Analysis
- max time kernel
147s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20250217-en - resource tags
- submitted
08/03/2025, 13:20
General
- Target Wannacry.exe
- Size 3.4MB
- Sample250308-qlc4baxpy3
- SHA256 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
Malware Config
Extracted
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]
-
wannacry
- Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �
-
115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn
Signatures
- Wannacry
WannaCry is a ransomware cryptoworm.
- Wannacry family
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Downloads MZ/PE file 2 IoCs
- Uses Session Manager for persistence 2 TTPs 3 IoCs
Creates Session Manager registry key to run executable early in system boot.
- Drops startup file 2 IoCs
- Executes dropped EXE 22 IoCs
- Loads dropped DLL 12 IoCs
- Modifies file permissions 1 TTPs 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks for any installed AV software in registry 1 TTPs 64 IoCs
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
- Writes to the Master Boot Record (MBR) 1 TTPs 5 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in System32 directory 2 IoCs
- Sets desktop wallpaper using registry 2 TTPs 2 IoCs
- Drops file in Program Files directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Embeds OpenSSL 1 IoCs
Embeds OpenSSL, may be used to circumvent TLS interception.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 22 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 9 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 4 IoCs
- Modifies registry key 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 37 IoCs
- Suspicious use of SendNotifyMessage 24 IoCs
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
- Views/modifies file attributes 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Wannacry.exe"C:\Users\Admin\AppData\Local\Temp\Wannacry.exe"1⤵
- Drops startup file
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib +h .2⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\icacls.exeicacls . /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 295311741440043.bat2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript.exe //nologo m.vbs3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +s F:\$RECYCLE2⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\taskhsvc.exeTaskData\Tor\taskhsvc.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start /b @[email protected] vs2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "xexgcbtro394" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\tasksche.exe\"" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "xexgcbtro394" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\tasksche.exe\"" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exe
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exe
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exe
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff9b75ecc40,0x7ff9b75ecc4c,0x7ff9b75ecc582⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1844,i,833048175034278552,2260892383069610704,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=1840 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1888,i,833048175034278552,2260892383069610704,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2056 /prefetch:32⤵
- Downloads MZ/PE file
