f557516d6afae3e96fb896a1164a2d8d8809a97e6f0a573cc507dc6a9398832a

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 04:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_a733e1924ac04a2fc48f284376c671a6_elex_wannacry.exe
Size 597KB
Sample260629-etwpvad14j
SHA256 f557516d6afae3e96fb896a1164a2d8d8809a97e6f0a573cc507dc6a9398832a
MD5 a733e1924ac04a2fc48f284376c671a6
SHA1 77f1c2270a7b1393f51b8e0c2dca016415f2901a
SHA512 3b5a07b7881a781c1c2ef3e5bd8a540cfad8eb09a09baa412ee0a8c3886d2934cf781a42065f7fa64d6ca54a863b51fb05b68eacd9914fae9daf4174ddb93b83
SSDEEP 3072:CGC43DkTv+XZZpS000000000000000000000000000000000000000000000000w:CGC43pZUprrrrrrrrrrrrrrrrrrm
TLSH
T11FD4F7D5B6825363EB420530E02F0F78226EBD9B904A6405A7E37B534B771069DEE1BF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection defense_evasion discovery

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 5 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	2026-06-27_a733e1924ac04a2fc48f284376c671a6_elex_wannacry.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	svchost.eXe
Set value (int)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	svchost.eXe
Set value (int)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	msmsgs.eXe
Set value (int)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	angle.eXe

Disables RegEdit via registry modification 4 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "2"	svchost.eXe
Set value (int)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "2"	svchost.eXe
Set value (int)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "2"	msmsgs.eXe
Set value (int)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "2"	angle.eXe

Executes dropped EXE 4 IoCs

pid	Process
3988	svchost.eXe
4696	svchost.eXe
4324	msmsgs.eXe
5712	angle.eXe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	msmsgs.eXe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\angle.eXe	angle.eXe
File created	C:\Windows\SysWOW64\angle.eXe	2026-06-27_a733e1924ac04a2fc48f284376c671a6_elex_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\RCX20D0.tmp	2026-06-27_a733e1924ac04a2fc48f284376c671a6_elex_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\angle.eXe	svchost.eXe
File opened for modification	C:\Windows\SysWOW64\RCX5635.tmp	svchost.eXe
File opened for modification	C:\Windows\SysWOW64\angle.eXe	2026-06-27_a733e1924ac04a2fc48f284376c671a6_elex_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\RCX5625.tmp	svchost.eXe
File opened for modification	C:\Windows\SysWOW64\angle.eXe	svchost.eXe
File created	C:\Windows\SysWOW64\angle.eXe	msmsgs.eXe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office\WINWORD.exe	2026-06-27_a733e1924ac04a2fc48f284376c671a6_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office11\WINWORD.exe	2026-06-27_a733e1924ac04a2fc48f284376c671a6_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office\EXCEL.exe	2026-06-27_a733e1924ac04a2fc48f284376c671a6_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office11\EXCEL.exe	2026-06-27_a733e1924ac04a2fc48f284376c671a6_elex_wannacry.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\svchost.eXe	2026-06-27_a733e1924ac04a2fc48f284376c671a6_elex_wannacry.exe
File opened for modification	C:\Windows\ziprar.eXe	2026-06-27_a733e1924ac04a2fc48f284376c671a6_elex_wannacry.exe
File created	C:\Windows\svchost.eXe	msmsgs.eXe
File opened for modification	C:\Windows\svchost.eXe	angle.eXe
File opened for modification	C:\Windows\svchost.eXe	2026-06-27_a733e1924ac04a2fc48f284376c671a6_elex_wannacry.exe
File opened for modification	C:\Windows\RCX20CF.tmp	2026-06-27_a733e1924ac04a2fc48f284376c671a6_elex_wannacry.exe
File created	C:\Windows\ziprar.eXe	2026-06-27_a733e1924ac04a2fc48f284376c671a6_elex_wannacry.exe
File opened for modification	C:\Windows\RCX2E2F.tmp	2026-06-27_a733e1924ac04a2fc48f284376c671a6_elex_wannacry.exe
File opened for modification	C:\Windows\svchost.eXe	svchost.eXe
File opened for modification	C:\Windows\RCX5625.tmp	svchost.eXe
File created	C:\Windows\svchost.eXe	svchost.eXe
File opened for modification	C:\Windows\RCX5886.tmp	angle.eXe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 27 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_a733e1924ac04a2fc48f284376c671a6_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msmsgs.eXe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	angle.eXe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.eXe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.eXe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\CLSID\{53BEDF0B-4E5B-4183-8DC9-B844344FA104}	msmsgs.eXe
Set value (str)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\CLSID\{53BEDF0B-4E5B-4183-8DC9-B844344FA104}\AppId = "{6d2b5079-2f0b-48dd-ab7f-97cec514d30b}"	msmsgs.eXe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4324	msmsgs.eXe
4324	msmsgs.eXe
4324	msmsgs.eXe
4324	msmsgs.eXe
4324	msmsgs.eXe
4324	msmsgs.eXe
4324	msmsgs.eXe
4324	msmsgs.eXe
4324	msmsgs.eXe
4324	msmsgs.eXe
4324	msmsgs.eXe
4324	msmsgs.eXe
4324	msmsgs.eXe
4324	msmsgs.eXe
4324	msmsgs.eXe
4324	msmsgs.eXe
4324	msmsgs.eXe
4324	msmsgs.eXe
4324	msmsgs.eXe
4324	msmsgs.eXe
4324	msmsgs.eXe
4324	msmsgs.eXe
4324	msmsgs.eXe
4324	msmsgs.eXe
4324	msmsgs.eXe
4324	msmsgs.eXe
4324	msmsgs.eXe
4324	msmsgs.eXe
4324	msmsgs.eXe
4324	msmsgs.eXe
4324	msmsgs.eXe
4324	msmsgs.eXe
4324	msmsgs.eXe
4324	msmsgs.eXe
4324	msmsgs.eXe
4324	msmsgs.eXe
4324	msmsgs.eXe
4324	msmsgs.eXe
4324	msmsgs.eXe
4324	msmsgs.eXe
4324	msmsgs.eXe
4324	msmsgs.eXe
4324	msmsgs.eXe
4324	msmsgs.eXe
4324	msmsgs.eXe
4324	msmsgs.eXe
4324	msmsgs.eXe
4324	msmsgs.eXe
4324	msmsgs.eXe
4324	msmsgs.eXe
4324	msmsgs.eXe
4324	msmsgs.eXe
4324	msmsgs.eXe
4324	msmsgs.eXe
4324	msmsgs.eXe
4324	msmsgs.eXe
4324	msmsgs.eXe
4324	msmsgs.eXe
4324	msmsgs.eXe
4324	msmsgs.eXe
4324	msmsgs.eXe
4324	msmsgs.eXe
4324	msmsgs.eXe
4324	msmsgs.eXe

