Analysis
- max time kernel
150s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/08/2026, 11:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-20_e34a7e68cf4f35e3976f2eaf183b966b_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-20_e34a7e68cf4f35e3976f2eaf183b966b_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target 2026-08-20_e34a7e68cf4f35e3976f2eaf183b966b_elex_wannacry.exe
- Size 773KB
- Sample260820-naszaach43
- SHA256 9010646722a479c22d1c954e6c50551ec0f8e1fe8d9584a88aeb3520f59fed13
- MD5 e34a7e68cf4f35e3976f2eaf183b966b
- SHA1 c075e95c41955bc34c3b0d7265fe4c20a7b63229
- SHA512 ac5a0ba137c5180528fe5f8abc56f02586010c43391dbff7e4afacb1d2c52ff7efa39f77c7a4378ee96886732de0603d1326555e179394ff67b0829cce769fe2
- SSDEEP 6144:fGC43NaVBhhhhhhhhhhhhhhhhhhhhhhhhhhhhorrrbrrrrr74:fAM
- TLSH T167F47CC0F95296D2EB020831C42F1F7D76EAAD521A5928056527BF172F73186ECAD23F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 5 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" svchost.eXe Set value (int) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" angle.eXe Set value (int) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" msmsgs.eXe Set value (int) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 2026-08-20_e34a7e68cf4f35e3976f2eaf183b966b_elex_wannacry.exe Set value (int) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" svchost.eXe - Disables RegEdit via registry modification 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "2" svchost.eXe Set value (int) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "2" svchost.eXe Set value (int) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "2" angle.eXe Set value (int) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "2" msmsgs.eXe - Executes dropped EXE 4 IoCs
pid Process 4948 svchost.eXe 4900 svchost.eXe 4484 msmsgs.eXe 4068 angle.eXe - Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\angle.eXe 2026-08-20_e34a7e68cf4f35e3976f2eaf183b966b_elex_wannacry.exe File opened for modification C:\Windows\SysWOW64\RCXF29B.tmp 2026-08-20_e34a7e68cf4f35e3976f2eaf183b966b_elex_wannacry.exe File opened for modification C:\Windows\SysWOW64\angle.eXe svchost.eXe File opened for modification C:\Windows\SysWOW64\RCX28BD.tmp svchost.eXe File opened for modification C:\Windows\SysWOW64\angle.eXe svchost.eXe File created C:\Windows\SysWOW64\angle.eXe angle.eXe File opened for modification C:\Windows\SysWOW64\angle.eXe 2026-08-20_e34a7e68cf4f35e3976f2eaf183b966b_elex_wannacry.exe File opened for modification C:\Windows\SysWOW64\RCX2A15.tmp svchost.eXe File created C:\Windows\SysWOW64\angle.eXe msmsgs.eXe - Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office11\WINWORD.exe 2026-08-20_e34a7e68cf4f35e3976f2eaf183b966b_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office\EXCEL.exe 2026-08-20_e34a7e68cf4f35e3976f2eaf183b966b_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office11\EXCEL.exe 2026-08-20_e34a7e68cf4f35e3976f2eaf183b966b_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office\WINWORD.exe 2026-08-20_e34a7e68cf4f35e3976f2eaf183b966b_elex_wannacry.exe - Drops file in Windows directory 13 IoCs
