7e5f300d848f9f5b748aca9b56210a011310eac8d36cca79e0e1c41e68c6165f

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 02:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_a0e2b566f70e7f6e4bc617f94a6503ad_elex_wannacry.exe
Size 252KB
Sample260731-c8fwtsvset
SHA256 7e5f300d848f9f5b748aca9b56210a011310eac8d36cca79e0e1c41e68c6165f
MD5 a0e2b566f70e7f6e4bc617f94a6503ad
SHA1 13207aef2946347aba5a38d54359cd4a5c636250
SHA512 dda1b617835ec388c15f70c83b28620299566852a625f90115d7eedd422c0f553d4c4aeb9dea439da17e3da10ac3e42d79a2838920a4365280996fc7e495e419
SSDEEP 3072:hOXQ2G+IpQZQneFAMx3qe8UzT+nWwXjDRJWwXjDRgjDRYL7SC3:CvGlpQEQAMtqNUzCT
TLSH
T1A8444A82D67A5AD1D818CD3005A634F557EF2C0334079E56E36BFB1F24BADD0AA4E622
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

credential_access discovery execution persistence spyware stealer

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Executes dropped EXE 4 IoCs

pid	Process
5540	wmimgmt.exe
4532	wmimgmt.exe
4572	wmimgmt.exe
4204	wmimgmt.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\wmi32 = "\"C:\\ProgramData\\Application Data\\wmimgmt.exe\""	wmimgmt.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	wmimgmt.exe

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
5744	ARP.EXE

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
5640	tasklist.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4432 set thread context of 3812	4432	2026-07-31_a0e2b566f70e7f6e4bc617f94a6503ad_elex_wannacry.exe	89
PID 5540 set thread context of 4532	5540	wmimgmt.exe	92
PID 4572 set thread context of 4204	4572	wmimgmt.exe	142

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1232	cmd.exe
5816	cmd.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 48 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmimgmt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ARP.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_a0e2b566f70e7f6e4bc617f94a6503ad_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systeminfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmimgmt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmimgmt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NETSTAT.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NETSTAT.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_a0e2b566f70e7f6e4bc617f94a6503ad_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ROUTE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
2824	NETSTAT.EXE

Discovers systems in the same network 1 TTPs 1 IoCs

discovery

Remote System Discovery

T1018

pid	Process
2540	net.exe

Gathers network information 2 TTPs 3 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4644	ipconfig.exe
2824	NETSTAT.EXE
724	NETSTAT.EXE