Suspicious behavior: LoadsDriver 5 IoCs

pid
4
4
4
4
4

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4324	msmsgs.eXe
Token: SeDebugPrivilege	4324	msmsgs.eXe
Token: SeDebugPrivilege	4324	msmsgs.eXe
Token: SeDebugPrivilege	4324	msmsgs.eXe
Token: SeDebugPrivilege	4324	msmsgs.eXe
Token: SeDebugPrivilege	4324	msmsgs.eXe
Token: SeDebugPrivilege	4324	msmsgs.eXe
Token: SeDebugPrivilege	4324	msmsgs.eXe
Token: SeDebugPrivilege	4324	msmsgs.eXe
Token: SeDebugPrivilege	4324	msmsgs.eXe
Token: SeDebugPrivilege	4324	msmsgs.eXe
Token: SeDebugPrivilege	4324	msmsgs.eXe
Token: SeDebugPrivilege	4324	msmsgs.eXe
Token: SeDebugPrivilege	4324	msmsgs.eXe
Token: SeDebugPrivilege	4324	msmsgs.eXe
Token: SeDebugPrivilege	4324	msmsgs.eXe
Token: SeDebugPrivilege	4324	msmsgs.eXe
Token: SeDebugPrivilege	4324	msmsgs.eXe
Token: SeDebugPrivilege	4324	msmsgs.eXe
Token: SeDebugPrivilege	4324	msmsgs.eXe
Token: SeDebugPrivilege	4324	msmsgs.eXe
Token: SeDebugPrivilege	4324	msmsgs.eXe
Token: SeDebugPrivilege	4324	msmsgs.eXe
Token: SeDebugPrivilege	4324	msmsgs.eXe
Token: SeDebugPrivilege	4324	msmsgs.eXe
Token: SeDebugPrivilege	4324	msmsgs.eXe
Token: SeDebugPrivilege	4324	msmsgs.eXe
Token: SeDebugPrivilege	4324	msmsgs.eXe
Token: SeDebugPrivilege	4324	msmsgs.eXe
Token: SeDebugPrivilege	4324	msmsgs.eXe
Token: SeDebugPrivilege	4324	msmsgs.eXe
Token: SeDebugPrivilege	4324	msmsgs.eXe
Token: SeDebugPrivilege	4324	msmsgs.eXe
Token: SeDebugPrivilege	4324	msmsgs.eXe
Token: SeDebugPrivilege	4324	msmsgs.eXe
Token: SeDebugPrivilege	4324	msmsgs.eXe
Token: SeDebugPrivilege	4324	msmsgs.eXe
Token: SeDebugPrivilege	4324	msmsgs.eXe
Token: SeDebugPrivilege	4324	msmsgs.eXe
Token: SeDebugPrivilege	4324	msmsgs.eXe
Token: SeDebugPrivilege	4324	msmsgs.eXe
Token: SeDebugPrivilege	4324	msmsgs.eXe
Token: SeDebugPrivilege	4324	msmsgs.eXe
Token: SeDebugPrivilege	4324	msmsgs.eXe
Token: SeDebugPrivilege	4324	msmsgs.eXe
Token: SeDebugPrivilege	4324	msmsgs.eXe
Token: SeDebugPrivilege	4324	msmsgs.eXe
Token: SeDebugPrivilege	4324	msmsgs.eXe
Token: SeDebugPrivilege	4324	msmsgs.eXe
Token: SeDebugPrivilege	4324	msmsgs.eXe
Token: SeDebugPrivilege	4324	msmsgs.eXe
Token: SeDebugPrivilege	4324	msmsgs.eXe
Token: SeDebugPrivilege	4324	msmsgs.eXe
Token: SeDebugPrivilege	4324	msmsgs.eXe
Token: SeDebugPrivilege	4324	msmsgs.eXe
Token: SeDebugPrivilege	4324	msmsgs.eXe
Token: SeDebugPrivilege	4324	msmsgs.eXe
Token: SeDebugPrivilege	4324	msmsgs.eXe
