Analysis
- max time kernel
150s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 04:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-10_95e0d337dd1333a760d111d714576e0a_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_95e0d337dd1333a760d111d714576e0a_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
General
- Target 2026-08-10_95e0d337dd1333a760d111d714576e0a_elex_wannacry.exe
- Size 249KB
- Sample260810-eyp3vs1cqc
- SHA256 9eb9047823c6c38fc78ef9f12f86fefc855022f9097570d16fc6c91a9aeea88b
- MD5 95e0d337dd1333a760d111d714576e0a
- SHA1 694c09468687a3d34c27cd69159ffb30eb820d5b
- SHA512 f7bfeca9d5beb4ce0cd3403311e68d458f473519804e211b6d4705fe49f20042d657278cf97104a68124bc27ac6fbe489d666ea2cd708ff17bcb293a25f66858
- SSDEEP 768:a4GjmJZkcEkdsH1r9Ov7UsrIMvcHvdSdGAENQP+EYHDlZZpHSidaKz2:HGjuPg3YP4cdTEu+ECZZprdR2
- TLSH T11044C82163965B5AED25273154030B3BEBF6142670AE233654B1CE1DBE682396F3F339
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 5 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 2026-08-10_95e0d337dd1333a760d111d714576e0a_elex_wannacry.exe Set value (int) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" svchost.eXe Set value (int) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" svchost.eXe Set value (int) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" msmsgs.eXe Set value (int) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" angle.eXe - Disables RegEdit via registry modification 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "2" svchost.eXe Set value (int) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "2" svchost.eXe Set value (int) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "2" msmsgs.eXe Set value (int) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "2" angle.eXe - Executes dropped EXE 4 IoCs
pid Process 716 svchost.eXe 1952 svchost.eXe 7116 msmsgs.eXe 6556 angle.eXe - Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts msmsgs.eXe - Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\RCX5FEA.tmp svchost.eXe File created C:\Windows\SysWOW64\angle.eXe 2026-08-10_95e0d337dd1333a760d111d714576e0a_elex_wannacry.exe File opened for modification C:\Windows\SysWOW64\angle.eXe 2026-08-10_95e0d337dd1333a760d111d714576e0a_elex_wannacry.exe File opened for modification C:\Windows\SysWOW64\RCX2A74.tmp 2026-08-10_95e0d337dd1333a760d111d714576e0a_elex_wannacry.exe File opened for modification C:\Windows\SysWOW64\angle.eXe svchost.eXe File opened for modification C:\Windows\SysWOW64\angle.eXe svchost.eXe File created C:\Windows\SysWOW64\angle.eXe msmsgs.eXe File created C:\Windows\SysWOW64\angle.eXe angle.eXe File opened for modification C:\Windows\SysWOW64\RCX5FBB.tmp svchost.eXe - Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office\WINWORD.exe 2026-08-10_95e0d337dd1333a760d111d714576e0a_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office11\WINWORD.exe 2026-08-10_95e0d337dd1333a760d111d714576e0a_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office\EXCEL.exe 2026-08-10_95e0d337dd1333a760d111d714576e0a_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office11\EXCEL.exe 2026-08-10_95e0d337dd1333a760d111d714576e0a_elex_wannacry.exe - Drops file in Windows directory 13 IoCs