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2284,i,833048175034278552,2260892383069610704,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2452 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3148,i,833048175034278552,2260892383069610704,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3168 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3188,i,833048175034278552,2260892383069610704,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3208 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4552,i,833048175034278552,2260892383069610704,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3740 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4728,i,833048175034278552,2260892383069610704,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4508 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4700,i,833048175034278552,2260892383069610704,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4832 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4972,i,833048175034278552,2260892383069610704,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4980 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5124,i,833048175034278552,2260892383069610704,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5128 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5180,i,833048175034278552,2260892383069610704,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5036 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5248,i,833048175034278552,2260892383069610704,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5292 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4968,i,833048175034278552,2260892383069610704,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5172 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5520,i,833048175034278552,2260892383069610704,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5300 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5476,i,833048175034278552,2260892383069610704,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5332 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5380,i,833048175034278552,2260892383069610704,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5048 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5608,i,833048175034278552,2260892383069610704,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5740 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=5324,i,833048175034278552,2260892383069610704,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5812 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=5308,i,833048175034278552,2260892383069610704,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5372 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=3176,i,833048175034278552,2260892383069610704,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3300 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=3284,i,833048175034278552,2260892383069610704,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5904 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=4144,i,833048175034278552,2260892383069610704,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5556 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=6212,i,833048175034278552,2260892383069610704,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6224 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=6208,i,833048175034278552,2260892383069610704,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6268 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4768,i,833048175034278552,2260892383069610704,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6392 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\avast_free_antivirus_setup_online.exe"C:\Users\Admin\Downloads\avast_free_antivirus_setup_online.exe"2⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\asw.ba0483fd5ce69d13\avast_free_antivirus_online_setup.exe"C:\Windows\Temp\asw.ba0483fd5ce69d13\avast_free_antivirus_online_setup.exe" /cookie:mmm_ava_003_999_a9c_m:dlid_FAV-ONLINE-HP /ga_clientid:57b1d578-9d14-4cd5-b2f6-7a1172cb9b23 /edat_dir:C:\Windows\Temp\asw.ba0483fd5ce69d13 /geo:GB3⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of FindShellTrayWindow