description ioc Process File opened for modification C:\Windows\RCX2B6B.tmp angle.eXe File created C:\Windows\svchost.eXe 2026-08-20_e34a7e68cf4f35e3976f2eaf183b966b_elex_wannacry.exe File opened for modification C:\Windows\svchost.eXe 2026-08-20_e34a7e68cf4f35e3976f2eaf183b966b_elex_wannacry.exe File opened for modification C:\Windows\RCX49.tmp 2026-08-20_e34a7e68cf4f35e3976f2eaf183b966b_elex_wannacry.exe File opened for modification C:\Windows\svchost.eXe svchost.eXe File opened for modification C:\Windows\RCX28AC.tmp svchost.eXe File created C:\Windows\svchost.eXe msmsgs.eXe File opened for modification C:\Windows\svchost.eXe angle.eXe File opened for modification C:\Windows\RCXF28B.tmp 2026-08-20_e34a7e68cf4f35e3976f2eaf183b966b_elex_wannacry.exe File created C:\Windows\ziprar.eXe 2026-08-20_e34a7e68cf4f35e3976f2eaf183b966b_elex_wannacry.exe File opened for modification C:\Windows\ziprar.eXe 2026-08-20_e34a7e68cf4f35e3976f2eaf183b966b_elex_wannacry.exe File opened for modification C:\Windows\svchost.eXe svchost.eXe File opened for modification C:\Windows\RCX29B6.tmp svchost.eXe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 27 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.eXe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msmsgs.eXe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.eXe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language angle.eXe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-20_e34a7e68cf4f35e3976f2eaf183b966b_elex_wannacry.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4484 msmsgs.eXe 4484 msmsgs.eXe 4484 msmsgs.eXe 4484 msmsgs.eXe 4484 msmsgs.eXe 4484 msmsgs.eXe 4484 msmsgs.eXe 4484 msmsgs.eXe 4484 msmsgs.eXe 4484 msmsgs.eXe 4484 msmsgs.eXe 4484 msmsgs.eXe 4484 msmsgs.eXe 4484 msmsgs.eXe 4484 msmsgs.eXe 4484 msmsgs.eXe 4484 msmsgs.eXe 4484 msmsgs.eXe 4484 msmsgs.eXe 4484 msmsgs.eXe 4484 msmsgs.eXe 4484 msmsgs.eXe 4484 msmsgs.eXe 4484 msmsgs.eXe 4484 msmsgs.eXe 4484 msmsgs.eXe 4484 msmsgs.eXe 4484 msmsgs.eXe 4484 msmsgs.eXe 4484 msmsgs.eXe 4484 msmsgs.eXe 4484 msmsgs.eXe 4484 msmsgs.eXe 4484 msmsgs.eXe 4484 msmsgs.eXe 4484 msmsgs.eXe 4484 msmsgs.eXe 4484 msmsgs.eXe 4484 msmsgs.eXe 4484 msmsgs.eXe 4484 msmsgs.eXe 4484 msmsgs.eXe 4484 msmsgs.eXe 4484 msmsgs.eXe 4484 msmsgs.eXe 4484 msmsgs.eXe 4484 msmsgs.eXe 4484 msmsgs.eXe 4484 msmsgs.eXe 4484 msmsgs.eXe 4484 msmsgs.eXe 4484 msmsgs.eXe 4484 msmsgs.eXe 4484 msmsgs.eXe 4484 msmsgs.eXe 4484 msmsgs.eXe 4484 msmsgs.eXe 4484 msmsgs.eXe 4484 msmsgs.eXe 4484 msmsgs.eXe 4484 msmsgs.eXe 4484 msmsgs.eXe 4484 msmsgs.eXe 4484 msmsgs.eXe - Suspicious behavior: LoadsDriver 5 IoCs
pid 4 4 4 4 4 - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4484 msmsgs.eXe Token: SeDebugPrivilege 4484 msmsgs.eXe Token: SeDebugPrivilege 4484 msmsgs.eXe Token: SeDebugPrivilege 4484 msmsgs.eXe Token: SeDebugPrivilege 4484 msmsgs.eXe Token: SeDebugPrivilege 4484 msmsgs.eXe Token: SeDebugPrivilege 4484 msmsgs.eXe Token: SeDebugPrivilege 4484 msmsgs.eXe Token: SeDebugPrivilege 4484 msmsgs.eXe Token: SeDebugPrivilege 4484 msmsgs.eXe Token: SeDebugPrivilege 4484 msmsgs.eXe Token: SeDebugPrivilege 4484 msmsgs.eXe