Analysis
- max time kernel
149s - max time network
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 20:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-09_650ccbd70b7249a23ce3cc256e5bbc15_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_650ccbd70b7249a23ce3cc256e5bbc15_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target 2026-08-09_650ccbd70b7249a23ce3cc256e5bbc15_elex_wannacry.exe
- Size 394KB
- Sample260809-zrn77sce24
- SHA256 a48b1d9a0ea37c6194df90cf1f08a0bab9eb7c54988f372b0ebb72a2adf8d45b
- MD5 650ccbd70b7249a23ce3cc256e5bbc15
- SHA1 210dd45e9c7430b87f7c6fdbfe40f65b32ac0f71
- SHA512 becbad460f4a60b3a5888e511dd0d687cccbc6c12a084d77e4690784d41ad5f2b0377347a1c0380d8baa80edf2bdd430ba207323dcf41ef60a0baf257148579e
- SSDEEP 3072:JGC43DkTv+XZZp2000000000000000000000000000000000000000000000000E:JGC43pZz
- TLSH T1A984F9D47AC25253CB411671E00F0F78623D60DB806F915AA7F3AB569B782099EEC1BF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 7 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" msmsgs.eXe Set value (int) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" angle.eXe Set value (int) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" svchost.eXe Set value (int) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" msmsgs.eXe Set value (int) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" angle.eXe Set value (int) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 2026-08-09_650ccbd70b7249a23ce3cc256e5bbc15_elex_wannacry.exe Set value (int) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" svchost.eXe - Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "2" svchost.eXe Set value (int) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "2" msmsgs.eXe Set value (int) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "2" angle.eXe Set value (int) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "2" svchost.eXe Set value (int) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "2" msmsgs.eXe Set value (int) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "2" angle.eXe - Executes dropped EXE 6 IoCs
pid Process 3008 svchost.eXe 4596 msmsgs.eXe 124 angle.eXe 1812 svchost.eXe 2684 msmsgs.eXe 5820 angle.eXe - Drops file in System32 directory 11 IoCs
description ioc Process File created C:\Windows\SysWOW64\angle.eXe angle.eXe File created C:\Windows\SysWOW64\angle.eXe msmsgs.eXe File created C:\Windows\SysWOW64\angle.eXe svchost.eXe File opened for modification C:\Windows\SysWOW64\angle.eXe svchost.eXe File created C:\Windows\SysWOW64\angle.eXe 2026-08-09_650ccbd70b7249a23ce3cc256e5bbc15_elex_wannacry.exe File created C:\Windows\SysWOW64\angle.eXe msmsgs.eXe File created C:\Windows\SysWOW64\angle.eXe angle.eXe File opened for modification C:\Windows\SysWOW64\angle.eXe 2026-08-09_650ccbd70b7249a23ce3cc256e5bbc15_elex_wannacry.exe File opened for modification C:\Windows\SysWOW64\RCX2B4F.tmp 2026-08-09_650ccbd70b7249a23ce3cc256e5bbc15_elex_wannacry.exe File opened for modification C:\Windows\SysWOW64\angle.eXe svchost.eXe File opened for modification C:\Windows\SysWOW64\RCX6087.tmp svchost.eXe - Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office11\WINWORD.exe 2026-08-09_650ccbd70b7249a23ce3cc256e5bbc15_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office\EXCEL.exe 2026-08-09_650ccbd70b7249a23ce3cc256e5bbc15_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office11\EXCEL.exe 2026-08-09_650ccbd70b7249a23ce3cc256e5bbc15_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office\WINWORD.exe 2026-08-09_650ccbd70b7249a23ce3cc256e5bbc15_elex_wannacry.exe - Drops file in Windows directory 16 IoCs