-
C:\Windows\Temp\asw-1d6ae504-6b20-468f-b566-885d4cdbdcc1\common\icarus.exeC:\Windows\Temp\asw-1d6ae504-6b20-468f-b566-885d4cdbdcc1\common\icarus.exe /icarus-info-path:C:\Windows\Temp\asw-1d6ae504-6b20-468f-b566-885d4cdbdcc1\icarus-info.xml /install /cookie:mmm_ava_003_999_a9c_m:dlid_FAV-ONLINE-HP /edat_dir:C:\Windows\Temp\asw.ba0483fd5ce69d13 /geo:GB /track-guid:57b1d578-9d14-4cd5-b2f6-7a1172cb9b23 /sssid:53564⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
-
C:\Windows\Temp\asw-1d6ae504-6b20-468f-b566-885d4cdbdcc1\common\icarus_ui.exeC:\Windows\Temp\asw-1d6ae504-6b20-468f-b566-885d4cdbdcc1\common\icarus_ui.exe /cookie:mmm_ava_003_999_a9c_m:dlid_FAV-ONLINE-HP /edat_dir:C:\Windows\Temp\asw.ba0483fd5ce69d13 /geo:GB /track-guid:57b1d578-9d14-4cd5-b2f6-7a1172cb9b23 /sssid:5356 /er_master:master_ep_4647c7b0-039a-4407-b4b6-fdf22c4ff688 /er_ui:ui_ep_3d587a55-4ec1-49b7-84f7-6053a434e12b5⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\Temp\asw-1d6ae504-6b20-468f-b566-885d4cdbdcc1\avast-av-vps\icarus.exeC:\Windows\Temp\asw-1d6ae504-6b20-468f-b566-885d4cdbdcc1\avast-av-vps\icarus.exe /cookie:mmm_ava_003_999_a9c_m:dlid_FAV-ONLINE-HP /edat_dir:C:\Windows\Temp\asw.ba0483fd5ce69d13 /geo:GB /track-guid:57b1d578-9d14-4cd5-b2f6-7a1172cb9b23 /sssid:5356 /er_master:master_ep_4647c7b0-039a-4407-b4b6-fdf22c4ff688 /er_ui:ui_ep_3d587a55-4ec1-49b7-84f7-6053a434e12b /er_slave:avast-av-vps_slave_ep_8436f7e5-fcc3-48b1-b73b-b8592db5c3f2 /slave:avast-av-vps5⤵
- Uses Session Manager for persistence
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Checks processor information in registry
-
-
C:\Windows\Temp\asw-1d6ae504-6b20-468f-b566-885d4cdbdcc1\avast-av\icarus.exeC:\Windows\Temp\asw-1d6ae504-6b20-468f-b566-885d4cdbdcc1\avast-av\icarus.exe /cookie:mmm_ava_003_999_a9c_m:dlid_FAV-ONLINE-HP /edat_dir:C:\Windows\Temp\asw.ba0483fd5ce69d13 /geo:GB /track-guid:57b1d578-9d14-4cd5-b2f6-7a1172cb9b23 /sssid:5356 /er_master:master_ep_4647c7b0-039a-4407-b4b6-fdf22c4ff688 /er_ui:ui_ep_3d587a55-4ec1-49b7-84f7-6053a434e12b /er_slave:avast-av_slave_ep_54160c7f-9fa2-46ed-a55c-bb4479ccc432 /slave:avast-av5⤵
- Uses Session Manager for persistence
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Checks processor information in registry
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Defense Evasion
File and Directory Permissions Modification
2Windows File and Directory Permissions Modification
1Hide Artifacts
1Hidden Files and Directories
1Indicator Removal
1File Deletion
1Modify Registry
4Pre-OS Boot
1Bootkit
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
ArPotEx32.dll
BCUEngine.dll
Sf2.dll
algo64.dll
aswJsFlt.dll
certs.map
db_ap2.dat
db_array.dat
db_as.dat
db_bank.dat
db_cmd.nmp
db_cmd.sig
db_conb.dat
db_dex.nmp
db_dex.sig
db_dns.nmp
db_dns.sig
db_dsign.dat
db_dyna.nmp
db_dyna.sig
db_el.dat
db_elf.nmp
db_elf.sig
db_elfa.nmp
db_elfa.sig
db_evope.dat
db_fn.nmp
db_fn.sig
db_java.nmp
db_java.sig
db_js.nmp
db_mu.dat
db_mx4.nmp
db_mx4.sig
db_mx95.nmp
db_mx95.sig
db_o7.nmp
db_o7.sig
db_o7c.dat
db_o7c.map
db_ob2.dat
db_pe.nmp
db_pe.sig
db_pe3.dat
db_pph.dat
db_sl.nmp
db_sl.sig
db_sn.nmp