Token: SeDebugPrivilege 4484 msmsgs.eXe Token: SeDebugPrivilege 4484 msmsgs.eXe Token: SeDebugPrivilege 4484 msmsgs.eXe Token: SeDebugPrivilege 4484 msmsgs.eXe Token: SeDebugPrivilege 4484 msmsgs.eXe Token: SeDebugPrivilege 4484 msmsgs.eXe Token: SeDebugPrivilege 4484 msmsgs.eXe Token: SeDebugPrivilege 4484 msmsgs.eXe Token: SeDebugPrivilege 4484 msmsgs.eXe Token: SeDebugPrivilege 4484 msmsgs.eXe Token: SeDebugPrivilege 4484 msmsgs.eXe Token: SeDebugPrivilege 4484 msmsgs.eXe Token: SeDebugPrivilege 4484 msmsgs.eXe Token: SeDebugPrivilege 4484 msmsgs.eXe Token: SeDebugPrivilege 4484 msmsgs.eXe Token: SeDebugPrivilege 4484 msmsgs.eXe Token: SeDebugPrivilege 4484 msmsgs.eXe Token: SeDebugPrivilege 4484 msmsgs.eXe Token: SeDebugPrivilege 4484 msmsgs.eXe Token: SeDebugPrivilege 4484 msmsgs.eXe Token: SeDebugPrivilege 4484 msmsgs.eXe Token: SeDebugPrivilege 4484 msmsgs.eXe Token: SeDebugPrivilege 4484 msmsgs.eXe Token: SeDebugPrivilege 4484 msmsgs.eXe Token: SeDebugPrivilege 4484 msmsgs.eXe Token: SeDebugPrivilege 4484 msmsgs.eXe Token: SeDebugPrivilege 4484 msmsgs.eXe Token: SeDebugPrivilege 4484 msmsgs.eXe Token: SeDebugPrivilege 4484 msmsgs.eXe Token: SeDebugPrivilege 4484 msmsgs.eXe Token: SeDebugPrivilege 4484 msmsgs.eXe Token: SeDebugPrivilege 4484 msmsgs.eXe Token: SeDebugPrivilege 4484 msmsgs.eXe Token: SeDebugPrivilege 4484 msmsgs.eXe Token: SeDebugPrivilege 4484 msmsgs.eXe Token: SeDebugPrivilege 4484 msmsgs.eXe Token: SeDebugPrivilege 4484 msmsgs.eXe Token: SeDebugPrivilege 4484 msmsgs.eXe Token: SeDebugPrivilege 4484 msmsgs.eXe Token: SeDebugPrivilege 4484 msmsgs.eXe Token: SeDebugPrivilege 4484 msmsgs.eXe Token: SeDebugPrivilege 4484 msmsgs.eXe Token: SeDebugPrivilege 4484 msmsgs.eXe Token: SeDebugPrivilege 4484 msmsgs.eXe Token: SeDebugPrivilege 4484 msmsgs.eXe Token: SeDebugPrivilege 4484 msmsgs.eXe Token: SeDebugPrivilege 4484 msmsgs.eXe Token: SeDebugPrivilege 4484 msmsgs.eXe Token: SeDebugPrivilege 4484 msmsgs.eXe Token: SeDebugPrivilege 4484 msmsgs.eXe Token: SeDebugPrivilege 4484 msmsgs.eXe Token: SeDebugPrivilege 4484 msmsgs.eXe - Suspicious use of SetWindowsHookEx 14 IoCs
pid Process 3440 2026-08-20_e34a7e68cf4f35e3976f2eaf183b966b_elex_wannacry.exe 3440 2026-08-20_e34a7e68cf4f35e3976f2eaf183b966b_elex_wannacry.exe 4948 svchost.eXe 4948 svchost.eXe 4900 svchost.eXe 4900 svchost.eXe 4484 msmsgs.eXe 4484 msmsgs.eXe 4068 angle.eXe 4068 angle.eXe 4484 msmsgs.eXe 4948 svchost.eXe 4900 svchost.eXe 4948 svchost.eXe - Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 3440 wrote to memory of 2512 3440 2026-08-20_e34a7e68cf4f35e3976f2eaf183b966b_elex_wannacry.exe 89 PID 3440 wrote to memory of 1224 3440 2026-08-20_e34a7e68cf4f35e3976f2eaf183b966b_elex_wannacry.exe 91 PID 3440 wrote to memory of 4948 3440 2026-08-20_e34a7e68cf4f35e3976f2eaf183b966b_elex_wannacry.exe 93 PID 3440 wrote to memory of 4900 3440 2026-08-20_e34a7e68cf4f35e3976f2eaf183b966b_elex_wannacry.exe 94 PID 3440 wrote to memory of 4484 3440 2026-08-20_e34a7e68cf4f35e3976f2eaf183b966b_elex_wannacry.exe 95 PID 4948 wrote to memory of 4808 4948 svchost.eXe 96 PID 3440 wrote to memory of 4068 3440 