description ioc Process File opened for modification C:\Windows\ziprar.eXe 2026-08-10_95e0d337dd1333a760d111d714576e0a_elex_wannacry.exe File opened for modification C:\Windows\svchost.eXe svchost.eXe File opened for modification C:\Windows\RCX5FBA.tmp svchost.eXe File opened for modification C:\Windows\RCX5FE9.tmp svchost.eXe File opened for modification C:\Windows\svchost.eXe angle.eXe File created C:\Windows\ziprar.eXe 2026-08-10_95e0d337dd1333a760d111d714576e0a_elex_wannacry.exe File opened for modification C:\Windows\RCX37E4.tmp 2026-08-10_95e0d337dd1333a760d111d714576e0a_elex_wannacry.exe File opened for modification C:\Windows\svchost.eXe svchost.eXe File created C:\Windows\svchost.eXe msmsgs.eXe File opened for modification C:\Windows\RCX6131.tmp angle.eXe File created C:\Windows\svchost.eXe 2026-08-10_95e0d337dd1333a760d111d714576e0a_elex_wannacry.exe File opened for modification C:\Windows\svchost.eXe 2026-08-10_95e0d337dd1333a760d111d714576e0a_elex_wannacry.exe File opened for modification C:\Windows\RCX2A54.tmp 2026-08-10_95e0d337dd1333a760d111d714576e0a_elex_wannacry.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 27 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.eXe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.eXe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msmsgs.eXe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language angle.eXe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_95e0d337dd1333a760d111d714576e0a_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\CLSID\{53BEDF0B-4E5B-4183-8DC9-B844344FA104} msmsgs.eXe Set value (str) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\CLSID\{53BEDF0B-4E5B-4183-8DC9-B844344FA104}\AppId = "{6d2b5079-2f0b-48dd-ab7f-97cec514d30b}" msmsgs.eXe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 7116 msmsgs.eXe 7116 msmsgs.eXe 7116 msmsgs.eXe 7116 msmsgs.eXe 7116 msmsgs.eXe 7116 msmsgs.eXe 7116 msmsgs.eXe 7116 msmsgs.eXe 7116 msmsgs.eXe 7116 msmsgs.eXe 7116 msmsgs.eXe 7116 msmsgs.eXe 7116 msmsgs.eXe 7116 msmsgs.eXe 7116 msmsgs.eXe 7116 msmsgs.eXe 7116 msmsgs.eXe 7116 msmsgs.eXe 7116 msmsgs.eXe 7116 msmsgs.eXe 7116 msmsgs.eXe 7116 msmsgs.eXe 7116 msmsgs.eXe 7116 msmsgs.eXe 7116 msmsgs.eXe 7116 msmsgs.eXe 7116 msmsgs.eXe 7116 msmsgs.eXe 7116 msmsgs.eXe 7116 msmsgs.eXe 7116 msmsgs.eXe 7116 msmsgs.eXe 7116 msmsgs.eXe 7116 msmsgs.eXe 7116 msmsgs.eXe 7116 msmsgs.eXe 7116 msmsgs.eXe 7116 msmsgs.eXe 7116 msmsgs.eXe 7116 msmsgs.eXe 7116 msmsgs.eXe 7116 msmsgs.eXe 7116 msmsgs.eXe 7116 msmsgs.eXe 7116 msmsgs.eXe 7116 msmsgs.eXe 7116 msmsgs.eXe 7116 msmsgs.eXe 7116 msmsgs.eXe 7116 msmsgs.eXe 7116 msmsgs.eXe 7116 msmsgs.eXe 7116 msmsgs.eXe 7116 msmsgs.eXe 7116 msmsgs.eXe 7116 msmsgs.eXe 7116 msmsgs.eXe 7116 msmsgs.eXe 7116 msmsgs.eXe 7116 msmsgs.eXe 7116 msmsgs.eXe 7116 msmsgs.eXe 7116 msmsgs.eXe 7116 msmsgs.eXe - Suspicious behavior: LoadsDriver 5 IoCs
pid 4 4 4 4 4 - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 7116 msmsgs.eXe Token: SeDebugPrivilege 7116 msmsgs.eXe Token: SeDebugPrivilege 7116 msmsgs.eXe Token: SeDebugPrivilege 7116 msmsgs.eXe Token: SeDebugPrivilege 7116 msmsgs.eXe Token: SeDebugPrivilege 7116 msmsgs.eXe Token: SeDebugPrivilege 7116 msmsgs.eXe Token: SeDebugPrivilege 7116 msmsgs.eXe Token: SeDebugPrivilege 7116 msmsgs.eXe Token: SeDebugPrivilege 7116 msmsgs.eXe Token: SeDebugPrivilege 7116 msmsgs.eXe Token: SeDebugPrivilege 7116 msmsgs.eXe Token: SeDebugPrivilege 7116 msmsgs.eXe Token: SeDebugPrivilege 7116 msmsgs.eXe Token: SeDebugPrivilege 7116 msmsgs.eXe Token: