Analysis
- max time kernel
150s - max time network
117s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 09:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-09_bba615995fffe29bbca95da74c78170a_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_bba615995fffe29bbca95da74c78170a_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target 2026-08-09_bba615995fffe29bbca95da74c78170a_elex_wannacry.exe
- Size 604KB
- Sample260809-lv5sgadj3w
- SHA256 13ba423502b4256fca27cfb1ecddced1e197ed89abb15bc1b470f9289470f33f
- MD5 bba615995fffe29bbca95da74c78170a
- SHA1 ee23b4ab49a4d21f520918d97ec15ffe7db679e9
- SHA512 ed299720687354bdba5378485c0b88917d42045b2b1d4100b0ca990181a927a426908b820eb1aebeac09151cf8d55b38c36800ae6098d3e1d31ea7be57cb283b
- SSDEEP 6144:+GC43pZ6hhhhhhhhhhhhhhhhhhhhhhhhhhhhC:+Y
- TLSH T1C6D429D4F9825A93CB420631D00F0F7DA17E6C87426E506596A3BB4B5B7420ADDEC2BF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 5 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" svchost.eXe Set value (int) \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" msmsgs.eXe Set value (int) \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" angle.eXe Set value (int) \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 2026-08-09_bba615995fffe29bbca95da74c78170a_elex_wannacry.exe Set value (int) \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" svchost.eXe - Disables RegEdit via registry modification 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "2" svchost.eXe Set value (int) \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "2" svchost.eXe Set value (int) \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "2" msmsgs.eXe Set value (int) \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "2" angle.eXe - Executes dropped EXE 4 IoCs
pid Process 6128 svchost.eXe 5488 svchost.eXe 4716 msmsgs.eXe 4296 angle.eXe - Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\RCX408D.tmp 2026-08-09_bba615995fffe29bbca95da74c78170a_elex_wannacry.exe File opened for modification C:\Windows\SysWOW64\angle.eXe svchost.eXe File opened for modification C:\Windows\SysWOW64\RCX7641.tmp svchost.eXe File opened for modification C:\Windows\SysWOW64\angle.eXe svchost.eXe File opened for modification C:\Windows\SysWOW64\RCX76CD.tmp svchost.eXe File created C:\Windows\SysWOW64\angle.eXe msmsgs.eXe File created C:\Windows\SysWOW64\angle.eXe angle.eXe File created C:\Windows\SysWOW64\angle.eXe 2026-08-09_bba615995fffe29bbca95da74c78170a_elex_wannacry.exe File opened for modification C:\Windows\SysWOW64\angle.eXe 2026-08-09_bba615995fffe29bbca95da74c78170a_elex_wannacry.exe - Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office11\WINWORD.exe 2026-08-09_bba615995fffe29bbca95da74c78170a_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office\EXCEL.exe 2026-08-09_bba615995fffe29bbca95da74c78170a_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office11\EXCEL.exe 2026-08-09_bba615995fffe29bbca95da74c78170a_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office\WINWORD.exe 2026-08-09_bba615995fffe29bbca95da74c78170a_elex_wannacry.exe - Drops file in Windows directory 13 IoCs