db_sn.sig
db_snh.dat
db_str.nmp
db_str.sig
db_swf.nmp
db_swf.sig
db_symtrnl.dat
db_tx.dat
db_w6.nmp
db_w6.sig
db_w6c.dat
db_w6c.map
db_wat.nmp
db_wat.sig
db_wh2.dat
db_xtn.map
def.ini
list_i.txt
uiext.dll
Base.dll
Boot.dll
aswClnTg.htm
aswClnTg.txt
aswInfTg.htm
aswInfTg.txt
uiLangRes.dll
AavmRpch.dll
AvBugReport.exe
AvConsent.exe
AvDump.exe
AvEmUpdate.exe
AvLaunch.exe
AvastNM.exe
AvastSvc.exe
AvastUI.exe
BreachGuardSdk.dll
BrowserCleanup.ini
CommChannel.dll
CommonRes.dll
HTMLayout.dll
aswArDisk.sys
aswArPot.sys
aswBoot.exe
aswElam.sys
aswKbd.sys
aswMonFlt.sys
aswNetHub.sys
aswRdr2.sys
aswRvrt.sys
aswSP.sys
aswSnx.sys
aswStm.sys
aswVmm.sys
aswbidsdriver.sys
aswbidsh.sys
aswbuniv.sys
Boost.txt
Crypto++.txt
Detours.txt
GSL.txt
ICU.txt
JsonCpp.txt
LZMA.txt
OpenSSL.txt
PCRE.txt
Xerces.txt
brotli.txt
bsdiff.txt
bzip2.txt
c-ares.txt
cURL.txt
cef.txt
dnscrypt-proxy.txt
intel_asm.txt
jansson.txt
lexbor.txt.ipending.4634de02
libPNG.txt
libevent.txt
libsodium.txt
lzfse.txt
mbedTLS.txt
mhook.txt
nanopb.txt
nghttp2.txt
protobuf.txt
pugixml.txt
rapidjson.txt
sqlite.txt
unrar.txt
vxWidgets.txt
xmlParser.txt
xxHash.txt
yara.txt
zlib.txt
OobeUtil.exe
RegSvr.exe
aswPEAntivirus.exe
aswPEBrowser.exe
aswPECommander.exe
aswPEShell.exe
aswRegLib.dll
aswShMin.exe
background-loading.png
background.png
waikamd64.mst
wxbase315u_vc.dll
wxmsw315u_core_vc.dll
SetupInf.exe
SupportTool.exe
VisthAux.exe
afwCoreClient.dll
afwRpc.dll
afwServ.exe
anen.dll
ashBase.dll
ashQuick.exe
ashServ.dll
ashShell.dll
ashTask.dll
ashUpd.exe
aswAMSI.dll
aswAux.dll
aswAv.dll
aswAvBootTimeScanShMin.exe
aswBrowser.dll
aswChLic.exe
aswCmnBS.dll
aswCmnIS.dll
aswCmnOS.dll
aswDld.dll
aswEngLdr.dll
aswEngSrv.exe
aswIP.dll
aswLog.dll
aswProperty.dll
aswPropertyAv.dll
aswRunDll.exe
aswRvrt.dll
aswSqLt.dll
aswToolsSvc.exe
aswVmm.dll
aswW8ntf.dll
aswavdetection.dll
aswcomm.dll
aswdetallocator.dll
aswhook.dll
aswidpm.dll
aswidsagent.exe
aswntsqlite.dll
aswpsic.dll
aswremoval.dll
aswsecapi.dll
aswwinamapi.dll
api-ms-win-core-console-l1-1-0.dll
api-ms-win-core-console-l1-2-0.dll
api-ms-win-core-datetime-l1-1-0.dll
api-ms-win-core-debug-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-fibers-l1-1-0.dll
api-ms-win-core-file-l1-1-0.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-heap-l1-1-0.dll
api-ms-win-core-interlocked-l1-1-0.dll
api-ms-win-core-libraryloader-l1-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-memory-l1-1-0.dll
api-ms-win-core-namedpipe-l1-1-0.dll
api-ms-win-core-processenvironment-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-profile-l1-1-0.dll
api-ms-win-core-rtlsupport-l1-1-0.dll
api-ms-win-core-string-l1-1-0.dll
api-ms-win-core-synch-l1-1-0.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-sysinfo-l1-1-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-util-l1-1-0.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-multibyte-l1-1-0.dll
api-ms-win-crt-private-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
avast.local_vc142.crt.manifest
concrt140.dll
msvcp140.dll
msvcp140_1.dll
msvcp140_2.dll
msvcp140_atomic_wait.dll
msvcp140_codecvt_ids.dll
ucrtbase.dll
vccorlib140.dll
vcruntime140.dll
vcruntime140_1.dll
vcruntime140_threads.dll
brandcfg.js
brandingdata.js
policy.def
browser_pass.dll
burger_client.dll
chrome_100_percent.pak
chrome_200_percent.pak
chrome_elf.dll
crts.cat
d3dcompiler_47.dll
dll_loader.dll
dnd_helper.dll
event_manager.dll
event_manager_burger.dll
event_manager_er.dll
event_manager_ga.dll
event_routing.dll
event_routing_rpc.dll
ffl2.dll
firefox_pass.exe
fltlib_wrapper.dll
gaming_hook.exe
about.js
