Analysis
- max time kernel
137s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20250217-en - resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system - submitted
06/03/2025, 14:49
Behavioral task
behavioral1
Sample
2025-03-06_555e8ed0f12b8da94ebe6758d7632499_wannacry.exe
Resource
win7-20240729-en
windows7-x64
23 signatures
150 seconds
Behavioral task
behavioral2
Sample
2025-03-06_555e8ed0f12b8da94ebe6758d7632499_wannacry.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
26 signatures
150 seconds
General
- Target 2025-03-06_555e8ed0f12b8da94ebe6758d7632499_wannacry.exe
- Size 5.6MB
- Sample250306-r7fxrs1set
- SHA256 177e0e48486fb7fe18d176c78d79ce5121f9f94541f0f3309f38adfb61433fc1
- MD5 555e8ed0f12b8da94ebe6758d7632499
- SHA1 e176566ffa6d1a4577298221277b46de31b7fd85
- SHA512 280e8d3b061f1adf9d6d3a370d9b6e88846d744e0762ee89591963f4d0e8c9358324056d42148a44f0f09c5808df4287f1fdece7f708113739bdda7d935fe447
- SSDEEP 768:rn3kInjryJpVCoJ7r9iwnnnnnnng0entC:T3kIjGF7r9iwnnnnnnnAntC
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Chaos
Ransomware family first seen in June 2021.
- Chaos Ransomware 2 IoCs
resource yara_rule behavioral2/memory/884-1-0x0000000000730000-0x0000000000CD4000-memory.dmp family_chaos behavioral2/files/0x000a00000001daff-6.dat family_chaos - Chaos family
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 3540 bcdedit.exe 972 bcdedit.exe -
pid Process 3728 wbadmin.exe - Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000\Control Panel\International\Geo\Nation 2025-03-06_555e8ed0f12b8da94ebe6758d7632499_wannacry.exe Key value queried \REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000\Control Panel\International\Geo\Nation wininit.exe - Drops startup file 3 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wininit.url wininit.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini wininit.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\overwritten.html wininit.exe - Executes dropped EXE 1 IoCs
pid Process 624 wininit.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 34 IoCs
description ioc Process File opened for modification C:\Users\Admin\Documents\desktop.ini wininit.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini wininit.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini wininit.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini wininit.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini wininit.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini wininit.exe File opened for modification C:\Users\Admin\Searches\desktop.ini wininit.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini wininit.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini wininit.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini wininit.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini wininit.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini wininit.exe File opened for modification C:\Users\Public\Desktop\desktop.ini wininit.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini wininit.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini wininit.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini wininit.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini wininit.exe File opened for modification C:\Users\Public\Videos\desktop.ini wininit.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini wininit.exe File opened for modification C:\Users\Admin\Music\desktop.ini wininit.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini wininit.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini wininit.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini wininit.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini wininit.exe File opened for modification C:\Users\Public\Documents\desktop.ini wininit.