Token: SeDebugPrivilege	4324	msmsgs.eXe
Token: SeDebugPrivilege	4324	msmsgs.eXe
Token: SeDebugPrivilege	4324	msmsgs.eXe
Token: SeDebugPrivilege	4324	msmsgs.eXe
Token: SeDebugPrivilege	4324	msmsgs.eXe
Token: SeDebugPrivilege	4324	msmsgs.eXe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
3188	2026-06-27_a733e1924ac04a2fc48f284376c671a6_elex_wannacry.exe
3188	2026-06-27_a733e1924ac04a2fc48f284376c671a6_elex_wannacry.exe
3988	svchost.eXe
3988	svchost.eXe
4696	svchost.eXe
4696	svchost.eXe
4324	msmsgs.eXe
4324	msmsgs.eXe
5712	angle.eXe
5712	angle.eXe
4324	msmsgs.eXe
4696	svchost.eXe
3988	svchost.eXe
4324	msmsgs.eXe
3988	svchost.eXe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 3188 wrote to memory of 1552	3188	2026-06-27_a733e1924ac04a2fc48f284376c671a6_elex_wannacry.exe	89
PID 3188 wrote to memory of 3708	3188	2026-06-27_a733e1924ac04a2fc48f284376c671a6_elex_wannacry.exe	91
PID 3188 wrote to memory of 3988	3188	2026-06-27_a733e1924ac04a2fc48f284376c671a6_elex_wannacry.exe	93
PID 3188 wrote to memory of 4696	3188	2026-06-27_a733e1924ac04a2fc48f284376c671a6_elex_wannacry.exe	94
PID 3188 wrote to memory of 4324	3188	2026-06-27_a733e1924ac04a2fc48f284376c671a6_elex_wannacry.exe	95
PID 4696 wrote to memory of 1488	4696	svchost.eXe	96
PID 3988 wrote to memory of 4256	3988	svchost.eXe	97
PID 4324 wrote to memory of 1824	4324	msmsgs.eXe	99
PID 3188 wrote to memory of 5712	3188	2026-06-27_a733e1924ac04a2fc48f284376c671a6_elex_wannacry.exe	101
PID 5712 wrote to memory of 848	5712	angle.eXe	103
PID 4696 wrote to memory of 1704	4696	svchost.eXe	105
PID 3988 wrote to memory of 5004	3988	svchost.eXe	107
PID 4324 wrote to memory of 3680	4324	msmsgs.eXe	109
PID 5712 wrote to memory of 1040	5712	angle.eXe	111
PID 3988 wrote to memory of 2412	3988	svchost.eXe	113
PID 3988 wrote to memory of 4476	3988	svchost.eXe	115
PID 3988 wrote to memory of 4540	3988	svchost.eXe	117
PID 3988 wrote to memory of 4844	3988	svchost.eXe	119
PID 3988 wrote to memory of 3180	3988	svchost.eXe	121
PID 3988 wrote to memory of 2592	3988	svchost.eXe	123
PID 3988 wrote to memory of 1324	3988	svchost.eXe	125
PID 3988 wrote to memory of 2896	3988	svchost.eXe	127
PID 3988 wrote to memory of 3952	3988	svchost.eXe	129
PID 3988 wrote to memory of 6084	3988	svchost.eXe	131
PID 3988 wrote to memory of 3936	3988	svchost.eXe	133
PID 3988 wrote to memory of 6120	3988	svchost.eXe	135