antiRansomware.js
antiTrack.js
ask.ogg
batterySaver.js
browserDetection.js
browserDetectionWindow.html
browserExtensions.js
ccaiWidgetStyle.css
core.js
darkWebMonitor.js
dashboard.js
dataShredder.js
deepProtect.js
doNotDisturb.js
done.ogg
driverUpdater.js
feedbackForm.js
firewall.js
help.js
i18n.js
kin.js
libs.js
locale-bn.json.ipending.4634de02
locale-ru.json
mainCss.css
mainCss_dark.css
mainCss_light.css
mainFont.css
mainFont_dark.css.ipending.4634de02
mainLayout.js
mainLayoutCss.css
mainLayoutCss_dark.css.ipending.4634de02
mainSprite.css.ipending.4634de02
mainSprite_light.css
mainVars.json
mainVars_dark.json
mainVars_dark_test.json
mainVars_light.json
mainVars_light_test.json
mainVars_test.json
mainWindow.html
myLicenses.js
napi.js
napiAdapter.js
napiExtensions.js
network.js
notifications.js
notify.ogg
offline.htm
overlay.html
pam.js
passwordProtection.js
plugins.js
ras.js
rescueDisk.js
sandbox.js
scans.js
search.js
secureBrowser.js
secureDns.js
secureLine.js
sensitiveData.js
settings.js
shields.js
smartScan.js
software.js
svelteComponents.js
svelteInternal.js
svgFlags.css
svgInline.svg
system.js
threat.ogg
tuneup.js
update.js
updatefile.json
virusChest.js
webCam.js
hns_tools.dll
icudtl.dat
jsbridge.dll
libEGL.dll
libGLESv2.dll
libcrypto-3-x64.dll
libssl-3-x64.dll
libwaapi.dll
libwaheap.dll
libwalocal.dll
libwaresource.dll
libwautils.dll
libwavmodapi.dll
am.pak
ar.pak
bg.pak
bn.pak
ca.pak
cs.pak
da.pak
de.pak
el.pak
en-GB.pak
en-US.pak
es-419.pak
es.pak
et.pak
fa.pak
fi.pak
fil.pak
fr.pak
gu.pak
he.pak
hi.pak
hr.pak
hu.pak
id.pak
it.pak
ja.pak
kn.pak
ko.pak
lt.pak
lv.pak
ml.pak
mr.pak
ms.pak
nb.pak
nl.pak
pl.pak
pt-BR.pak
pt-PT.pak
ro.pak
ru.pak
sk.pak
sl.pak
sr.pak
sv.pak
sw.pak
ta.pak
te.pak
th.pak
tr.pak
uk.pak
vi.pak
zh-CN.pak
zh-TW.pak
log.dll
mfc140.dll
mfc140u.dll
mfcm140.dll
mfcm140u.dll
module_lifetime.dll
nos.dll
ntp_time.dll
onnxruntime.dll
overseer.exe
perfstats.dll
process_monitor.dll
protobuf.dll
resources.pak
sched.exe
serialization.dll
config.def
config.def
shepherdsync.dll
snapshot_blob.bin
snxhk.dll
streamback.dll
su_adapter.dll
su_common.dll
su_controller.dll
su_worker.exe
libEGL.dll
libGLESv2.dll
task_performance_logger.dll
tasks_core.dll
uet_client.dll
v8_context_snapshot.bin
vaarclient.dll
wa_3rd_party_host_32.exe
wa_3rd_party_host_64.exe
wsc.dll
wsc_proxy.exe
wsc_proxy.exe.manifest
AavmRpch.dll
AvDump.exe
RegSvr.exe
ashShell.dll
aswAMSI.dll
aswBrowser.dll
aswCmnBS.dll
aswCmnIS.dll
aswCmnOS.dll
aswProperty.dll
aswPropertyAv.dll
aswRunDll.exe
aswhook.dll
API-MS-Win-core-xstate-l2-1-0.dll
api-ms-win-core-console-l1-1-0.dll
api-ms-win-core-console-l1-2-0.dll
api-ms-win-core-datetime-l1-1-0.dll
api-ms-win-core-debug-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-fibers-l1-1-0.dll
api-ms-win-core-file-l1-1-0.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-heap-l1-1-0.dll
api-ms-win-core-interlocked-l1-1-0.dll
api-ms-win-core-libraryloader-l1-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-memory-l1-1-0.dll
api-ms-win-core-namedpipe-l1-1-0.dll
api-ms-win-core-processenvironment-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-profile-l1-1-0.dll
api-ms-win-core-rtlsupport-l1-1-0.dll
api-ms-win-core-string-l1-1-0.dll
api-ms-win-core-synch-l1-1-0.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-sysinfo-l1-1-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-util-l1-1-0.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-multibyte-l1-1-0.dll
api-ms-win-crt-private-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
avast.local_vc142.crt.manifest