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1479699283-3000499823-2337359760-1000\desktop.ini wininit.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini wininit.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini wininit.exe File opened for modification C:\Users\Public\Pictures\desktop.ini wininit.exe File opened for modification C:\Users\Admin\Links\desktop.ini wininit.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini wininit.exe File opened for modification C:\Users\Admin\Videos\desktop.ini wininit.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini wininit.exe File opened for modification C:\Users\Public\Music\desktop.ini wininit.exe - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zocn2q45a.jpg" wininit.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 vds.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2112 vssadmin.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 624 wininit.exe - Suspicious behavior: EnumeratesProcesses 59 IoCs
pid Process 884 2025-03-06_555e8ed0f12b8da94ebe6758d7632499_wannacry.exe 884 2025-03-06_555e8ed0f12b8da94ebe6758d7632499_wannacry.exe 884 2025-03-06_555e8ed0f12b8da94ebe6758d7632499_wannacry.exe 884 2025-03-06_555e8ed0f12b8da94ebe6758d7632499_wannacry.exe 884 2025-03-06_555e8ed0f12b8da94ebe6758d7632499_wannacry.exe 884 2025-03-06_555e8ed0f12b8da94ebe6758d7632499_wannacry.exe 884 2025-03-06_555e8ed0f12b8da94ebe6758d7632499_wannacry.exe 884 2025-03-06_555e8ed0f12b8da94ebe6758d7632499_wannacry.exe 884 2025-03-06_555e8ed0f12b8da94ebe6758d7632499_wannacry.exe 884 2025-03-06_555e8ed0f12b8da94ebe6758d7632499_wannacry.exe 884 2025-03-06_555e8ed0f12b8da94ebe6758d7632499_wannacry.exe 884 2025-03-06_555e8ed0f12b8da94ebe6758d7632499_wannacry.exe 884 2025-03-06_555e8ed0f12b8da94ebe6758d7632499_wannacry.exe 884 2025-03-06_555e8ed0f12b8da94ebe6758d7632499_wannacry.exe 884 2025-03-06_555e8ed0f12b8da94ebe6758d7632499_wannacry.exe 884 2025-03-06_555e8ed0f12b8da94ebe6758d7632499_wannacry.exe 884 2025-03-06_555e8ed0f12b8da94ebe6758d7632499_wannacry.exe 884 2025-03-06_555e8ed0f12b8da94ebe6758d7632499_wannacry.exe 884 2025-03-06_555e8ed0f12b8da94ebe6758d7632499_wannacry.exe 884 2025-03-06_555e8ed0f12b8da94ebe6758d7632499_wannacry.exe 884 2025-03-06_555e8ed0f12b8da94ebe6758d7632499_wannacry.exe 884 2025-03-06_555e8ed0f12b8da94ebe6758d7632499_wannacry.exe 884 2025-03-06_555e8ed0f12b8da94ebe6758d7632499_wannacry.exe 884 2025-03-06_555e8ed0f12b8da94ebe6758d7632499_wannacry.exe 884 2025-03-06_555e8ed0f12b8da94ebe6758d7632499_wannacry.exe 624 wininit.exe 624 wininit.exe 624 wininit.exe 624 wininit.exe 624 wininit.exe 624 wininit.exe 624 wininit.exe 624 wininit.exe 624 wininit.exe 624 wininit.exe 624 wininit.exe 624 wininit.exe 624 wininit.exe 624 wininit.exe 624 wininit.exe 624 wininit.exe 624 wininit.exe 624 wininit.exe 624 wininit.exe 624 wininit.exe 624 wininit.exe 624 wininit.exe 624 wininit.exe 624 wininit.exe 3480 msedge.exe 3480 msedge.exe 3924 msedge.exe 3924 msedge.exe 5172 identity_helper.exe 5172 identity_helper.exe 5692 msedge.exe 5692 msedge.exe 5692 msedge.exe 5692 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe - Suspicious use of AdjustPrivilegeToken 50 IoCs
description pid Process Token: SeDebugPrivilege 884 2025-03-06_555e8ed0f12b8da94ebe6758d7632499_wannacry.exe Token: SeDebugPrivilege 624 wininit.exe Token: SeBackupPrivilege 4336 vssvc.exe Token: SeRestorePrivilege 4336 vssvc.exe Token: SeAuditPrivilege 4336 vssvc.exe Token: SeIncreaseQuotaPrivilege 2240 WMIC.exe Token: SeSecurityPrivilege 2240 WMIC.exe Token: SeTakeOwnershipPrivilege 2240 WMIC.exe Token: SeLoadDriverPrivilege 2240 WMIC.exe Token: SeSystemProfilePrivilege 2240 WMIC.exe Token: SeSystemtimePrivilege 2240 WMIC.exe Token: SeProfSingleProcessPrivilege 2240 WMIC.exe Token: SeIncBasePriorityPrivilege 