Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260630-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/07/2026, 15:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-01_93dfed3ad957d36ddffb43a9756ec63e_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-01_93dfed3ad957d36ddffb43a9756ec63e_elex_wannacry.exe
Resource
win11ltsc2024-20260630-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target 2026-07-01_93dfed3ad957d36ddffb43a9756ec63e_elex_wannacry.exe
- Size 634KB
- Sample260701-sg99csax3s
- SHA256 02404fe4dfc67dcd52e6b144a9d4075c8639d969f1cb7bd3441c98476fe20b35
- MD5 93dfed3ad957d36ddffb43a9756ec63e
- SHA1 bb2b4be212cb4d99f698579ec0e865d4e5cdd00a
- SHA512 adf0d83d32cd2acb580cd8368df64b4a85d32c7c6f0bca9d450785e4fdf77d1f1f5ec40e38af2b727c5007cf208a2951017540c9e8e0556b719bf69e5bf97c21
- SSDEEP 6144:tGC43pZuC8bDQ8bDQ8bDQ8bDQ8bDQ8bDQ8bDQ8bDQ8bDQ8bDQ8bDQ8bDQ8bDQ8bW:tb0
- TLSH T153D417D6B68242A3EB520531E02F0F6C225EBDE7954A6405A7E3B7130B731069DEE17F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 5 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" svchost.eXe Set value (int) \REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" msmsgs.eXe Set value (int) \REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" angle.eXe Set value (int) \REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 2026-07-01_93dfed3ad957d36ddffb43a9756ec63e_elex_wannacry.exe Set value (int) \REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" svchost.eXe - Disables RegEdit via registry modification 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "2" svchost.eXe Set value (int) \REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "2" msmsgs.eXe Set value (int) \REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "2" angle.eXe Set value (int) \REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "2" svchost.eXe - Executes dropped EXE 4 IoCs
pid Process 2852 svchost.eXe 4364 svchost.eXe 5200 msmsgs.eXe 1176 angle.eXe - Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\angle.eXe 2026-07-01_93dfed3ad957d36ddffb43a9756ec63e_elex_wannacry.exe File opened for modification C:\Windows\SysWOW64\RCX1EAB.tmp svchost.eXe File opened for modification C:\Windows\SysWOW64\angle.eXe svchost.eXe File opened for modification C:\Windows\SysWOW64\RCX1EE9.tmp svchost.eXe File created C:\Windows\SysWOW64\angle.eXe angle.eXe File created C:\Windows\SysWOW64\angle.eXe 2026-07-01_93dfed3ad957d36ddffb43a9756ec63e_elex_wannacry.exe File opened for modification C:\Windows\SysWOW64\RCXE954.tmp 2026-07-01_93dfed3ad957d36ddffb43a9756ec63e_elex_wannacry.exe File opened for modification C:\Windows\SysWOW64\angle.eXe svchost.eXe File created C:\Windows\SysWOW64\angle.eXe msmsgs.eXe - Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office\WINWORD.exe 2026-07-01_93dfed3ad957d36ddffb43a9756ec63e_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office11\WINWORD.exe 2026-07-01_93dfed3ad957d36ddffb43a9756ec63e_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office\EXCEL.exe 2026-07-01_93dfed3ad957d36ddffb43a9756ec63e_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office11\EXCEL.exe 2026-07-01_93dfed3ad957d36ddffb43a9756ec63e_elex_wannacry.exe - Drops file in Windows directory 13 IoCs