SeDebugPrivilege 7116 msmsgs.eXe Token: SeDebugPrivilege 7116 msmsgs.eXe Token: SeDebugPrivilege 7116 msmsgs.eXe Token: SeDebugPrivilege 7116 msmsgs.eXe Token: SeDebugPrivilege 7116 msmsgs.eXe Token: SeDebugPrivilege 7116 msmsgs.eXe Token: SeDebugPrivilege 7116 msmsgs.eXe Token: SeDebugPrivilege 7116 msmsgs.eXe Token: SeDebugPrivilege 7116 msmsgs.eXe Token: SeDebugPrivilege 7116 msmsgs.eXe Token: SeDebugPrivilege 7116 msmsgs.eXe Token: SeDebugPrivilege 7116 msmsgs.eXe Token: SeDebugPrivilege 7116 msmsgs.eXe Token: SeDebugPrivilege 7116 msmsgs.eXe Token: SeDebugPrivilege 7116 msmsgs.eXe Token: SeDebugPrivilege 7116 msmsgs.eXe Token: SeDebugPrivilege 7116 msmsgs.eXe Token: SeDebugPrivilege 7116 msmsgs.eXe Token: SeDebugPrivilege 7116 msmsgs.eXe Token: SeDebugPrivilege 7116 msmsgs.eXe Token: SeDebugPrivilege 7116 msmsgs.eXe Token: SeDebugPrivilege 7116 msmsgs.eXe Token: SeDebugPrivilege 7116 msmsgs.eXe Token: SeDebugPrivilege 7116 msmsgs.eXe Token: SeDebugPrivilege 7116 msmsgs.eXe Token: SeDebugPrivilege 7116 msmsgs.eXe Token: SeDebugPrivilege 7116 msmsgs.eXe Token: SeDebugPrivilege 7116 msmsgs.eXe Token: SeDebugPrivilege 7116 msmsgs.eXe Token: SeDebugPrivilege 7116 msmsgs.eXe Token: SeDebugPrivilege 7116 msmsgs.eXe Token: SeDebugPrivilege 7116 msmsgs.eXe Token: SeDebugPrivilege 7116 msmsgs.eXe Token: SeDebugPrivilege 7116 msmsgs.eXe Token: SeDebugPrivilege 7116 msmsgs.eXe Token: SeDebugPrivilege 7116 msmsgs.eXe Token: SeDebugPrivilege 7116 msmsgs.eXe Token: SeDebugPrivilege 7116 msmsgs.eXe Token: SeDebugPrivilege 7116 msmsgs.eXe Token: SeDebugPrivilege 7116 msmsgs.eXe Token: SeDebugPrivilege 7116 msmsgs.eXe Token: SeDebugPrivilege 7116 msmsgs.eXe Token: SeDebugPrivilege 7116 msmsgs.eXe Token: SeDebugPrivilege 7116 msmsgs.eXe Token: SeDebugPrivilege 7116 msmsgs.eXe Token: SeDebugPrivilege 7116 msmsgs.eXe Token: SeDebugPrivilege 7116 msmsgs.eXe Token: SeDebugPrivilege 7116 msmsgs.eXe Token: SeDebugPrivilege 7116 msmsgs.eXe - Suspicious use of SetWindowsHookEx 15 IoCs
pid Process 2220 2026-08-10_95e0d337dd1333a760d111d714576e0a_elex_wannacry.exe 2220 2026-08-10_95e0d337dd1333a760d111d714576e0a_elex_wannacry.exe 716 svchost.eXe 716 svchost.eXe 1952 svchost.eXe 1952 svchost.eXe 7116 msmsgs.eXe 7116 msmsgs.eXe 6556 angle.eXe 6556 angle.eXe 7116 msmsgs.eXe 1952 svchost.eXe 716 svchost.eXe 7116 msmsgs.eXe 716 svchost.eXe - Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 2220 wrote to memory of 3728 2220 2026-08-10_95e0d337dd1333a760d111d714576e0a_elex_wannacry.exe 90 PID 2220 wrote to memory of 4168 2220 2026-08-10_95e0d337dd1333a760d111d714576e0a_elex_wannacry.exe 92 PID 2220 wrote to memory of 716 2220 2026-08-10_95e0d337dd1333a760d111d714576e0a_elex_wannacry.exe 94 PID 2220 wrote to memory of 1952 2220 2026-08-10_95e0d337dd1333a760d111d714576e0a_elex_wannacry.exe 95 PID 2220 wrote to memory of 7116 2220 2026-08-10_95e0d337dd1333a760d111d714576e0a_elex_wannacry.exe 96 PID 1952 wrote to memory of 1992 1952 svchost.eXe 97 PID 2220 wrote to memory of 6556 2220 2026-08-10_95e0d337dd1333a760d111d714576e0a_elex_wannacry.exe 99 PID 716 wrote to memory of 2112 716 svchost.eXe 100 PID 7116 wrote to memory of 1228 7116 msmsgs.eXe 102 PID 6556 wrote to memory of 4332 6556 angle.eXe 104 PID 1952 wrote to memory of 2596 1952 svchost.eXe 106 PID 716 wrote to memory of 6704 716 svchost.eXe 108 PID 7116 wrote to memory of 2676 7116 msmsgs.eXe 110 