2026-08-20_e34a7e68cf4f35e3976f2eaf183b966b_elex_wannacry.exe 98 PID 4900 wrote to memory of 1732 4900 svchost.eXe 99 PID 4068 wrote to memory of 4396 4068 angle.eXe 101 PID 4484 wrote to memory of 3300 4484 msmsgs.eXe 103 PID 4948 wrote to memory of 4336 4948 svchost.eXe 105 PID 4900 wrote to memory of 1808 4900 svchost.eXe 107 PID 4068 wrote to memory of 4284 4068 angle.eXe 109 PID 4484 wrote to memory of 4488 4484 msmsgs.eXe 111 PID 4948 wrote to memory of 2456 4948 svchost.eXe 114 PID 4948 wrote to memory of 1404 4948 svchost.eXe 116 PID 4948 wrote to memory of 6092 4948 svchost.eXe 118 PID 4948 wrote to memory of 4652 4948 svchost.eXe 120 PID 4948 wrote to memory of 4920 4948 svchost.eXe 122 PID 4948 wrote to memory of 1180 4948 svchost.eXe 124 PID 4948 wrote to memory of 5344 4948 svchost.eXe 126 PID 4948 wrote to memory of 2652 4948 svchost.eXe 128 PID 4948 wrote to memory of 4380 4948 svchost.eXe 130 PID 4948 wrote to memory of 4080 4948 svchost.eXe 132 PID 4948 wrote to memory of 2172 4948 svchost.eXe 134 PID 4948 wrote to memory of 1816 4948 svchost.eXe 136
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_e34a7e68cf4f35e3976f2eaf183b966b_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_e34a7e68cf4f35e3976f2eaf183b966b_elex_wannacry.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg2⤵
- System Location Discovery: System Language Discovery
PID:2512
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" export HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srservice C:\Windows\regedit.reg2⤵
- System Location Discovery: System Language Discovery
PID:1224
-
-
C:\Users\Public\Pictures\svchost.eXe"C:\Users\Public\Pictures\svchost.eXe"2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:4808
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" export HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srservice C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:4336
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:2456
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:1404
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:6092
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:4652
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:4920
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:1180
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:5344
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:2652
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:4380
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:4080
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:2172
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:1816
-
-
-
C:\Users\Public\Music\svchost.eXe"C:\Users\Public\Music\svchost.eXe"2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:1732
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" export HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srservice C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:1808
-
-
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\msmsgs.eXe"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\msmsgs.eXe"2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:3300