description ioc Process File opened for modification C:\Windows\svchost.eXe svchost.eXe File created C:\Windows\svchost.eXe msmsgs.eXe File opened for modification C:\Windows\svchost.eXe angle.eXe File opened for modification C:\Windows\RCX2040.tmp angle.eXe File opened for modification C:\Windows\RCXE915.tmp 2026-07-01_93dfed3ad957d36ddffb43a9756ec63e_elex_wannacry.exe File created C:\Windows\ziprar.eXe 2026-07-01_93dfed3ad957d36ddffb43a9756ec63e_elex_wannacry.exe File opened for modification C:\Windows\ziprar.eXe 2026-07-01_93dfed3ad957d36ddffb43a9756ec63e_elex_wannacry.exe File opened for modification C:\Windows\RCX1EAA.tmp svchost.eXe File opened for modification C:\Windows\RCX1EE8.tmp svchost.eXe File created C:\Windows\svchost.eXe 2026-07-01_93dfed3ad957d36ddffb43a9756ec63e_elex_wannacry.exe File opened for modification C:\Windows\svchost.eXe 2026-07-01_93dfed3ad957d36ddffb43a9756ec63e_elex_wannacry.exe File opened for modification C:\Windows\RCXF6D4.tmp 2026-07-01_93dfed3ad957d36ddffb43a9756ec63e_elex_wannacry.exe File opened for modification C:\Windows\svchost.eXe svchost.eXe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 27 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-01_93dfed3ad957d36ddffb43a9756ec63e_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msmsgs.eXe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.eXe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.eXe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language angle.eXe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5200 msmsgs.eXe 5200 msmsgs.eXe 5200 msmsgs.eXe 5200 msmsgs.eXe 5200 msmsgs.eXe 5200 msmsgs.eXe 5200 msmsgs.eXe 5200 msmsgs.eXe 5200 msmsgs.eXe 5200 msmsgs.eXe 5200 msmsgs.eXe 5200 msmsgs.eXe 5200 msmsgs.eXe 5200 msmsgs.eXe 5200 msmsgs.eXe 5200 msmsgs.eXe 5200 msmsgs.eXe 5200 msmsgs.eXe 5200 msmsgs.eXe 5200 msmsgs.eXe 5200 msmsgs.eXe 5200 msmsgs.eXe 5200 msmsgs.eXe 5200 msmsgs.eXe 5200 msmsgs.eXe 5200 msmsgs.eXe 5200 msmsgs.eXe 5200 msmsgs.eXe 5200 msmsgs.eXe 5200 msmsgs.eXe 5200 msmsgs.eXe 5200 msmsgs.eXe 5200 msmsgs.eXe 5200 msmsgs.eXe 5200 msmsgs.eXe 5200 msmsgs.eXe 5200 msmsgs.eXe 5200 msmsgs.eXe 5200 msmsgs.eXe 5200 msmsgs.eXe 5200 msmsgs.eXe 5200 msmsgs.eXe 5200 msmsgs.eXe 5200 msmsgs.eXe 5200 msmsgs.eXe 5200 msmsgs.eXe 5200 msmsgs.eXe 5200 msmsgs.eXe 5200 msmsgs.eXe 5200 msmsgs.eXe 5200 msmsgs.eXe 5200 msmsgs.eXe 5200 msmsgs.eXe 5200 msmsgs.eXe 5200 msmsgs.eXe 5200 msmsgs.eXe 5200 msmsgs.eXe 5200 msmsgs.eXe 5200 msmsgs.eXe 5200 msmsgs.eXe 5200 msmsgs.eXe 5200 msmsgs.eXe 5200 msmsgs.eXe 5200 msmsgs.eXe - Suspicious behavior: LoadsDriver 5 IoCs
pid 4 4 4 4 4 - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5200 msmsgs.eXe Token: SeDebugPrivilege 5200 msmsgs.eXe Token: SeDebugPrivilege 5200 msmsgs.eXe Token: SeDebugPrivilege 5200 msmsgs.eXe Token: SeDebugPrivilege 5200 msmsgs.eXe Token: SeDebugPrivilege 5200 msmsgs.eXe Token: SeDebugPrivilege 5200 msmsgs.eXe Token: SeDebugPrivilege 5200 msmsgs.eXe Token: SeDebugPrivilege 5200 msmsgs.eXe Token: SeDebugPrivilege 5200 msmsgs.eXe Token: SeDebugPrivilege 5200 msmsgs.eXe Token: SeDebugPrivilege 5200 