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
5280	systeminfo.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4432	2026-07-31_a0e2b566f70e7f6e4bc617f94a6503ad_elex_wannacry.exe
4432	2026-07-31_a0e2b566f70e7f6e4bc617f94a6503ad_elex_wannacry.exe
5540	wmimgmt.exe
5540	wmimgmt.exe
4572	wmimgmt.exe
4572	wmimgmt.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeBackupPrivilege	3812	2026-07-31_a0e2b566f70e7f6e4bc617f94a6503ad_elex_wannacry.exe
Token: SeBackupPrivilege	3812	2026-07-31_a0e2b566f70e7f6e4bc617f94a6503ad_elex_wannacry.exe
Token: SeBackupPrivilege	3812	2026-07-31_a0e2b566f70e7f6e4bc617f94a6503ad_elex_wannacry.exe
Token: SeRestorePrivilege	3812	2026-07-31_a0e2b566f70e7f6e4bc617f94a6503ad_elex_wannacry.exe
Token: SeBackupPrivilege	3812	2026-07-31_a0e2b566f70e7f6e4bc617f94a6503ad_elex_wannacry.exe
Token: SeBackupPrivilege	3812	2026-07-31_a0e2b566f70e7f6e4bc617f94a6503ad_elex_wannacry.exe
Token: SeBackupPrivilege	3812	2026-07-31_a0e2b566f70e7f6e4bc617f94a6503ad_elex_wannacry.exe
Token: SeRestorePrivilege	3812	2026-07-31_a0e2b566f70e7f6e4bc617f94a6503ad_elex_wannacry.exe
Token: SeBackupPrivilege	3812	2026-07-31_a0e2b566f70e7f6e4bc617f94a6503ad_elex_wannacry.exe
Token: SeRestorePrivilege	3812	2026-07-31_a0e2b566f70e7f6e4bc617f94a6503ad_elex_wannacry.exe
Token: SeBackupPrivilege	3812	2026-07-31_a0e2b566f70e7f6e4bc617f94a6503ad_elex_wannacry.exe
Token: SeRestorePrivilege	3812	2026-07-31_a0e2b566f70e7f6e4bc617f94a6503ad_elex_wannacry.exe
Token: SeBackupPrivilege	4532	wmimgmt.exe
Token: SeBackupPrivilege	4532	wmimgmt.exe
Token: SeBackupPrivilege	4532	wmimgmt.exe
Token: SeRestorePrivilege	4532	wmimgmt.exe
Token: SeBackupPrivilege	4532	wmimgmt.exe
Token: SeDebugPrivilege	5640	tasklist.exe
Token: SeDebugPrivilege	2824	NETSTAT.EXE
Token: SeBackupPrivilege	4204	wmimgmt.exe
Token: SeBackupPrivilege	4204	wmimgmt.exe
Token: SeBackupPrivilege	4204	wmimgmt.exe
Token: SeRestorePrivilege	4204	wmimgmt.exe
Token: SeBackupPrivilege	4204	wmimgmt.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4432	2026-07-31_a0e2b566f70e7f6e4bc617f94a6503ad_elex_wannacry.exe
4432	2026-07-31_a0e2b566f70e7f6e4bc617f94a6503ad_elex_wannacry.exe
5540	wmimgmt.exe
5540	wmimgmt.exe
4572	wmimgmt.exe
4572	wmimgmt.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 4432 wrote to memory of 3812	4432	2026-07-31_a0e2b566f70e7f6e4bc617f94a6503ad_elex_wannacry.exe	89
PID 4432 wrote to memory of 3812	4432	2026-07-31_a0e2b566f70e7f6e4bc617f94a6503ad_elex_wannacry.exe	89
PID 3812 wrote to memory of 5540	3812	2026-07-31_a0e2b566f70e7f6e4bc617f94a6503ad_elex_wannacry.exe	91
PID 5540 wrote to memory of 4532	5540	wmimgmt.exe	92
PID 5540 wrote to memory of 4532	5540	wmimgmt.exe	92
PID 4532 wrote to memory of 1232	4532	wmimgmt.exe	93
PID 1232 wrote to memory of 4796	1232	cmd.exe	95
PID 1232 wrote to memory of 2328	1232	cmd.exe	96
PID 1232 wrote to memory of 4240	1232	cmd.exe	97
PID 4240 wrote to memory of 4636	4240	net.exe	98
PID 1232 wrote to memory of 5440	1232	cmd.exe	99
PID 5440 wrote to memory of 4968	5440	net.exe	100
PID 1232 wrote to memory of 5640	1232	cmd.exe	101
PID 1232 wrote to memory of 5280	1232	cmd.exe	103
PID 1232 wrote to memory of 2360	1232	cmd.exe	105
PID 1232 wrote to memory of 3704	1232	cmd.exe	106
PID 1232 wrote to memory of 4940	1232	cmd.exe	107
PID 1232 wrote to memory of 5340	1232	cmd.exe	108
PID 1232 wrote to memory of 2592	1232	cmd.exe	109
PID 1232 wrote to memory of 2808	1232	cmd.exe	110
PID 1232 wrote to memory of 6100	1232	cmd.exe	111
PID 1232 wrote to memory of 5740	1232	cmd.exe	112
PID 1232 wrote to memory of 5568	1232	cmd.exe	113
PID 1232 wrote to memory of 4644	1232	cmd.exe	114
PID 1232 wrote to memory of 2824	1232	cmd.exe	115
PID 1232 wrote to memory of 5744	1232	cmd.exe	116
PID 1232 wrote to memory of 724	1232	cmd.exe	117
PID 724 wrote to memory of 5816	724	NETSTAT.EXE	118
PID 5816 wrote to memory of 5400	5816	cmd.exe	119
PID 1232 wrote to memory of 3112	1232	cmd.exe	120
PID 3112 wrote to memory of 4616	3112	net.exe	121
PID 1232 wrote to memory of 5104	1232	cmd.exe	122
PID 1232 wrote to memory of 5952	1232	cmd.exe	123
PID 1232 wrote to memory of 5012	1232	cmd.exe	124
PID 5012 wrote to memory of 1504	5012	net.exe	125
PID 1232 wrote to memory of 2540	1232	cmd.exe	126
PID 1232 wrote to memory of 2408	1232	cmd.exe	127
PID 1232 wrote to memory of 1144	1232	cmd.exe	128
PID 1232 wrote to memory of 4700	1232	cmd.exe	129
PID 1232 wrote to memory of 5652	1232	cmd.exe	130
PID 1232 wrote to memory of 2508	1232	cmd.exe	131
PID 1232 wrote to memory of 2708	1232	cmd.exe	132
PID 1232 wrote to memory of 2296	1232	cmd.exe	133
PID 1232 wrote to memory of 2288	1232	cmd.exe	134
PID 1232 wrote to memory of 1436	1232	cmd.exe	135
PID 1232 wrote to memory of 2948	1232	cmd.exe	136
PID 1232 wrote to memory of 1540	1232	cmd.exe	137
PID 1232 wrote to memory of 4392	1232	cmd.exe	138
PID 4572 wrote to memory of 4204	4572	wmimgmt.exe	142
PID 4572 wrote to memory of 4204	4572	wmimgmt.exe	142