description ioc Process File opened for modification C:\Windows\svchost.eXe angle.eXe File created C:\Windows\svchost.eXe 2026-08-09_650ccbd70b7249a23ce3cc256e5bbc15_elex_wannacry.exe File opened for modification C:\Windows\RCX38AF.tmp 2026-08-09_650ccbd70b7249a23ce3cc256e5bbc15_elex_wannacry.exe File created C:\Windows\svchost.eXe msmsgs.eXe File opened for modification C:\Windows\svchost.eXe angle.eXe File opened for modification C:\Windows\RCX6086.tmp svchost.eXe File created C:\Windows\svchost.eXe msmsgs.eXe File opened for modification C:\Windows\RCX619F.tmp angle.eXe File opened for modification C:\Windows\RCX6F4A.tmp angle.eXe File created C:\Windows\ziprar.eXe 2026-08-09_650ccbd70b7249a23ce3cc256e5bbc15_elex_wannacry.exe File opened for modification C:\Windows\ziprar.eXe 2026-08-09_650ccbd70b7249a23ce3cc256e5bbc15_elex_wannacry.exe File opened for modification C:\Windows\svchost.eXe svchost.eXe File opened for modification C:\Windows\svchost.eXe svchost.eXe File opened for modification C:\Windows\RCX6ECD.tmp svchost.eXe File opened for modification C:\Windows\svchost.eXe 2026-08-09_650ccbd70b7249a23ce3cc256e5bbc15_elex_wannacry.exe File opened for modification C:\Windows\RCX2B3E.tmp 2026-08-09_650ccbd70b7249a23ce3cc256e5bbc15_elex_wannacry.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 33 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.eXe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.eXe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language angle.eXe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_650ccbd70b7249a23ce3cc256e5bbc15_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language angle.eXe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msmsgs.eXe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msmsgs.eXe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4596 msmsgs.eXe 4596 msmsgs.eXe 2684 msmsgs.eXe 2684 msmsgs.eXe 4596 msmsgs.eXe 4596 msmsgs.eXe 4596 msmsgs.eXe 4596 msmsgs.eXe 4596 msmsgs.eXe 4596 msmsgs.eXe 4596 msmsgs.eXe 4596 msmsgs.eXe 4596 msmsgs.eXe 4596 msmsgs.eXe 4596 msmsgs.eXe 4596 msmsgs.eXe 4596 msmsgs.eXe 4596 msmsgs.eXe 2684 msmsgs.eXe 2684 msmsgs.eXe 4596 msmsgs.eXe 4596 msmsgs.eXe 2684 msmsgs.eXe 2684 msmsgs.eXe 4596 msmsgs.eXe 4596 msmsgs.eXe 2684 msmsgs.eXe 2684 msmsgs.eXe 4596 msmsgs.eXe 4596 msmsgs.eXe 2684 msmsgs.eXe 2684 msmsgs.eXe 4596 msmsgs.eXe 4596 msmsgs.eXe 2684 msmsgs.eXe 2684 msmsgs.eXe 4596 msmsgs.eXe 4596 msmsgs.eXe 2684 msmsgs.eXe 2684 msmsgs.eXe 4596 msmsgs.eXe 4596 msmsgs.eXe 2684 msmsgs.eXe 2684 msmsgs.eXe 4596 msmsgs.eXe 4596 msmsgs.eXe 2684 msmsgs.eXe 2684 msmsgs.eXe 4596 msmsgs.eXe 4596 msmsgs.eXe 2684 msmsgs.eXe 2684 msmsgs.eXe 4596 msmsgs.eXe 4596 msmsgs.eXe 2684 msmsgs.eXe 2684 msmsgs.eXe 4596 msmsgs.eXe 4596 msmsgs.eXe 2684 msmsgs.eXe 2684 msmsgs.eXe 4596 msmsgs.eXe 4596 msmsgs.eXe 2684 msmsgs.eXe 2684 msmsgs.eXe - Suspicious behavior: LoadsDriver 5 IoCs
pid 4 4 4 4 4 - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4596 msmsgs.eXe Token: SeDebugPrivilege 2684 msmsgs.eXe Token: SeDebugPrivilege 4596 msmsgs.eXe Token: SeDebugPrivilege 4596 msmsgs.eXe Token: SeDebugPrivilege 4596 msmsgs.eXe Token: SeDebugPrivilege 4596 msmsgs.eXe Token: SeDebugPrivilege 4596 msmsgs.eXe Token: SeDebugPrivilege 4596 msmsgs.eXe Token: SeDebugPrivilege 4596 msmsgs.eXe Token: SeDebugPrivilege 2684 msmsgs.eXe Token: SeDebugPrivilege 4596 msmsgs.eXe Token: SeDebugPrivilege 2684 msmsgs.eXe Token: SeDebugPrivilege 4596 msmsgs.eXe Token: SeDebugPrivilege 2684 msmsgs.eXe Token: SeDebugPrivilege 4596 msmsgs.eXe Token: SeDebugPrivilege 2684 msmsgs.eXe Token: SeDebugPrivilege 4596 msmsgs.eXe Token: SeDebugPrivilege 2684 msmsgs.eXe Token: SeDebugPrivilege 4596 msmsgs.eXe Token: SeDebugPrivilege 2684 msmsgs.eXe Token: SeDebugPrivilege 