msmsgs.eXe Token: SeDebugPrivilege 5200 msmsgs.eXe Token: SeDebugPrivilege 5200 msmsgs.eXe Token: SeDebugPrivilege 5200 msmsgs.eXe Token: SeDebugPrivilege 5200 msmsgs.eXe Token: SeDebugPrivilege 5200 msmsgs.eXe Token: SeDebugPrivilege 5200 msmsgs.eXe Token: SeDebugPrivilege 5200 msmsgs.eXe Token: SeDebugPrivilege 5200 msmsgs.eXe Token: SeDebugPrivilege 5200 msmsgs.eXe Token: SeDebugPrivilege 5200 msmsgs.eXe Token: SeDebugPrivilege 5200 msmsgs.eXe Token: SeDebugPrivilege 5200 msmsgs.eXe Token: SeDebugPrivilege 5200 msmsgs.eXe Token: SeDebugPrivilege 5200 msmsgs.eXe Token: SeDebugPrivilege 5200 msmsgs.eXe Token: SeDebugPrivilege 5200 msmsgs.eXe Token: SeDebugPrivilege 5200 msmsgs.eXe Token: SeDebugPrivilege 5200 msmsgs.eXe Token: SeDebugPrivilege 5200 msmsgs.eXe Token: SeDebugPrivilege 5200 msmsgs.eXe Token: SeDebugPrivilege 5200 msmsgs.eXe Token: SeDebugPrivilege 5200 msmsgs.eXe Token: SeDebugPrivilege 5200 msmsgs.eXe Token: SeDebugPrivilege 5200 msmsgs.eXe Token: SeDebugPrivilege 5200 msmsgs.eXe Token: SeDebugPrivilege 5200 msmsgs.eXe Token: SeDebugPrivilege 5200 msmsgs.eXe Token: SeDebugPrivilege 5200 msmsgs.eXe Token: SeDebugPrivilege 5200 msmsgs.eXe Token: SeDebugPrivilege 5200 msmsgs.eXe Token: SeDebugPrivilege 5200 msmsgs.eXe Token: SeDebugPrivilege 5200 msmsgs.eXe Token: SeDebugPrivilege 5200 msmsgs.eXe Token: SeDebugPrivilege 5200 msmsgs.eXe Token: SeDebugPrivilege 5200 msmsgs.eXe Token: SeDebugPrivilege 5200 msmsgs.eXe Token: SeDebugPrivilege 5200 msmsgs.eXe Token: SeDebugPrivilege 5200 msmsgs.eXe Token: SeDebugPrivilege 5200 msmsgs.eXe Token: SeDebugPrivilege 5200 msmsgs.eXe Token: SeDebugPrivilege 5200 msmsgs.eXe Token: SeDebugPrivilege 5200 msmsgs.eXe Token: SeDebugPrivilege 5200 msmsgs.eXe Token: SeDebugPrivilege 5200 msmsgs.eXe Token: SeDebugPrivilege 5200 msmsgs.eXe Token: SeDebugPrivilege 5200 msmsgs.eXe Token: SeDebugPrivilege 5200 msmsgs.eXe Token: SeDebugPrivilege 5200 msmsgs.eXe Token: SeDebugPrivilege 5200 msmsgs.eXe Token: SeDebugPrivilege 5200 msmsgs.eXe Token: SeDebugPrivilege 5200 msmsgs.eXe Token: SeDebugPrivilege 5200 msmsgs.eXe - Suspicious use of SetWindowsHookEx 14 IoCs
pid Process 4852 2026-07-01_93dfed3ad957d36ddffb43a9756ec63e_elex_wannacry.exe 4852 2026-07-01_93dfed3ad957d36ddffb43a9756ec63e_elex_wannacry.exe 2852 svchost.eXe 2852 svchost.eXe 4364 svchost.eXe 4364 svchost.eXe 5200 msmsgs.eXe 5200 msmsgs.eXe 1176 angle.eXe 1176 angle.eXe 5200 msmsgs.eXe 4364 svchost.eXe 2852 svchost.eXe 2852 svchost.eXe - Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 4852 wrote to memory of 5660 4852 2026-07-01_93dfed3ad957d36ddffb43a9756ec63e_elex_wannacry.exe 88 PID 4852 wrote to memory of 2064 4852 2026-07-01_93dfed3ad957d36ddffb43a9756ec63e_elex_wannacry.exe 90 PID 4852 wrote to memory of 2852 4852 2026-07-01_93dfed3ad957d36ddffb43a9756ec63e_elex_wannacry.exe 92 PID 4852 wrote to memory of 4364 4852 2026-07-01_93dfed3ad957d36ddffb43a9756ec63e_elex_wannacry.exe 93 PID 4852 wrote to memory of 5200 4852 2026-07-01_93dfed3ad957d36ddffb43a9756ec63e_elex_wannacry.exe 94 PID 4364 wrote to memory of 2964 4364 svchost.eXe 95 PID 4852 wrote to memory of 1176 4852 2026-07-01_93dfed3ad957d36ddffb43a9756ec63e_elex_wannacry.exe 