C:\Users\Admin\AppData\Local\Temp\2026-07-31_a0e2b566f70e7f6e4bc617f94a6503ad_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_a0e2b566f70e7f6e4bc617f94a6503ad_elex_wannacry.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4432
- C:\Users\Admin\AppData\Local\Temp\2026-07-31_a0e2b566f70e7f6e4bc617f94a6503ad_elex_wannacry.exe
  C:\Users\Admin\AppData\Local\Temp\2026-07-31_a0e2b566f70e7f6e4bc617f94a6503ad_elex_wannacry.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3812
- - C:\ProgramData\Application Data\wmimgmt.exe
    "C:\ProgramData\Application Data\wmimgmt.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5540
  - - C:\ProgramData\Application Data\wmimgmt.exe
      "C:\ProgramData\Application Data\wmimgmt.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4532
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /v:on /c "C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\ghi.bat"
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1232
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /s "YM.CGP_" "C:\Users\Admin"\..\*.txt
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4796
      - C:\Windows\SysWOW64\chcp.com
        
        chcp
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2328
      - C:\Windows\SysWOW64\net.exe
        
        net user
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4240
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4636
      - C:\Windows\SysWOW64\net.exe
        
        net localgroup administrators
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5440
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4968
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:5640
      - C:\Windows\SysWOW64\systeminfo.exe
        
        systeminfo
        6⤵
        System Location Discovery: System Language Discovery
        Gathers system information
        
        PID:5280
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2360
      - C:\Windows\SysWOW64\find.exe
        
        find "REG_"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3704
      - C:\Windows\SysWOW64\reg.exe
        
        reg query HKEY_CURRENT_USER\Software\Microsoft\Office
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4940
      - C:\Windows\SysWOW64\reg.exe
        
        reg query HKEY_CURRENT_USER\Software\Microsoft\Office\8.0\Common\UserInfo
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5340
      - C:\Windows\SysWOW64\reg.exe
        
        reg query HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Common\UserInfo
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2592
      - C:\Windows\SysWOW64\reg.exe
        
        reg query HKEY_CURRENT_USER\Software\Microsoft\Office\10.0\Common\UserInfo
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2808
      - C:\Windows\SysWOW64\reg.exe
        
        reg query HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Common\UserInfo
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6100
      - C:\Windows\SysWOW64\reg.exe
        
        reg query HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\UserInfo
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5740
      - C:\Windows\SysWOW64\reg.exe
        
        reg query HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Common\UserInfo
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5568
      - C:\Windows\SysWOW64\ipconfig.exe
        
        ipconfig /all
        6⤵
        System Location Discovery: System Language Discovery
        Gathers network information
        