4596 msmsgs.eXe Token: SeDebugPrivilege 2684 msmsgs.eXe Token: SeDebugPrivilege 4596 msmsgs.eXe Token: SeDebugPrivilege 2684 msmsgs.eXe Token: SeDebugPrivilege 4596 msmsgs.eXe Token: SeDebugPrivilege 2684 msmsgs.eXe Token: SeDebugPrivilege 4596 msmsgs.eXe Token: SeDebugPrivilege 2684 msmsgs.eXe Token: SeDebugPrivilege 4596 msmsgs.eXe Token: SeDebugPrivilege 2684 msmsgs.eXe Token: SeDebugPrivilege 4596 msmsgs.eXe Token: SeDebugPrivilege 2684 msmsgs.eXe Token: SeDebugPrivilege 4596 msmsgs.eXe Token: SeDebugPrivilege 2684 msmsgs.eXe Token: SeDebugPrivilege 4596 msmsgs.eXe Token: SeDebugPrivilege 2684 msmsgs.eXe Token: SeDebugPrivilege 4596 msmsgs.eXe Token: SeDebugPrivilege 2684 msmsgs.eXe Token: SeDebugPrivilege 4596 msmsgs.eXe Token: SeDebugPrivilege 2684 msmsgs.eXe Token: SeDebugPrivilege 4596 msmsgs.eXe Token: SeDebugPrivilege 2684 msmsgs.eXe Token: SeDebugPrivilege 4596 msmsgs.eXe Token: SeDebugPrivilege 2684 msmsgs.eXe Token: SeDebugPrivilege 4596 msmsgs.eXe Token: SeDebugPrivilege 2684 msmsgs.eXe Token: SeDebugPrivilege 4596 msmsgs.eXe Token: SeDebugPrivilege 2684 msmsgs.eXe Token: SeDebugPrivilege 4596 msmsgs.eXe Token: SeDebugPrivilege 2684 msmsgs.eXe Token: SeDebugPrivilege 4596 msmsgs.eXe Token: SeDebugPrivilege 2684 msmsgs.eXe Token: SeDebugPrivilege 4596 msmsgs.eXe Token: SeDebugPrivilege 2684 msmsgs.eXe Token: SeDebugPrivilege 4596 msmsgs.eXe Token: SeDebugPrivilege 2684 msmsgs.eXe Token: SeDebugPrivilege 4596 msmsgs.eXe Token: SeDebugPrivilege 2684 msmsgs.eXe Token: SeDebugPrivilege 4596 msmsgs.eXe Token: SeDebugPrivilege 2684 msmsgs.eXe Token: SeDebugPrivilege 4596 msmsgs.eXe Token: SeDebugPrivilege 2684 msmsgs.eXe Token: SeDebugPrivilege 4596 msmsgs.eXe Token: SeDebugPrivilege 2684 msmsgs.eXe - Suspicious use of SetWindowsHookEx 19 IoCs
pid Process 2748 2026-08-09_650ccbd70b7249a23ce3cc256e5bbc15_elex_wannacry.exe 2748 2026-08-09_650ccbd70b7249a23ce3cc256e5bbc15_elex_wannacry.exe 3008 svchost.eXe 3008 svchost.eXe 4596 msmsgs.eXe 4596 msmsgs.eXe 124 angle.eXe 124 angle.eXe 1812 svchost.eXe 1812 svchost.eXe 2684 msmsgs.eXe 2684 msmsgs.eXe 5820 angle.eXe 5820 angle.eXe 4596 msmsgs.eXe 2684 msmsgs.eXe 3008 svchost.eXe 1812 svchost.eXe 3008 svchost.eXe - Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 2748 wrote to memory of 796 2748 2026-08-09_650ccbd70b7249a23ce3cc256e5bbc15_elex_wannacry.exe 89 PID 2748 wrote to memory of 5244 2748 2026-08-09_650ccbd70b7249a23ce3cc256e5bbc15_elex_wannacry.exe 91 PID 2748 wrote to memory of 3008 2748 2026-08-09_650ccbd70b7249a23ce3cc256e5bbc15_elex_wannacry.exe 93 PID 2748 wrote to memory of 4596 2748 2026-08-09_650ccbd70b7249a23ce3cc256e5bbc15_elex_wannacry.exe 94 PID 2748 wrote to memory of 124 2748 2026-08-09_650ccbd70b7249a23ce3cc256e5bbc15_elex_wannacry.exe 95 PID 3008 wrote to memory of 4348 3008 svchost.eXe 96 PID 4596 wrote to memory of 5324 4596 msmsgs.eXe 98 PID 124 wrote to memory of 1452 124 angle.eXe 100 PID 3008 wrote to memory of 5100 3008 svchost.eXe 102 PID 4596 wrote to memory of 5760 4596 msmsgs.eXe 104 PID 124 wrote to memory of 696 124 angle.eXe 106 PID 124 wrote to memory of 1812 124 angle.eXe 108 PID 124 wrote to memory of 2684 124 angle.eXe 109 PID 124 wrote to memory of 5820 124 angle.eXe 110 PID 1812 wrote to memory of 5944 1812 svchost.eXe 111 PID 2684 wrote to memory of 3988 2684 msmsgs.eXe 112 PID 5820 wrote to memory of 1344 5820 angle.eXe 115 PID 2684 wrote to memory of 4464 2684 msmsgs.eXe 117 PID 1812 wrote to memory of 5884 1812 svchost.eXe 118 PID 5820 wrote to memory of 5936 5820 angle.eXe 121 PID 3008 wrote to memory of 4788 3008 svchost.eXe 124 PID 3008 wrote to memory of 2752 3008 svchost.eXe 126 PID 3008 wrote to memory of 892 3008 svchost.eXe 128 PID 3008 wrote to memory of 3404 3008 svchost.eXe 130 PID 3008 wrote to memory of 2420 3008 svchost.eXe 132 PID 3008 wrote to memory of 3416 3008 svchost.eXe 134 PID 3008 wrote to memory of 2408 3008 svchost.eXe 136 PID 3008 wrote to memory of 3308 3008 svchost.eXe 138 PID 3008 wrote to memory of 5372 3008 svchost.eXe 140 PID 3008 wrote to memory of 5396 3008 svchost.eXe 142 PID 3008 wrote to memory of 4428 3008 svchost.eXe 144 PID 3008 wrote to memory of 3528 3008 svchost.eXe 146