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" export HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srservice C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:4488
-
-
-
C:\Windows\SysWOW64\angle.eXe"C:\Windows\system32\angle.eXe"2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:4396
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" export HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srservice C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:4284
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Surat Buat Presiden.htm
- Size 656B
- SHA256 ea7c34f49417b382ff9c872fccd1f5f58636f3001a2fe837ed195a4d239f66e6
- MD5 e0722dddd4442be2d33a6948b7c8d04d
- SHA1 1bc56ec2ca2d1ae3c0cbb2f66289945a32bb3d13
- SHA512 2236ab5c1547e58aee6da04f4fe5f44a1292cd026596b3766eb76d468e6b67a391982baaa5f4698ec1c719c0c89142e136b1c0f17aa1ea19e7c4963655823bec
- TLSH T1BCF02377AD07238E447606C8215E69290C3D1E121A02464D5E107EF881A6981E7149D5
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\Music\svchost.eXe
- Size 763KB
- SHA256 8b3bd65722ad8172e8b8cbe05ade852cef58fcd0909c35b92248a9a55d91b151
- MD5 989d203ffb8b5930d760910fb4f1f462
- SHA1 f6466b35bca4071ed7afe071d8de55eaf4dbb4be
- SHA512 d49bc5b81891b556da991063d622f02db1e86f5ecf8c1ff3946ab7abd5ee7a61d79c6ef1422825ade144eb4641d067557198ce155c7de3d1e2a38033079fb30c
- SSDEEP 6144:XGC43NaVhnhhhhhhhhhhhhhhhhhhhhhhhhhhhorrrbrrrrr7Z:XA3
- TLSH T193F47CC1F94296D2EB020831C42F1F7936EAAD521A5928056527BF172F73186EDED23F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\Pictures\wmplayer.eXe
- Size 773KB
- SHA256 9010646722a479c22d1c954e6c50551ec0f8e1fe8d9584a88aeb3520f59fed13
- MD5 e34a7e68cf4f35e3976f2eaf183b966b
- SHA1 c075e95c41955bc34c3b0d7265fe4c20a7b63229
- SHA512 ac5a0ba137c5180528fe5f8abc56f02586010c43391dbff7e4afacb1d2c52ff7efa39f77c7a4378ee96886732de0603d1326555e179394ff67b0829cce769fe2
- SSDEEP 6144:fGC43NaVBhhhhhhhhhhhhhhhhhhhhhhhhhhhhorrrbrrrrr74:fAM
- TLSH T167F47CC0F95296D2EB020831C42F1F7D76EAAD521A5928056527BF172F73186ECAD23F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\RCX29B6.tmp
- Size 753KB
- SHA256 e3047942ddd2488acd73e0b0b656a09d9efb2ea0edee7a425ded2b80ee1531e9
- MD5 f2da7e8b21d28e414d853afa7f8575a5
- SHA1 24f8e01e5d48365d0d5efbdbc88cbddfcd70a95e
- SHA512 5adac67d2c62f99c6a21b29871b9bb1dd50290f56471c6bc6414708687abfcabbece92bcc58a22d3c9e4a981e0dd23efae9a604bd4c681e716c86a65867b8cd8
- SSDEEP 6144:3GC43NaVDhhhhhhhhhhhhhhhhhhhhhhhhhhorrrbrrrrr7b:3Ap
- TLSH T1D3F47DC1F94296D2EB020831C42F1F7936EBAD521A5928056527BF172F73186EDAD23F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\ziprar.eXe
- Size 647KB
- SHA256 39636e37cd7e10977c2f163de5666d64a21a7b4a4f6a9dacd42f2530b50b7e54
- MD5 aae7a5a770b9a6cb9fafbb4f9cab9f90
- SHA1 6563fafb46b0a7bebd0188dc09a40c40b4432b3f
- SHA512 caad6578a57568fa65a562d69677cca622f3fff66054378ea744e6d752615097a0180c23fbb4bdb1215c1ec0b003cf145dabf9655fa48b518fe4c13d1f3000ec
- SSDEEP 3072:9GC43DksD+XZVpasHhhhhO0000000000000000000l000000000000000000000u:9GC43NaVMghhhhorrrbrrrrr74
- TLSH T182E44BC1F18252E3EF180832901F5F75179A7D63564A590672A7FB231A731C8AE9E23F
- MD5 SHA1 SHA512 SSDEEP TLSH