        PID:4644
      - C:\Windows\SysWOW64\NETSTAT.EXE
        
        netstat -ano
        6⤵
        System Location Discovery: System Language Discovery
        System Network Connections Discovery
        Gathers network information
        Suspicious use of AdjustPrivilegeToken
        
        PID:2824
      - C:\Windows\SysWOW64\ARP.EXE
        
        arp -a
        6⤵
        Network Service Discovery
        System Location Discovery: System Language Discovery
        
        PID:5744
      - C:\Windows\SysWOW64\NETSTAT.EXE
        
        netstat -r
        6⤵
        System Location Discovery: System Language Discovery
        Gathers network information
        Suspicious use of WriteProcessMemory
        
        PID:724
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print
        7⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5816
        
        C:\Windows\SysWOW64\ROUTE.EXE
        
        C:\Windows\system32\route.exe print
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5400
      - C:\Windows\SysWOW64\net.exe
        
        net start
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3112
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4616
      - C:\Windows\SysWOW64\net.exe
        
        net use
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5104
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo n"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5952
      - C:\Windows\SysWOW64\net.exe
        
        net share
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5012
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 share
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1504
      - C:\Windows\SysWOW64\net.exe
        
        net view /domain
        6⤵
        System Location Discovery: System Language Discovery
        Discovers systems in the same network
        
        PID:2540
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\\s.log "
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2408
      - C:\Windows\SysWOW64\find.exe
        
        find /i /v "------"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1144
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\\t.log "
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4700
      - C:\Windows\SysWOW64\find.exe
        
        find /i /v "domain"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5652
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\\s.log "
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2508
      - C:\Windows\SysWOW64\find.exe
        
        find /i /v "¬A╛╣"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2708
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\\t.log "
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2296
      - C:\Windows\SysWOW64\find.exe
        
        find /i /v "░⌡ªµª¿"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2288
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\\s.log "
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1436
      - C:\Windows\SysWOW64\find.exe
        
        find /i /v "├ⁿ┴ε"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2948
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\\t.log "
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1540
      - C:\Windows\SysWOW64\find.exe
        
        find /i /v "completed successfully"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4392

C:\ProgramData\Application Data\wmimgmt.exe
"C:\ProgramData\Application Data\wmimgmt.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4572
- C:\ProgramData\Application Data\wmimgmt.exe
  "C:\ProgramData\Application Data\wmimgmt.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Permission Groups Discovery

T1069

Local Groups

T1069.001

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wmimgmt.exe

Path C:\ProgramData\wmimgmt.exe
Size 252KB
SHA256 7e5f300d848f9f5b748aca9b56210a011310eac8d36cca79e0e1c41e68c6165f
MD5 a0e2b566f70e7f6e4bc617f94a6503ad
SHA1 13207aef2946347aba5a38d54359cd4a5c636250
SHA512 dda1b617835ec388c15f70c83b28620299566852a625f90115d7eedd422c0f553d4c4aeb9dea439da17e3da10ac3e42d79a2838920a4365280996fc7e495e419
SSDEEP 3072:hOXQ2G+IpQZQneFAMx3qe8UzT+nWwXjDRJWwXjDRgjDRYL7SC3:CvGlpQEQAMtqNUzCT
TLSH
T1A8444A82D67A5AD1D818CD3005A634F557EF2C0334079E56E36BFB1F24BADD0AA4E622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INFO.TXT