2240 WMIC.exe Token: SeCreatePagefilePrivilege 2240 WMIC.exe Token: SeBackupPrivilege 2240 WMIC.exe Token: SeRestorePrivilege 2240 WMIC.exe Token: SeShutdownPrivilege 2240 WMIC.exe Token: SeDebugPrivilege 2240 WMIC.exe Token: SeSystemEnvironmentPrivilege 2240 WMIC.exe Token: SeRemoteShutdownPrivilege 2240 WMIC.exe Token: SeUndockPrivilege 2240 WMIC.exe Token: SeManageVolumePrivilege 2240 WMIC.exe Token: 33 2240 WMIC.exe Token: 34 2240 WMIC.exe Token: 35 2240 WMIC.exe Token: 36 2240 WMIC.exe Token: SeIncreaseQuotaPrivilege 2240 WMIC.exe Token: SeSecurityPrivilege 2240 WMIC.exe Token: SeTakeOwnershipPrivilege 2240 WMIC.exe Token: SeLoadDriverPrivilege 2240 WMIC.exe Token: SeSystemProfilePrivilege 2240 WMIC.exe Token: SeSystemtimePrivilege 2240 WMIC.exe Token: SeProfSingleProcessPrivilege 2240 WMIC.exe Token: SeIncBasePriorityPrivilege 2240 WMIC.exe Token: SeCreatePagefilePrivilege 2240 WMIC.exe Token: SeBackupPrivilege 2240 WMIC.exe Token: SeRestorePrivilege 2240 WMIC.exe Token: SeShutdownPrivilege 2240 WMIC.exe Token: SeDebugPrivilege 2240 WMIC.exe Token: SeSystemEnvironmentPrivilege 2240 WMIC.exe Token: SeRemoteShutdownPrivilege 2240 WMIC.exe Token: SeUndockPrivilege 2240 WMIC.exe Token: SeManageVolumePrivilege 2240 WMIC.exe Token: 33 2240 WMIC.exe Token: 34 2240 WMIC.exe Token: 35 2240 WMIC.exe Token: 36 2240 WMIC.exe Token: SeBackupPrivilege 220 wbengine.exe Token: SeRestorePrivilege 220 wbengine.exe Token: SeSecurityPrivilege 220 wbengine.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 884 wrote to memory of 624 884 2025-03-06_555e8ed0f12b8da94ebe6758d7632499_wannacry.exe 93 PID 884 wrote to memory of 624 884 2025-03-06_555e8ed0f12b8da94ebe6758d7632499_wannacry.exe 93 PID 624 wrote to memory of 4044 624 wininit.exe 96 PID 624 wrote to memory of 4044 624 wininit.exe 96 PID 4044 wrote to memory of 2112 4044 cmd.exe 98 PID 4044 wrote to memory of 2112 4044 cmd.exe 98 PID 4044 wrote to memory of 2240 4044 cmd.exe 101 PID 4044 wrote to memory of 2240 4044 cmd.exe 101 PID 624 wrote to memory of 2640 624 wininit.exe 102 PID 624 wrote to memory of 2640 624 wininit.exe 102 PID 2640 wrote to memory of 3540 2640 cmd.exe 105 PID 2640 wrote to memory of 3540 2640 cmd.exe 105 PID 2640 wrote to memory of 972 2640 cmd.exe 106 PID 2640 wrote to memory of 972 2640 cmd.exe 106 PID 624 wrote to memory of 5072 624 wininit.exe 107 PID 624 wrote to memory of 5072 624 wininit.exe 107 PID 5072 wrote to memory of 3728 5072 cmd.exe 109 PID 5072 wrote to memory of 3728 5072 cmd.exe 109 PID 624 wrote to memory of 3924 624 wininit.exe 114 PID 624 wrote to memory of 3924 624 wininit.exe 114 PID 3924 wrote to memory of 3912 3924 msedge.exe 115 PID 3924 wrote to memory of 3912 3924 msedge.exe 115 PID 3924 wrote to memory of 5088 3924 msedge.exe 117 PID 3924 wrote to memory of 5088 3924 msedge.exe 117 PID 3924 wrote to memory of 5088 3924 msedge.exe 117 PID 3924 wrote to memory of 5088 3924 msedge.exe 117 PID 3924 wrote to memory of 5088 3924 msedge.exe 117 PID 3924 wrote to memory of 5088 3924 msedge.exe 117 PID 3924 wrote to memory of 5088 3924 msedge.exe 117 PID 3924 wrote to memory of 5088 3924 msedge.exe 117 PID 3924 wrote to memory of 5088 3924 msedge.exe 117 PID 3924 wrote to memory of 5088 3924 msedge.exe 117 PID 3924 wrote to memory of 5088 3924 msedge.exe 117 PID 3924 wrote to memory of 5088 3924 msedge.exe 117 PID 3924 wrote to memory of 5088 3924 msedge.exe 117 PID 3924 wrote to memory of 5088 3924 msedge.exe 117 PID 3924 wrote to memory of 5088 3924 msedge.exe 117 PID 3924 wrote to memory of 5088 3924 msedge.exe 117 PID 3924 wrote to memory of 5088 3924 msedge.exe 117 PID 3924 wrote to memory of 5088 3924 msedge.exe 117 PID 3924 wrote to memory of 5088 3924 msedge.exe 117 PID 3924 wrote to memory of 5088 3924 msedge.exe 117 PID 