PID 6556 wrote to memory of 5492 6556 angle.eXe 112 PID 716 wrote to memory of 3236 716 svchost.eXe 115 PID 716 wrote to memory of 252 716 svchost.eXe 117 PID 716 wrote to memory of 5480 716 svchost.eXe 119 PID 716 wrote to memory of 4688 716 svchost.eXe 121 PID 716 wrote to memory of 4964 716 svchost.eXe 123 PID 716 wrote to memory of 1008 716 svchost.eXe 125 PID 716 wrote to memory of 2820 716 svchost.eXe 127 PID 716 wrote to memory of 4080 716 svchost.eXe 129 PID 716 wrote to memory of 5532 716 svchost.eXe 131 PID 716 wrote to memory of 1004 716 svchost.eXe 133 PID 716 wrote to memory of 1612 716 svchost.eXe 135 PID 716 wrote to memory of 1888 716 svchost.eXe 137
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_95e0d337dd1333a760d111d714576e0a_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_95e0d337dd1333a760d111d714576e0a_elex_wannacry.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg2⤵
- System Location Discovery: System Language Discovery
PID:3728
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" export HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srservice C:\Windows\regedit.reg2⤵
- System Location Discovery: System Language Discovery
PID:4168
-
-
C:\Users\Public\Pictures\svchost.eXe"C:\Users\Public\Pictures\svchost.eXe"2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:716 -
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:2112
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" export HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srservice C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:6704
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:3236
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:252
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:5480
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:4688
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:4964
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:1008
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:2820
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:4080
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:5532
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:1004
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:1612
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:1888
-
-
-
C:\Users\Public\Music\svchost.eXe"C:\Users\Public\Music\svchost.eXe"2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:1992
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" export HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srservice C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:2596
-
-
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\msmsgs.eXe"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\msmsgs.eXe"2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Accesses Microsoft Outlook accounts
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:7116 -
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:1228
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" export HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srservice C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:2676
-
-
-
C:\Windows\SysWOW64\angle.eXe"C:\Windows\system32\angle.eXe"2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6556 -
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:4332