concrt140.dll
msvcp140.dll
msvcp140_1.dll
msvcp140_2.dll
msvcp140_atomic_wait.dll
msvcp140_codecvt_ids.dll
ucrtbase.dll
vccorlib140.dll
vcruntime140.dll
vcruntime140_threads.dll
dll_loader.dll
dnd_helper.dll
firefox_pass.exe
gaming_hook.exe
snxhk.dll
OpenSans-Bold.ttf
OpenSans-Italic.ttf
OpenSans-Light.ttf
OpenSans-Regular.ttf
RobotoCondensed-Bold.ttf
RobotoCondensed-Regular.ttf
proximanova-bold.otf
proximanova-light.otf
proximanova-regular.otf
Blocked.htm
image001.png
config.xml.ipending.4634de02
macaddr.db.ipending.4634de02
networks.xml.ipending.4634de02
ports.xml.ipending.4634de02
rules.xml.ipending.4634de02
templates.xml.ipending.4634de02
dnddetection.dat
dnddetection.dat.ver
dndrules.dat
dndrules.dat.ver
overseer_unattend.xml
profile.wprp
settings-25.2.9898.2555.ori
snx_gconfig.xml
icarus.ini
icarus.ini
icarus.ini
BrowsingTopicsState
the-real-index
the-real-index~RFe59047b.TMP
messages.json
dasherSettingSchema.json
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
TransportSecurity
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
the-real-index
the-real-index~RFe58b6e7.TMP
c6131e90-d200-4cd5-934e-9248c2d948f0.tmp
Local State
Local State
00000000.res
295311741440043.bat
libeay32.dll
libevent-2-0-5.dll
libgcc_s_sjlj-1.dll
libssp-0.dll
ssleay32.dll
tor.exe
zlib1.dll
b.wnry
c.wnry
c.wnry
m.vbs
m_bulgarian.wnry
m_chinese (simplified).wnry
m_chinese (traditional).wnry
m_croatian.wnry
m_czech.wnry
m_danish.wnry
m_dutch.wnry
m_english.wnry
m_filipino.wnry
m_finnish.wnry
m_french.wnry
m_german.wnry
m_greek.wnry
m_indonesian.wnry
m_italian.wnry
m_japanese.wnry
m_korean.wnry
m_latvian.wnry
m_norwegian.wnry
m_polish.wnry
m_portuguese.wnry
m_romanian.wnry
m_russian.wnry
m_slovak.wnry
m_spanish.wnry
m_swedish.wnry
m_turkish.wnry
m_vietnamese.wnry
r.wnry
s.wnry
messages.json
d93fba36-383e-49c1-973f-417e21426b6a.tmp
t.wnry
taskdl.exe
taskse.exe
u.wnry
cached-microdescs.new
avast_free_antivirus_setup_online.exe
icarus_rvrt.exe
bug_report.exe
dump_process.exe
icarus.exe
icarus_ui.exe
product-def.xml
setupui.cont
memory/3772-1436-0x0000000000ED0000-0x00000000011CE000-memory.dmp
memory/3772-1412-0x0000000000ED0000-0x00000000011CE000-memory.dmp
memory/3772-1880-0x00000000743A0000-0x00000000745BC000-memory.dmp
memory/3772-1415-0x0000000000ED0000-0x00000000011CE000-memory.dmp
memory/3772-1438-0x00000000743A0000-0x00000000745BC000-memory.dmp
memory/3772-2349-0x0000000000ED0000-0x00000000011CE000-memory.dmp
memory/3772-1429-0x0000000000ED0000-0x00000000011CE000-memory.dmp
memory/3772-1408-0x0000000074640000-0x00000000746C2000-memory.dmp
memory/3772-1411-0x00000000742C0000-0x00000000742E2000-memory.dmp
memory/3772-1409-0x00000000743A0000-0x00000000745BC000-memory.dmp
memory/3772-1410-0x0000000074310000-0x0000000074392000-memory.dmp
memory/3772-1878-0x0000000000ED0000-0x00000000011CE000-memory.dmp
memory/3772-1416-0x0000000074640000-0x00000000746C2000-memory.dmp
memory/3772-1421-0x00000000745C0000-0x0000000074637000-memory.dmp
memory/3772-1420-0x00000000742C0000-0x00000000742E2000-memory.dmp
memory/3772-1419-0x00000000742F0000-0x000000007430C000-memory.dmp
memory/3772-1418-0x0000000074310000-0x0000000074392000-memory.dmp
memory/3772-1417-0x00000000743A0000-0x00000000745BC000-memory.dmp
memory/3772-1952-0x0000000000ED0000-0x00000000011CE000-memory.dmp
memory/3772-1954-0x00000000743A0000-0x00000000745BC000-memory.dmp
memory/3772-2135-0x0000000000ED0000-0x00000000011CE000-memory.dmp
memory/3772-2202-0x0000000000ED0000-0x00000000011CE000-memory.dmp
memory/4748-39-0x0000000010000000-0x0000000010010000-memory.dmp