3924 wrote to memory of 5088 3924 msedge.exe 117 PID 3924 wrote to memory of 5088 3924 msedge.exe 117 PID 3924 wrote to memory of 5088 3924 msedge.exe 117 PID 3924 wrote to memory of 5088 3924 msedge.exe 117 PID 3924 wrote to memory of 5088 3924 msedge.exe 117 PID 3924 wrote to memory of 5088 3924 msedge.exe 117 PID 3924 wrote to memory of 5088 3924 msedge.exe 117 PID 3924 wrote to memory of 5088 3924 msedge.exe 117 PID 3924 wrote to memory of 5088 3924 msedge.exe 117 PID 3924 wrote to memory of 5088 3924 msedge.exe 117 PID 3924 wrote to memory of 5088 3924 msedge.exe 117 PID 3924 wrote to memory of 5088 3924 msedge.exe 117 PID 3924 wrote to memory of 5088 3924 msedge.exe 117 PID 3924 wrote to memory of 5088 3924 msedge.exe 117 PID 3924 wrote to memory of 5088 3924 msedge.exe 117 PID 3924 wrote to memory of 5088 3924 msedge.exe 117 PID 3924 wrote to memory of 5088 3924 msedge.exe 117 PID 3924 wrote to memory of 5088 3924 msedge.exe 117 PID 3924 wrote to memory of 5088 3924 msedge.exe 117 PID 3924 wrote to memory of 5088 3924 msedge.exe 117 PID 3924 wrote to memory of 3480 3924 msedge.exe 118 PID 3924 wrote to memory of 3480 3924 msedge.exe 118 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-03-06_555e8ed0f12b8da94ebe6758d7632499_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2025-03-06_555e8ed0f12b8da94ebe6758d7632499_wannacry.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Users\Admin\AppData\Roaming\wininit.exe"C:\Users\Admin\AppData\Roaming\wininit.exe"2⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete3⤵
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
PID:2112
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2240
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no3⤵
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
PID:3540
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
PID:972
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet3⤵
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet4⤵
- Deletes backup catalog
PID:3728
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Roaming\overwritten.html3⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe3b5846f8,0x7ffe3b584708,0x7ffe3b5847184⤵PID:3912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,6126571848849935182,17174989364481735713,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:24⤵PID:5088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,6126571848849935182,17174989364481735713,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:34⤵
- Suspicious behavior: EnumeratesProcesses
PID:3480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,6126571848849935182,17174989364481735713,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:84⤵PID:4060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6126571848849935182,17174989364481735713,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:14⤵PID:464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6126571848849935182,17174989364481735713,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:14⤵PID:2252
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,6126571848849935182,17174989364481735713,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:84⤵PID:548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,6126571848849935182,17174989364481735713,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:84⤵
- Suspicious behavior: EnumeratesProcesses