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" export HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srservice C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:5492
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Surat Buat Presiden.htm
- Size 656B
- SHA256 ea7c34f49417b382ff9c872fccd1f5f58636f3001a2fe837ed195a4d239f66e6
- MD5 e0722dddd4442be2d33a6948b7c8d04d
- SHA1 1bc56ec2ca2d1ae3c0cbb2f66289945a32bb3d13
- SHA512 2236ab5c1547e58aee6da04f4fe5f44a1292cd026596b3766eb76d468e6b67a391982baaa5f4698ec1c719c0c89142e136b1c0f17aa1ea19e7c4963655823bec
- TLSH T1BCF02377AD07238E447606C8215E69290C3D1E121A02464D5E107EF881A6981E7149D5
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\Music\angle.eXe
- Size 393KB
- SHA256 7ef4b696cf2ec8793faa2060f034b4861c75c0024e6995ea9b15d7ad872ce647
- MD5 cc5c888ff6b2b6ecc8f95ce379806b92
- SHA1 9357168b0ad8257adaaaf2de3bf70e9aafb06cfa
- SHA512 140daa7d527e175cd6183c82b66012861c17f492a7f5e146a4bec48bb487ebde6d283fac575ca8cfab9715d4ace756b16e70cdee57ce4c1e75f4b9e2761fe4c9
- SSDEEP 3072:RGC43DkTv+XZZpre00000000000000000000000000000000000000000000000w:RGC43pZhO
- TLSH T18D84C6E47AC25323CB811670E00F0F78627E60DB815E9065A7F39B5697782199EEC1BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\Music\svchost.eXe
- Size 248KB
- SHA256 e8746e590946af422d453df9845553f114690396346801f9a1f2631c5cd4da6a
- MD5 202edcce060e651f02cb5b7a301411d8
- SHA1 19d5b5b36569c937d5bc28d7c13b1c648d03ae93
- SHA512 c0d7d1c8ac40166100c81e49a8b7da4110d21ac753e3b455a1df4f15bb82252bc0ea74e60981898f073919777622372449d47b233c01073da86a5fa3c7821a3a
- SSDEEP 768:mMGjmJZkcEkdsH1r9Ov7UsrIMvcHvdSdGAENQP+EYHDlZZpAKdO:PGjuPg3YP4cdTEu+ECZZpxO
- TLSH T14D44C82163965B5AED25273154030B3BEBF6142670AE233654B1CE1DBE682396F3F339
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\Pictures\iexplore.eXe
- Size 249KB
- SHA256 9eb9047823c6c38fc78ef9f12f86fefc855022f9097570d16fc6c91a9aeea88b
- MD5 95e0d337dd1333a760d111d714576e0a
- SHA1 694c09468687a3d34c27cd69159ffb30eb820d5b
- SHA512 f7bfeca9d5beb4ce0cd3403311e68d458f473519804e211b6d4705fe49f20042d657278cf97104a68124bc27ac6fbe489d666ea2cd708ff17bcb293a25f66858
- SSDEEP 768:a4GjmJZkcEkdsH1r9Ov7UsrIMvcHvdSdGAENQP+EYHDlZZpHSidaKz2:HGjuPg3YP4cdTEu+ECZZprdR2
- TLSH T11044C82163965B5AED25273154030B3BEBF6142670AE233654B1CE1DBE682396F3F339
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\RCX5FE9.tmp
- Size 246KB
- SHA256 9dda9a2d43b7a5b1ac829420946431e54de02f15991577d382f28199354d22ba
- MD5 2e3941e81e751dd723d1413db086b8e2
- SHA1 c88407683cba80d1294e1cb59c79b0a7a95c8f39
- SHA512 d016b444459d840158776555cba7b004e18fef660a95ef5593a5b501cbcb4ac3bcf6ac67a5c796edec5c7dd802fc7b41ed506c7f934ea332b8d66d848aa2686d
- SSDEEP 768:APWGjmJZkcEkdsH1r9Ov7UsrIMvcHvdSdGAENQP+EYHDlZZpMTdGKXAV5cT:yWGjuPg3YP4cdTEu+ECZZpow5cT
- TLSH T14C34C82163965B5AED25273154030B3BEBF6142670AE233654B1CE1DBE682396F3F339
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\ziprar.eXe
- Size 322KB
- SHA256 b2bee9abe95c5e7ede0de697b56f12c1aec51e20b73b05cb1c2084a3c0816887
- MD5 4ff1b32d507c23eee64bf4e03ed4dabe
- SHA1 62c40c8bf9df526094a0d1dfc1a63003f6fcdd7b
- SHA512 351a6136fec6b861ecd16886d3921cf6d0fce01abc92051ae5f49e4dcbbee0a7aa1e31d82ac6d9e15d92311ff943b5f73124e4f0bf17d1396ecb6f9d15987328
- SSDEEP 1536:WGjuPg3YP4cdTEu+ECZZprdKWWWWWWWWWWWWWWWWWWWWWWWT:WGC43DkTv+XZZprJ
- TLSH T169640B11B2E55659ED282A325003873BDBF62C27619A533760F2FB1EBD7016C5F2B329
- MD5 SHA1 SHA512 SSDEEP TLSH