description ioc Process File opened for modification C:\Windows\svchost.eXe 2026-08-09_bba615995fffe29bbca95da74c78170a_elex_wannacry.exe File opened for modification C:\Windows\RCX4E2B.tmp 2026-08-09_bba615995fffe29bbca95da74c78170a_elex_wannacry.exe File opened for modification C:\Windows\svchost.eXe svchost.eXe File opened for modification C:\Windows\RCX76CC.tmp svchost.eXe File opened for modification C:\Windows\svchost.eXe angle.eXe File opened for modification C:\Windows\RCX403D.tmp 2026-08-09_bba615995fffe29bbca95da74c78170a_elex_wannacry.exe File created C:\Windows\ziprar.eXe 2026-08-09_bba615995fffe29bbca95da74c78170a_elex_wannacry.exe File opened for modification C:\Windows\ziprar.eXe 2026-08-09_bba615995fffe29bbca95da74c78170a_elex_wannacry.exe File opened for modification C:\Windows\RCX7640.tmp svchost.eXe File opened for modification C:\Windows\svchost.eXe svchost.eXe File created C:\Windows\svchost.eXe msmsgs.eXe File opened for modification C:\Windows\RCX7824.tmp angle.eXe File created C:\Windows\svchost.eXe 2026-08-09_bba615995fffe29bbca95da74c78170a_elex_wannacry.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 27 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_bba615995fffe29bbca95da74c78170a_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.eXe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msmsgs.eXe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.eXe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language angle.eXe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4716 msmsgs.eXe 4716 msmsgs.eXe 4716 msmsgs.eXe 4716 msmsgs.eXe 4716 msmsgs.eXe 4716 msmsgs.eXe 4716 msmsgs.eXe 4716 msmsgs.eXe 4716 msmsgs.eXe 4716 msmsgs.eXe 4716 msmsgs.eXe 4716 msmsgs.eXe 4716 msmsgs.eXe 4716 msmsgs.eXe 4716 msmsgs.eXe 4716 msmsgs.eXe 4716 msmsgs.eXe 4716 msmsgs.eXe 4716 msmsgs.eXe 4716 msmsgs.eXe 4716 msmsgs.eXe 4716 msmsgs.eXe 4716 msmsgs.eXe 4716 msmsgs.eXe 4716 msmsgs.eXe 4716 msmsgs.eXe 4716 msmsgs.eXe 4716 msmsgs.eXe 4716 msmsgs.eXe 4716 msmsgs.eXe 4716 msmsgs.eXe 4716 msmsgs.eXe 4716 msmsgs.eXe 4716 msmsgs.eXe 4716 msmsgs.eXe 4716 msmsgs.eXe 4716 msmsgs.eXe 4716 msmsgs.eXe 4716 msmsgs.eXe 4716 msmsgs.eXe 4716 msmsgs.eXe 4716 msmsgs.eXe 4716 msmsgs.eXe 4716 msmsgs.eXe 4716 msmsgs.eXe 4716 msmsgs.eXe 4716 msmsgs.eXe 4716 msmsgs.eXe 4716 msmsgs.eXe 4716 msmsgs.eXe 4716 msmsgs.eXe 4716 msmsgs.eXe 4716 msmsgs.eXe 4716 msmsgs.eXe 4716 msmsgs.eXe 4716 msmsgs.eXe 4716 msmsgs.eXe 4716 msmsgs.eXe 4716 msmsgs.eXe 4716 msmsgs.eXe 4716 msmsgs.eXe 4716 msmsgs.eXe 4716 msmsgs.eXe 4716 msmsgs.eXe - Suspicious behavior: LoadsDriver 5 IoCs
pid 4 4 4 4 4 - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4716 msmsgs.eXe Token: SeDebugPrivilege 4716 msmsgs.eXe Token: SeDebugPrivilege 4716 msmsgs.eXe Token: SeDebugPrivilege 4716 msmsgs.eXe Token: SeDebugPrivilege 4716 msmsgs.eXe Token: SeDebugPrivilege 4716 msmsgs.eXe Token: SeDebugPrivilege 4716 msmsgs.eXe Token: SeDebugPrivilege 4716 msmsgs.eXe Token: SeDebugPrivilege 4716 msmsgs.eXe Token: SeDebugPrivilege 4716 msmsgs.eXe Token: SeDebugPrivilege 4716 msmsgs.eXe Token: SeDebugPrivilege 4716 msmsgs.eXe Token: SeDebugPrivilege 4716 msmsgs.eXe Token: SeDebugPrivilege 4716 msmsgs.eXe Token: SeDebugPrivilege 4716 msmsgs.eXe Token: SeDebugPrivilege 4716 msmsgs.eXe Token: SeDebugPrivilege 4716 msmsgs.eXe Token: SeDebugPrivilege 4716 msmsgs.eXe Token: SeDebugPrivilege 4716 msmsgs.eXe Token: SeDebugPrivilege 4716 msmsgs.eXe Token: SeDebugPrivilege 4716 msmsgs.eXe Token: SeDebugPrivilege 4716 msmsgs.eXe Token: SeDebugPrivilege 4716 msmsgs.eXe Token: SeDebugPrivilege 4716 msmsgs.eXe Token: SeDebugPrivilege 4716 msmsgs.eXe Token: SeDebugPrivilege 4716 msmsgs.eXe Token: SeDebugPrivilege 4716 msmsgs.eXe Token: SeDebugPrivilege 4716 msmsgs.eXe Token: SeDebugPrivilege 4716 msmsgs.eXe Token: SeDebugPrivilege 4716 msmsgs.eXe Token: SeDebugPrivilege 4716 msmsgs.eXe Token: SeDebugPrivilege 4716 msmsgs.eXe Token: SeDebugPrivilege 4716 msmsgs.eXe Token: SeDebugPrivilege 4716 msmsgs.eXe Token: SeDebugPrivilege 4716 msmsgs.eXe Token: SeDebugPrivilege 4716 msmsgs.eXe Token: SeDebugPrivilege 4716 msmsgs.eXe Token: SeDebugPrivilege 4716 msmsgs.eXe Token: SeDebugPrivilege 4716 msmsgs.eXe Token: SeDebugPrivilege 4716 msmsgs.eXe Token: SeDebugPrivilege 4716 msmsgs.eXe Token: SeDebugPrivilege 4716 msmsgs.eXe Token: SeDebugPrivilege 4716 msmsgs.eXe Token: SeDebugPrivilege 4716 msmsgs.eXe Token: SeDebugPrivilege 4716 msmsgs.eXe Token: SeDebugPrivilege 4716 msmsgs.eXe Token: SeDebugPrivilege 4716 msmsgs.eXe Token: SeDebugPrivilege 4716 msmsgs.eXe Token: SeDebugPrivilege 4716 msmsgs.eXe Token: SeDebugPrivilege 4716 msmsgs.eXe Token: SeDebugPrivilege 4716 msmsgs.eXe Token: SeDebugPrivilege 4716 msmsgs.eXe Token: SeDebugPrivilege 4716 msmsgs.eXe Token: SeDebugPrivilege 4716 msmsgs.eXe Token: SeDebugPrivilege 4716 msmsgs.eXe Token: SeDebugPrivilege 4716 msmsgs.eXe Token: SeDebugPrivilege 4716 msmsgs.eXe Token: SeDebugPrivilege 4716 msmsgs.eXe Token: SeDebugPrivilege 4716 msmsgs.eXe Token: SeDebugPrivilege 4716 msmsgs.eXe Token: SeDebugPrivilege 4716 msmsgs.eXe Token: SeDebugPrivilege 4716 msmsgs.eXe Token: SeDebugPrivilege 4716 msmsgs.eXe Token: SeDebugPrivilege 4716 msmsgs.eXe - Suspicious use of SetWindowsHookEx 14 IoCs
pid Process 1448 2026-08-09_bba615995fffe29bbca95da74c78170a_elex_wannacry.exe 1448 2026-08-09_bba615995fffe29bbca95da74c78170a_elex_wannacry.exe 6128 svchost.eXe 6128 svchost.eXe 5488 svchost.eXe 5488 svchost.eXe 4716 msmsgs.eXe 4716 msmsgs.eXe 4296 angle.eXe 4296 angle.eXe 4716 msmsgs.eXe 6128 svchost.eXe 5488 svchost.eXe 6128 svchost.eXe - Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 1448 wrote to memory of 1588 1448 2026-08-09_bba615995fffe29bbca95da74c78170a_elex_wannacry.exe 89 PID 1448 wrote to memory of 2512 1448 2026-08-09_bba615995fffe29bbca95da74c78170a_elex_wannacry.exe 91 PID 1448 wrote to memory of 6128 1448 2026-08-09_bba615995fffe29bbca95da74c78170a_elex_wannacry.exe 93 PID 1448 wrote to memory of 5488 1448 2026-08-09_bba615995fffe29bbca95da74c78170a_elex_wannacry.exe 94 PID 6128 wrote to memory of 3440 6128 svchost.eXe 95 PID 1448 wrote to memory of 4716 1448 2026-08-09_bba615995fffe29bbca95da74c78170a_elex_wannacry.exe 97 PID 1448 wrote to memory of 4296 1448 2026-08-09_bba615995fffe29bbca95da74c78170a_elex_wannacry.exe 98 PID 5488 wrote to memory of 548 5488 svchost.eXe 99 PID 4716 wrote to memory of 3512 4716 msmsgs.eXe 101 PID 4296 wrote to memory of 5316 4296 angle.eXe 103 PID 6128 wrote to memory of 3340 6128 svchost.eXe 105 PID 5488 wrote to memory of 2548 5488 svchost.eXe 107 PID 4716 wrote to memory of 572 4716 msmsgs.eXe 109 PID 4296 