Path C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\INFO.TXT
Size 13KB
SHA256 98ca4f72af37b6ce938ee7da8ad7a03749ee624414abe67ddcd3aaddc21afa83
MD5 fff184da0b2fba621cd0ebd4f0001d38
SHA1 d98215fe0743c0bba2698bd2883d22698bd3cb69
SHA512 958585426c6bcd6dde80e02c0743105648b56a26f4afc3a1e978f2e114b17c314ea34d807ee942285250de6beadb3eaa661cc765a430640c9684a2b17a11de1e
SSDEEP 384:zQVBlEdvhD2GQy+2vge9Dh1Rkk5fhfJtHkdHL7mE2KYnXvGlQfGbx0052rSkanBG:s6dJDBQy+2vge9Dh1Rkk5fhfJtHkdHLu
TLSH
T16B52FF408C9FC1B8A51DD3993A134002F79A654531AAAEE936CD449C7BE1F0CD3EF9B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INFO.TXT

Path C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\INFO.TXT
Size 34.2MB
SHA256 7bf0bb8563f32e81c3d992baca556bec72dc13c19d194af59547dc8bc4e08081
MD5 2d30a23a2e5d82fd2744f1e93249bd39
SHA1 78228d99cb53b6479fe3a768873aec303e10e3f3
SHA512 6d1148306ab4b0deb691891eecec63bb0f7080b7914146de50522f00afb0490817f339db2ab9926834432dad8af09e77bfc009a857826000107982f11a4e05b9
SSDEEP 49152:mcItC6I1NZgA8vVTr/MXsWPvTKZgROC6lz0mEwkro9WMIUKYGArjBypGWkByLmim:UjBj
TLSH
T16C770E4FCEE9C5D99A93E60213390EE7E46D1553620B0D1873BD138A4BE31763BAD938
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.p

Path C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\drivers.p
Size 15B
SHA256 d8a21e76d208e48198b4afa4a54157044255e074acd5c25f99d9894ad70fbde2
MD5 48290ef0f324cf793b4f7ef936ddf34a
SHA1 ff77d5f263909066a61c89ead0764f6167dc3b16
SHA512 e32bd98f8ca5ceb6d90fde670c8a8a02d841745083040ced0dc5492ed0cdb7eb0bda3cd0a0a101e374a25ba0227991e545be7d41a114c591a7c5f6025d2f6eac
MD5 SHA1 SHA512

Submit Download

ghi.bat

Path C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\ghi.bat
Size 3KB
SHA256 1ebd7eae014cf21830a64f251bf768e2935fa3de5223dcb86f3e69dc88c384c8
MD5 58a64905608130d77188e612e3972897
SHA1 fd2c205c16330cbd77bf3c4ffa8db0e0f245db49
SHA512 288968fbce883e1ec8ba764ed9e82aa9712d1390a8aa98c9f4c7a45247be59825b981c3236e309c5bbff5d075998b406e0a1c049ecb035b58668a1f3354020fe
TLSH
T1AE6100077C5C080B0D75015ADB89B85532EDC2C3D24E26A7254ED2B6F6A935883B4ECE
MD5 SHA1 SHA512 TLSH

Submit Download

INFO.TXT

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\INFO.TXT
Size 43B
SHA256 2964606b9fc629a8db8c98ca13e1cb11151774f2279dc7a5e7086d11fbf9bbe9
MD5 f59265b8898fd4dc81d6a9c44f1b6b5a
SHA1 a2487877842e2d5a4f8682b43a5ed2bd5b8bf435
SHA512 2573eda4594aecdef677102e97b0e3b8cd9b953be49ee59852042e5782735f2714f20381397557b04fa1934d463039a9bfcf17f344179d32b34c70b1617c78f6
MD5 SHA1 SHA512

Submit Download

memory/3812-3-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4432-1-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4432-0-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4532-32-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4532-28-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4532-26-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4532-37-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4532-38-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4532-39-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4532-40-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4532-50-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4532-53-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4572-35-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/5540-5-0x0000000000400000-0x000000000043F000-memory.dmp

Download