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_650ccbd70b7249a23ce3cc256e5bbc15_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_650ccbd70b7249a23ce3cc256e5bbc15_elex_wannacry.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg2⤵
- System Location Discovery: System Language Discovery
PID:796
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" export HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srservice C:\Windows\regedit.reg2⤵
- System Location Discovery: System Language Discovery
PID:5244
-
-
C:\Users\Public\Pictures\svchost.eXe"C:\Users\Public\Pictures\svchost.eXe"2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:4348
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" export HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srservice C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:5100
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:4788
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:2752
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:892
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:3404
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:2420
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:3416
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:2408
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:3308
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:5372
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:5396
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:4428
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:3528
-
-
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\msmsgs.eXe"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\msmsgs.eXe"2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:5324
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" export HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srservice C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:5760
-
-
-
C:\Windows\SysWOW64\angle.eXe"C:\Windows\system32\angle.eXe"2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:124 -
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:1452
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" export HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srservice C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:696
-
-
C:\Users\Public\Music\svchost.eXe"C:\Users\Public\Music\svchost.eXe"3⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg4⤵
- System Location Discovery: System Language Discovery
PID:5944
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" export HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srservice C:\Windows\regedit.reg4⤵
- System Location Discovery: System Language Discovery
PID:5884
-
-
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\msmsgs.eXe"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\msmsgs.eXe"3⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg4⤵
- System Location Discovery: System Language Discovery
PID:3988
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" export HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srservice C:\Windows\regedit.reg4⤵
- System Location Discovery: System Language Discovery
PID:4464
-
-
-