C:\Users\Admin\AppData\Local\Temp\2026-06-27_a733e1924ac04a2fc48f284376c671a6_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_a733e1924ac04a2fc48f284376c671a6_elex_wannacry.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3188
- C:\Windows\SysWOW64\reg.exe
  "C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1552
- C:\Windows\SysWOW64\reg.exe
  "C:\Windows\System32\reg.exe" export HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srservice C:\Windows\regedit.reg
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3708
- C:\Users\Public\Pictures\svchost.eXe
  "C:\Users\Public\Pictures\svchost.eXe"
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3988
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4256
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" export HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srservice C:\Windows\regedit.reg
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5004
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2412
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4476
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4540
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4844
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3180
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2592
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1324
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2896
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3952
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6084
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3936
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6120
- C:\Users\Public\Music\svchost.eXe
  "C:\Users\Public\Music\svchost.eXe"
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4696
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1488
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" export HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srservice C:\Windows\regedit.reg
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1704
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\msmsgs.eXe
  "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\msmsgs.eXe"
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Accesses Microsoft Outlook accounts
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4324
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1824
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" export HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srservice C:\Windows\regedit.reg
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3680
- C:\Windows\SysWOW64\angle.eXe
  "C:\Windows\system32\angle.eXe"
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5712
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg
    3⤵
    - System Location Discovery: System Language Discovery
    PID:848
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" export HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srservice C:\Windows\regedit.reg
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

msmsgs.eXe

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\msmsgs.eXe
Size 597KB
SHA256 f557516d6afae3e96fb896a1164a2d8d8809a97e6f0a573cc507dc6a9398832a
MD5 a733e1924ac04a2fc48f284376c671a6
SHA1 77f1c2270a7b1393f51b8e0c2dca016415f2901a
SHA512 3b5a07b7881a781c1c2ef3e5bd8a540cfad8eb09a09baa412ee0a8c3886d2934cf781a42065f7fa64d6ca54a863b51fb05b68eacd9914fae9daf4174ddb93b83
SSDEEP 3072:CGC43DkTv+XZZpS000000000000000000000000000000000000000000000000w:CGC43pZUprrrrrrrrrrrrrrrrrrm
TLSH
T11FD4F7D5B6825363EB420530E02F0F78226EBD9B904A6405A7E37B534B771069DEE1BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Surat Buat Presiden.htm

Path C:\Surat Buat Presiden.htm
Size 656B
SHA256 ea7c34f49417b382ff9c872fccd1f5f58636f3001a2fe837ed195a4d239f66e6
MD5 e0722dddd4442be2d33a6948b7c8d04d
SHA1 1bc56ec2ca2d1ae3c0cbb2f66289945a32bb3d13
SHA512 2236ab5c1547e58aee6da04f4fe5f44a1292cd026596b3766eb76d468e6b67a391982baaa5f4698ec1c719c0c89142e136b1c0f17aa1ea19e7c4963655823bec
TLSH
T1BCF02377AD07238E447606C8215E69290C3D1E121A02464D5E107EF881A6981E7149D5
MD5 SHA1 SHA512 TLSH