wrote to memory of 5280 4296 angle.eXe 111 PID 6128 wrote to memory of 1416 6128 svchost.eXe 114 PID 6128 wrote to memory of 6020 6128 svchost.eXe 116 PID 6128 wrote to memory of 2536 6128 svchost.eXe 118 PID 6128 wrote to memory of 5412 6128 svchost.eXe 120 PID 6128 wrote to memory of 4320 6128 svchost.eXe 122 PID 6128 wrote to memory of 4868 6128 svchost.eXe 124 PID 6128 wrote to memory of 1796 6128 svchost.eXe 126 PID 6128 wrote to memory of 1104 6128 svchost.eXe 128 PID 6128 wrote to memory of 3852 6128 svchost.eXe 130 PID 6128 wrote to memory of 1624 6128 svchost.eXe 132 PID 6128 wrote to memory of 5088 6128 svchost.eXe 134 PID 6128 wrote to memory of 2580 6128 svchost.eXe 136
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_bba615995fffe29bbca95da74c78170a_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_bba615995fffe29bbca95da74c78170a_elex_wannacry.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg2⤵
- System Location Discovery: System Language Discovery
PID:1588
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" export HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srservice C:\Windows\regedit.reg2⤵
- System Location Discovery: System Language Discovery
PID:2512
-
-
C:\Users\Public\Pictures\svchost.eXe"C:\Users\Public\Pictures\svchost.eXe"2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6128 -
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:3440
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" export HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srservice C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:3340
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:1416
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:6020
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:2536
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:5412
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:4320
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:4868
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:1796
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:1104
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:3852
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:1624
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:5088
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:2580
-
-
-
C:\Users\Public\Music\svchost.eXe"C:\Users\Public\Music\svchost.eXe"2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5488 -
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:548
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" export HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srservice C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:2548
-
-
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\msmsgs.eXe"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\msmsgs.eXe"2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:3512
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" export HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srservice C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:572
-
-
-
C:\Windows\SysWOW64\angle.eXe"C:\Windows\system32\angle.eXe"2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:5316