97 PID 2852 wrote to memory of 5352 2852 svchost.eXe 98 PID 5200 wrote to memory of 2328 5200 msmsgs.eXe 100 PID 1176 wrote to memory of 3560 1176 angle.eXe 102 PID 4364 wrote to memory of 2516 4364 svchost.eXe 104 PID 2852 wrote to memory of 1428 2852 svchost.eXe 106 PID 5200 wrote to memory of 6096 5200 msmsgs.eXe 108 PID 1176 wrote to memory of 2292 1176 angle.eXe 109 PID 2852 wrote to memory of 3416 2852 svchost.eXe 112 PID 2852 wrote to memory of 3776 2852 svchost.eXe 114 PID 2852 wrote to memory of 1076 2852 svchost.eXe 116 PID 2852 wrote to memory of 3068 2852 svchost.eXe 118 PID 2852 wrote to memory of 3712 2852 svchost.eXe 120 PID 2852 wrote to memory of 2216 2852 svchost.eXe 122 PID 2852 wrote to memory of 3844 2852 svchost.eXe 124 PID 2852 wrote to memory of 3180 2852 svchost.eXe 126 PID 2852 wrote to memory of 3084 2852 svchost.eXe 128 PID 2852 wrote to memory of 2656 2852 svchost.eXe 130 PID 2852 wrote to memory of 5604 2852 svchost.eXe 132 PID 2852 wrote to memory of 4440 2852 svchost.eXe 134
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-01_93dfed3ad957d36ddffb43a9756ec63e_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-01_93dfed3ad957d36ddffb43a9756ec63e_elex_wannacry.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg2⤵
- System Location Discovery: System Language Discovery
PID:5660
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" export HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srservice C:\Windows\regedit.reg2⤵
- System Location Discovery: System Language Discovery
PID:2064
-
-
C:\Users\Public\Pictures\svchost.eXe"C:\Users\Public\Pictures\svchost.eXe"2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:5352
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" export HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srservice C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:1428
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:3416
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:3776
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:1076
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:3068
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:3712
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:2216
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:3844
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:3180
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:3084
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:2656
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:5604
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:4440
-
-
-
C:\Users\Public\Music\svchost.eXe"C:\Users\Public\Music\svchost.eXe"2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:2964
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" export HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srservice C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:2516
-
-
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\msmsgs.eXe"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\msmsgs.eXe"2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5200 -
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:2328