C:\Windows\SysWOW64\angle.eXe"C:\Windows\system32\angle.eXe"3⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5820 -
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg4⤵
- System Location Discovery: System Language Discovery
PID:1344
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" export HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srservice C:\Windows\regedit.reg4⤵
- System Location Discovery: System Language Discovery
PID:5936
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Surat Buat Presiden.htm
- Size 656B
- SHA256 ea7c34f49417b382ff9c872fccd1f5f58636f3001a2fe837ed195a4d239f66e6
- MD5 e0722dddd4442be2d33a6948b7c8d04d
- SHA1 1bc56ec2ca2d1ae3c0cbb2f66289945a32bb3d13
- SHA512 2236ab5c1547e58aee6da04f4fe5f44a1292cd026596b3766eb76d468e6b67a391982baaa5f4698ec1c719c0c89142e136b1c0f17aa1ea19e7c4963655823bec
- TLSH T1BCF02377AD07238E447606C8215E69290C3D1E121A02464D5E107EF881A6981E7149D5
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\Music\RCX61B0.tmp
- Size 394KB
- SHA256 f6f5f9bdc4f96cadd64da0b64b7ff302df86c73e9198925fe440d3cdd13af283
- MD5 7a01a05001f83d9dded0eda88a15e1dc
- SHA1 f3583847a54700be8f819c73bb90046708cc034c
- SHA512 a4210fbc32d014ab6c8bf1159a0d566464071a7a574ee0c27514037ca1f211671e747afa046d6c5c4df5f786141aa4576532eef64d13d2457633dfffd86d9208
- SSDEEP 3072:RGC43DkTv+XZZp2q00000000000000000000000000000000000000000000000+:RGC43pZkY
- TLSH T17B84C5E47AC25363CB811670E00F0F78627E60DB805E9065A7F39B5697782199EEC1BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\Music\angle.eXe
- Size 394KB
- SHA256 a48b1d9a0ea37c6194df90cf1f08a0bab9eb7c54988f372b0ebb72a2adf8d45b
- MD5 650ccbd70b7249a23ce3cc256e5bbc15
- SHA1 210dd45e9c7430b87f7c6fdbfe40f65b32ac0f71
- SHA512 becbad460f4a60b3a5888e511dd0d687cccbc6c12a084d77e4690784d41ad5f2b0377347a1c0380d8baa80edf2bdd430ba207323dcf41ef60a0baf257148579e
- SSDEEP 3072:JGC43DkTv+XZZp2000000000000000000000000000000000000000000000000E:JGC43pZz
- TLSH T1A984F9D47AC25253CB411671E00F0F78623D60DB806F915AA7F3AB569B782099EEC1BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\Music\svchost.eXe
- Size 391KB
- SHA256 c354b08ecdad24345dc03b3f32fa8c8138e40dd01bae4d10dd20de3fcb1189eb
- MD5 80729c4156193e28800c4f265fa4c8b9
- SHA1 d1f09bb80f6cd46158a094a48972d7f07a8ace14
- SHA512 cfa587a6376462006f3c83972460c6fd2801e33d01b742f3188202c3394df74db6b42d76abbb7ee5f0d8c64b1a9c8d2a434e0af71b76c832670bc59d8d5eea48
- SSDEEP 3072:FGC43DkTv+XZZpja200000000000000000000000000000000000000000000002:FGC43pZRg
- TLSH T19284F9D47AC25253CB411671E00F0F78623D60DB806F915AA7F3AB569B782099EEC1BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\RCX6086.tmp
- Size 389KB
- SHA256 adf266be30b7fff94a79990c75d823ae6f34bd4b567aa3154a427f53ec72b126
- MD5 e6a1da6e8523e45305a1bfe04d3a7191
- SHA1 8163620b5b76c25f3073e6729ce6303eb8cf4971
- SHA512 f4d5dfdcfb374a920bfd3729ee45c4f4fa6637c0369f1df8c94ea636bfa270dd0cad20edefc18d5dba664ff8cb432feb2a4de67cd502d32b5081d24082b3082c
- SSDEEP 3072:RGC43DkTv+XZZplyh0000000000000000000000000000000000000000000000v:RGC43pZ/yB
- TLSH T1DA84F9D47AC25253CB411671E00F0F78623D60DB806F915AA7F3AB569B782099EEC1BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\ziprar.eXe
- Size 442KB
- SHA256 5a76de0ab7d5b2988efb91b533227f9c63eaa89e5cd26d99a308719e0106fd44
- MD5 ee81d0037a88b0470fc1d34c33a8fd35
- SHA1 7c61f797865f68248cf48de57143e877193f6784
- SHA512 4899058a5f53477aa086b71892f93c2a14c916ecf89f9ba0d85a52776a58541af0eb1df12822f8b3c370f0be0706e1e2eafbae5072a2e2279bb43d9889aa8fef
- SSDEEP 3072:8GC43DkTv+XZZp/000000000000000000000000000000000000000000000000k:8GC43pZq
- TLSH T158A4F8E576C25363CB410631E00F0B79663E6C97815F9126A2E3BB564B742099FEC2BF
- MD5 SHA1 SHA512 SSDEEP TLSH