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" export HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srservice C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:5280
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Surat Buat Presiden.htm
- Size 656B
- SHA256 ea7c34f49417b382ff9c872fccd1f5f58636f3001a2fe837ed195a4d239f66e6
- MD5 e0722dddd4442be2d33a6948b7c8d04d
- SHA1 1bc56ec2ca2d1ae3c0cbb2f66289945a32bb3d13
- SHA512 2236ab5c1547e58aee6da04f4fe5f44a1292cd026596b3766eb76d468e6b67a391982baaa5f4698ec1c719c0c89142e136b1c0f17aa1ea19e7c4963655823bec
- TLSH T1BCF02377AD07238E447606C8215E69290C3D1E121A02464D5E107EF881A6981E7149D5
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\Music\RCX7759.tmp
- Size 394KB
- SHA256 f6f5f9bdc4f96cadd64da0b64b7ff302df86c73e9198925fe440d3cdd13af283
- MD5 7a01a05001f83d9dded0eda88a15e1dc
- SHA1 f3583847a54700be8f819c73bb90046708cc034c
- SHA512 a4210fbc32d014ab6c8bf1159a0d566464071a7a574ee0c27514037ca1f211671e747afa046d6c5c4df5f786141aa4576532eef64d13d2457633dfffd86d9208
- SSDEEP 3072:RGC43DkTv+XZZp2q00000000000000000000000000000000000000000000000+:RGC43pZkY
- TLSH T17B84C5E47AC25363CB811670E00F0F78627E60DB805E9065A7F39B5697782199EEC1BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\Music\svchost.eXe
- Size 594KB
- SHA256 0bf62e48eb7bbe589af1db9b5926f890355bc0be60de5705776ff666331c3109
- MD5 0ea488c43ceb9f5abc574970d4510462
- SHA1 b36dabe5b920e612929e3d4fb7554f35b453ce83
- SHA512 b041c89d753c16377e019c85fd05d43f2df73b02441eb2015ab9a11b52bfba6c60da5be999aa9033da3497c718f4697c77e1181d16daba7b51a6053680f9e01e
- SSDEEP 6144:CGC43pZRMhhhhhhhhhhhhhhhhhhhhhhhhhhho:Cs
- TLSH T1E5D429D4F9825693CB420631D00F0F7DA17E6C87426E906596A3BB4B5B7420ADDEC2BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\Pictures\wmplayer.eXe
- Size 604KB
- SHA256 13ba423502b4256fca27cfb1ecddced1e197ed89abb15bc1b470f9289470f33f
- MD5 bba615995fffe29bbca95da74c78170a
- SHA1 ee23b4ab49a4d21f520918d97ec15ffe7db679e9
- SHA512 ed299720687354bdba5378485c0b88917d42045b2b1d4100b0ca990181a927a426908b820eb1aebeac09151cf8d55b38c36800ae6098d3e1d31ea7be57cb283b
- SSDEEP 6144:+GC43pZ6hhhhhhhhhhhhhhhhhhhhhhhhhhhhC:+Y
- TLSH T1C6D429D4F9825A93CB420631D00F0F7DA17E6C87426E506596A3BB4B5B7420ADDEC2BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\RCX76CC.tmp
- Size 585KB
- SHA256 678ed1917dba02e1f72435536ef036042fa91a1e6c2e7c2bd5253b3f973484db
- MD5 bd99387c2a85427b6103420d8098a161
- SHA1 5e7b11dfbc9aaf3c5832e6b277707e5b32ce527a
- SHA512 a272bca9c30589f015e9aa6c53d342a78d95a4d4a428865cd8b094539609926a540080c9f79b94040f736cd7db46276e83eeab442097120f1f591cde71c7fdbc
- SSDEEP 6144:uGC43pZbhhhhhhhhhhhhhhhhhhhhhhhhhhV:uy
- TLSH T161D429D4F9825693CB420631D00F0F7DA17E6C87426E906596A3BB4B5B7420ADDEC2BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\ziprar.eXe
- Size 478KB
- SHA256 51c3dd95939b5dd729cc571849aca23d49e02892ad02b036cb54b1da0f6b5d39
- MD5 b695d3843493158144d41c586af7019f
- SHA1 47ce57e075ab262e938539ecab60f617a02aa100
- SHA512 18b38e0f0c4a3e1be0a494807e1afad0bf160e5bb95a05451df4cfc304456bc236ff7d44503c8d3eafa58f976876ef83bba8598fa4c5ecb865d0b7ab93676382
- SSDEEP 3072:3GC43DkTv+XZZpMhhhhO0000000000000000000000000000000000000000000E:3GC43pZehhhhC
- TLSH T1ECA419E5B6C15263CB410631E00F0F79623E6C97815E9126A2E3BB575B742099FEC2BF
- MD5 SHA1 SHA512 SSDEEP TLSH