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" export HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srservice C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:6096
-
-
-
C:\Windows\SysWOW64\angle.eXe"C:\Windows\system32\angle.eXe"2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:3560
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" export HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srservice C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:2292
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Surat Buat Presiden.htm
- Size 656B
- SHA256 ea7c34f49417b382ff9c872fccd1f5f58636f3001a2fe837ed195a4d239f66e6
- MD5 e0722dddd4442be2d33a6948b7c8d04d
- SHA1 1bc56ec2ca2d1ae3c0cbb2f66289945a32bb3d13
- SHA512 2236ab5c1547e58aee6da04f4fe5f44a1292cd026596b3766eb76d468e6b67a391982baaa5f4698ec1c719c0c89142e136b1c0f17aa1ea19e7c4963655823bec
- TLSH T1BCF02377AD07238E447606C8215E69290C3D1E121A02464D5E107EF881A6981E7149D5
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\Music\RCX2011.tmp
- Size 629KB
- SHA256 b42f2c882c365694579f6338a0e4397904fdaee6c725366dceb766bc89787762
- MD5 cb02fa7d575856672dc7cf61ba8f2bb4
- SHA1 6598cb147352f39e7671cc30e619c25f3c522777
- SHA512 5ce6b7be304583efe68bdc4f62cf4f0cc35bad22c4ceba9dc3e727bae62c1103d735ae84c23939327eabdc747e5882c5e1954e9bbd67416ed39ca1b31d7eb39b
- SSDEEP 3072:GGC43DkTv+XZZp7N00000000000000000000000000000000000K00000000000D:GGC43pZl5rrrrrrrrrrrrrrrrrrG
- TLSH T1F9D4E6D5B6825363EB420530E02F0F78226EBD9B904A6405A7E37B534B771069DEE1BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\Music\svchost.eXe
- Size 629KB
- SHA256 f3a1b3dd6c54dca710f4d72c597aeddefa48cd1fcac90e67813d6bcf24e327c2
- MD5 4e4790106cf7af22a174af56fcb356b5
- SHA1 54bf8808dbccbec42ea38263ee0e490ba4f4377c
- SHA512 0d9aa397cafbdc6920f69d273ce6d9fd4ad40a4e96e5dbb3b6708ef7dad33c0ddfffa27aefe46095d9a369ae54048ccae06e3d0e5a0d80d55136d7bc7b2855e0
- SSDEEP 6144:ZGC43pZLj8bDQ8bDQ8bDQ8bDQ8bDQ8bDQ8bDQ8bDQ8bDQ8bDQ8bDQ8bDQ8bDQ8bM:Zif
- TLSH T1A6D417D6B68252A3EB520531E02F0F6C225EBDE7944A6405A7E3B7130B731069DEE17F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\RCX1EE8.tmp
- Size 625KB
- SHA256 c03cd4eb4a1f1b7ccf29418584169ffc7d2fb7397a48bd5a2c5b95154107da82
- MD5 10b96f246eb8a939b85622a00dd6810b
- SHA1 3e8bc3e5d588494070815b980847f95086d81f67
- SHA512 38c12f81d2e2ada2b24bc76d38df3dd2370f9e11e3c3e0c4d292f6ce65574ac9cae589cf1b25dceadfa1a355cc3802ea7f574e12717b2858172171422c085f3b
- SSDEEP 6144:VGC43pZE8bDQ8bDQ8bDQ8bDQ8bDQ8bDQ8bDQ8bDQ8bDQ8bDQ8bDQ8bDQ8bDQ8bD8:Vn
- TLSH T175D407D5B68252A3EB520531E02F0F6C225EBDE7944A6405A7E3BB130B731069DEE17F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\ziprar.eXe
- Size 650KB
- SHA256 aa38a836d3e2a15a72a7302d7b227fb93d0ea9534ace148eff1fd7628bbed1cb
- MD5 1572e827bfc9a745025a84d4d8fc8a39
- SHA1 b4490859faf06fabe8712dd4a2feb21378c69d6b
- SHA512 5a02b58681cb2db38433b70cf23036bbc742a0764e4b6032cb8b7365443f8fbc1a6a40da710f7b831d8800fd4adf809c7709e7fd007fd27216104591865e167d
- SSDEEP 3072:tGC43DkTv+XZZpG0000000000000000000000000000000000000000000000005:tGC43pZNrrrrrrrrrrrrrrrrrrY
- TLSH T101E418D5B68252A3EF410531E11F0F78222EBD97914A6406A3E37B530B7314A9EEE17F
- MD5 SHA1 SHA512 SSDEEP TLSH