PID:5172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6126571848849935182,17174989364481735713,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4236 /prefetch:14⤵PID:5260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6126571848849935182,17174989364481735713,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:14⤵PID:5268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6126571848849935182,17174989364481735713,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4064 /prefetch:14⤵PID:5484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6126571848849935182,17174989364481735713,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:14⤵PID:5492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,6126571848849935182,17174989364481735713,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1828 /prefetch:24⤵
- Suspicious behavior: EnumeratesProcesses
PID:5692
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4336
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:220
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:5036
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
PID:4728
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:452
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2632
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Direct Volume Access
1Indicator Removal
3File Deletion
3Modify Registry
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 8786fd66f4602e6ed3fa5248bd597b3f362ffa458f85207eaa154beb55522348
- MD5 93be3a1bf9c257eaf83babf49b0b5e01
- SHA1 d55c01e95c2e6a87a5ece8cc1d466cc98a520e2a
- SHA512 885b09dd3072921f375eedb5f0575561adc89700ecfbe999bc3e5ea1d7cb45e19d85c5e420f2c0a12b428742e1110e66f4ceecbe5a6badddd36cc9e0aff48e52
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 ca80bbae3c392e46d730a53d0ee4cfecbbe45c264ad3b3c7ee287252c21eaeab
- MD5 6738f4e2490ee5070d850bf03bf3efa5
- SHA1 fbc49d2dd145369e8861532e6ebf0bd56a0fe67c
- SHA512 2939edf5e6c34c9ea669a129a4a5a410fbbd29cd504dc8e007e9b3b3c7fbb9bea8c14d6177ac375d0c481995774a02d210328569231cb01db07b59452333b22b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 964f316073894a08236381ae1ba9b18b103e2f8eedd64128479db45eba9e5844
- MD5 54490f9db1ea73768e440eaba5158cbd
- SHA1 26fb3e75b74be3a752b096dc2cf68303232c1c78
- SHA512 24ad35164ab3ef0db378ceaa73b32e220c33a84047781ea3521cfe994630b78b2077dc4466515001a8aeaa41bb979d2cfa99ece56f75b2063c072f0ed022c414
- SSDEEP 96:n6k1wEY1LDV2QwpvWMoiVmdeHXtHy56UWQyV+VDCziEwb:n6kwRhGWMXq6ro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 b3939dc283cf9167991277f5ab66b25ed86dca82ea4eaa52b70b3b16a51b1d4c
- MD5 b950e90dd1e7cf2734a0122953a00d07
- SHA1 68b031c20f49569c906aa4b3d6c8093ab0ea7ce1
- SHA512 16ecdb70366e1e165e8cbbe3a34917f68afceab74275cd8264fb1c1941ae3bb26c7601bbb7f5379d4d48b20ed014cbee20f13daba704b4b0a1a207b7ea1c9037
- SSDEEP 96:n6kVwEY1LDV2QwpvWMoiVmdeHXtHy56UWQyV+VD7AiEwb:n6kQRhGWMXq6rg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 61c07a7c2c999783982b9bc3534cc54078345c8bacb6065cbde2d38943057eec
- MD5 5ea3cc702b56646ab6bd3bed6b7fa69b
- SHA1 895a13b9b3a8f7231f47cdd3d1ca88c93a8fed54
- SHA512 d532e9dab5c41e0de60abe021e153c23cfd44dfd0abc55d89ff6fbe9abc465657e1358f97113463da141525e447be42b9a90ce88bf5236af93e0f9e7ff0183b5
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupOe2RU4/oRuOIesGG3q/7Jw:A9iIxuERzA83h09RZxYQdDOvsGG3q/7K
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\wininit.exe
- Size 5.6MB
- SHA256 177e0e48486fb7fe18d176c78d79ce5121f9f94541f0f3309f38adfb61433fc1
- MD5 555e8ed0f12b8da94ebe6758d7632499
- SHA1 e176566ffa6d1a4577298221277b46de31b7fd85
- SHA512 280e8d3b061f1adf9d6d3a370d9b6e88846d744e0762ee89591963f4d0e8c9358324056d42148a44f0f09c5808df4287f1fdece7f708113739bdda7d935fe447
- SSDEEP 768:rn3kInjryJpVCoJ7r9iwnnnnnnng0entC:T3kIjGF7r9iwnnnnnnnAntC
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Desktop\overwritten.html
- Size 82B
- SHA256 8fe31ddd89b9f3f9e5107d24d0a1184ab1047fe89142b66d1eba1e117eba2ba3
- MD5 fa4a3a1d2ab22fa84d84ec6646c7885c
- SHA1 4b9a1e8c6535a9d3e76eb773bb9c54bb852e1eac
- SHA512 bade982388c07caf9c2b8c967c9f38627b9511294022f710404ecbb18a6d36777b7df7668e175e79d7d642b682c2a3c9fac60d27d7dbc37672579d330d6a2145
- MD5 SHA1 SHA512