Submit Download

RCX5887.tmp

Path C:\Users\Public\Music\RCX5887.tmp
Size 601KB
SHA256 0afc47716d7671ef38d04679d090bf3a92cef34cde71428abc40688b5b11ac17
MD5 8227ebd7751e3417b2a86eef20a1ba60
SHA1 d2d4cada5f051a503b9c654dec8a770adefd0af4
SHA512 8afa5f5910a0a37902b20f7dc95fd00015c8209c11f39c4a004ff5247b445ab80c96c8d4a5c3b90444b3ff45ccf0748463717e4040657975ed64af639b98e0b3
SSDEEP 3072:6GC43DkTv+XZZpQv00000000000000000000000000000000000000000000000p:6GC43pZC8rrrrrrrrrrrrrrrrrrL
TLSH
T1F9D4F7D5B6825363EB420530E02F0F78226EBD9B904A6405A7E37B534B771069DEE1BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

angle.eXe

Path C:\Users\Public\Music\angle.eXe
Size 602KB
SHA256 d2f43cc710e5f0ff96c3799e6e839e36f479043d576125d09f44cfaa4357e646
MD5 09875d8c3fbbd6bca3a61fa3642f7ec1
SHA1 44f38d78245582e0f5bfb05ece58ed88247ab98a
SHA512 09d33a8007fb0cf03a218087b8c517c614292205be08a74dda3dece3d598b2a55d26ea3c8f9384e99275f60f605bd31916cd512eee5ac1de895caa7f16607648
SSDEEP 3072:OGC43DkTv+XZZpS000000000000000000000000000000000000000000000000p:OGC43pZ5rrrrrrrrrrrrrrrrrrc
TLSH
T135D4F6D5B6825363EB420530E02F0F78226EBD9B904A6405A7E37B534B771069DEE1BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.eXe

Path C:\Users\Public\Music\svchost.eXe
Size 595KB
SHA256 0e95c2abf2a3316482c4a16024198bdb0a8a8f9587c877083f0a79c7464c9fbb
MD5 42eecfb87f3a4876091762dfd3d8e493
SHA1 f64e03d75b84154b4e4a9c40fcb2957e74b23b34
SHA512 8457d4ec46e2b9376e5a667cd1838cd08e5a5aec88b80c020c7c02d4469421499ee8c6411513960e865dbaa05e31193fd20362de045090a04608a703e7759ffc
SSDEEP 3072:uGC43DkTv+XZZprH00000000000000000000000000000000000000000000000V:uGC43pZ3rrrrrrrrrrrrrrrrrrg
TLSH
T11FD4F7D5B6825363EB420530E02F0F78226EBD9B904A6405A7E37B534B771069DEE1BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX5635.tmp

Path C:\Windows\SysWOW64\RCX5635.tmp
Size 593KB
SHA256 d278573311c651b53cbb2fd92cadb4c17e046e9728bc7751639fec4477194713
MD5 7bceaaf58633ff326afe3566d2978402
SHA1 46395b39046dd0be02514ed1a68db4752d91181e
SHA512 c7b4a841d657563ed38eb916f0d614a2e4fcfa1f5476f7c5f9e17688ac9c53e066feaddd89bf4f6e7d69aade35afc1e5fb6243a654701fdcbd7c136781d26c1f
SSDEEP 3072:uGC43DkTv+XZZpzL000000000000000000000000000000000000000000000008:uGC43pZZQrrrrrrrrrrrrrrrrrru
TLSH
T14AD4F7D5B6825363EB420530E02F0F78226EBD9B904A6405A7E37B534B771069DEE1BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ziprar.eXe

Path C:\Windows\ziprar.eXe
Size 650KB
SHA256 d5b8c8d7729b7835f23c41280ac052b87b2107968fb4761233c62244306ac685
MD5 8d82c173627336dadcf1ea31a7a16254
SHA1 5d7eb8afcd3631e321e40065caa1bd4ea1fc5ae9
SHA512 e1bd3cb2dd8b55fa229121ffc1d13a59c2d396abefa14bae5affd281fa3cdf5de5881c9353e8eb48561dc3e92624b224795972ce7f4dc62568f29bc3de710c4e
SSDEEP 3072:tGC43DkTv+XZZpZ000000000000000000000000000000000000000000000000p:tGC43pZArrrrrrrrrrrrrrrrrrc
TLSH
T1B9E418D5B68252A3EF410531E11F0F78222EBD97914A6406A3E37B530B7314A9EEE17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download