Analysis
- max time kernel
150s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/11/2026, 22:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-03_414637098cf469414321e4b86b1b1d8a_elex_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-03_414637098cf469414321e4b86b1b1d8a_elex_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
General
- Target 2026-11-03_414637098cf469414321e4b86b1b1d8a_elex_wannacry.exe
- Size 772KB
- Sample261104-2k3s5avycv
- SHA256 f44ccd726389512d64621b9472f30374bc6b83d7c36b2b30cb2e9d9a4114233a
- MD5 414637098cf469414321e4b86b1b1d8a
- SHA1 362379c5c904dc8407aae8b91b526eea96923414
- SHA512 1152cd80a65affb26bc328ede0154e200e43b39b31fcf18539cd0afaaea3b2b4d629d393e086ea606dddb9665afe17a3dcf50d26a2b0505acf632008eb878bfd
- SSDEEP 6144:XGC43NaVNhhhhhhhhhhhhhhhhhhhhhhhhhhhhorrrbrrrrr7w:XAk
- TLSH T1AAF47CC0F95296D2EB020831C42F1F7D76EAAD521A5928056527BF172F73186ECAD23F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 5 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 2026-11-03_414637098cf469414321e4b86b1b1d8a_elex_wannacry.exe Set value (int) \REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" svchost.eXe Set value (int) \REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" svchost.eXe Set value (int) \REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" msmsgs.eXe Set value (int) \REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" angle.eXe - Disables RegEdit via registry modification 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "2" msmsgs.eXe Set value (int) \REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "2" angle.eXe Set value (int) \REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "2" svchost.eXe Set value (int) \REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "2" svchost.eXe - Executes dropped EXE 4 IoCs
pid Process 1112 svchost.eXe 1396 svchost.eXe 5780 msmsgs.eXe 364 angle.eXe - Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\angle.eXe svchost.eXe File created C:\Windows\SysWOW64\angle.eXe msmsgs.eXe File created C:\Windows\SysWOW64\angle.eXe angle.eXe File opened for modification C:\Windows\SysWOW64\angle.eXe 2026-11-03_414637098cf469414321e4b86b1b1d8a_elex_wannacry.exe File opened for modification C:\Windows\SysWOW64\RCXEBC5.tmp 2026-11-03_414637098cf469414321e4b86b1b1d8a_elex_wannacry.exe File opened for modification C:\Windows\SysWOW64\angle.eXe svchost.eXe File opened for modification C:\Windows\SysWOW64\RCX2245.tmp svchost.eXe File opened for modification C:\Windows\SysWOW64\RCX2293.tmp svchost.eXe File created C:\Windows\SysWOW64\angle.eXe 2026-11-03_414637098cf469414321e4b86b1b1d8a_elex_wannacry.exe - Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office\WINWORD.exe 2026-11-03_414637098cf469414321e4b86b1b1d8a_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office11\WINWORD.exe 2026-11-03_414637098cf469414321e4b86b1b1d8a_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office\EXCEL.exe 2026-11-03_414637098cf469414321e4b86b1b1d8a_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office11\EXCEL.exe 2026-11-03_414637098cf469414321e4b86b1b1d8a_elex_wannacry.exe - Drops file in Windows directory 13 IoCs
description ioc Process File created C:\Windows\svchost.eXe 2026-11-03_414637098cf469414321e4b86b1b1d8a_elex_wannacry.exe File opened for modification C:\Windows\RCXEBB5.tmp 2026-11-03_414637098cf469414321e4b86b1b1d8a_elex_wannacry.exe File created C:\Windows\ziprar.eXe 2026-11-03_414637098cf469414321e4b86b1b1d8a_elex_wannacry.exe File opened for modification C:\Windows\RCXF993.tmp 2026-11-03_414637098cf469414321e4b86b1b1d8a_elex_wannacry.exe File opened for modification C:\Windows\svchost.eXe svchost.eXe File opened for modification C:\Windows\RCX2244.tmp svchost.eXe File opened for modification C:\Windows\RCX2292.tmp svchost.eXe File created C:\Windows\svchost.eXe msmsgs.eXe File opened for modification C:\Windows\svchost.eXe 2026-11-03_414637098cf469414321e4b86b1b1d8a_elex_wannacry.exe File opened for modification C:\Windows\ziprar.eXe 2026-11-03_414637098cf469414321e4b86b1b1d8a_elex_wannacry.exe File opened for modification C:\Windows\svchost.eXe svchost.eXe File opened for modification C:\Windows\svchost.eXe angle.eXe File opened for modification C:\Windows\RCX2495.tmp angle.eXe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname svchost.eXe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain svchost.eXe - System Location Discovery: System Language Discovery 1 TTPs 27 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msmsgs.eXe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-11-03_414637098cf469414321e4b86b1b1d8a_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.eXe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.eXe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language angle.eXe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5780 msmsgs.eXe 5780 msmsgs.eXe 5780 msmsgs.eXe 5780 msmsgs.eXe 5780 msmsgs.eXe 5780 msmsgs.eXe 5780 msmsgs.eXe 5780 msmsgs.eXe 5780 msmsgs.eXe 5780 msmsgs.eXe 5780 msmsgs.eXe 5780 msmsgs.eXe 5780 msmsgs.eXe 5780 msmsgs.eXe 5780 msmsgs.eXe 5780 msmsgs.eXe 5780 msmsgs.eXe 5780 msmsgs.eXe 5780 msmsgs.eXe 5780 msmsgs.eXe 5780 msmsgs.eXe 5780 msmsgs.eXe 5780 msmsgs.eXe 5780 msmsgs.eXe 5780 msmsgs.eXe 5780 msmsgs.eXe 5780 msmsgs.eXe 5780 msmsgs.eXe 5780 msmsgs.eXe 5780 msmsgs.eXe 5780 msmsgs.eXe 5780 msmsgs.eXe 5780 msmsgs.eXe 5780 msmsgs.eXe 5780 msmsgs.eXe 5780 msmsgs.eXe 5780 msmsgs.eXe 5780 msmsgs.eXe 5780 msmsgs.eXe 5780 msmsgs.eXe 5780 msmsgs.eXe 5780 msmsgs.eXe 5780 msmsgs.eXe 5780 msmsgs.eXe 5780 msmsgs.eXe 5780 msmsgs.eXe 5780 msmsgs.eXe 5780 msmsgs.eXe 5780 msmsgs.eXe 5780 msmsgs.eXe 5780 msmsgs.eXe 5780 msmsgs.eXe 5780 msmsgs.eXe 5780 msmsgs.eXe 5780 msmsgs.eXe 5780 msmsgs.eXe 5780 msmsgs.eXe 5780 msmsgs.eXe 5780 msmsgs.eXe 5780 msmsgs.eXe 5780 msmsgs.eXe 5780 msmsgs.eXe 5780 msmsgs.eXe 5780 msmsgs.eXe - Suspicious behavior: LoadsDriver 5 IoCs
pid 4 4 4 4 4 - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5780 msmsgs.eXe Token: SeDebugPrivilege 5780 msmsgs.eXe Token: SeDebugPrivilege 5780 msmsgs.eXe Token: SeDebugPrivilege 5780 msmsgs.eXe Token: SeDebugPrivilege 5780 msmsgs.eXe Token: SeDebugPrivilege 5780 msmsgs.eXe Token: SeDebugPrivilege 5780 msmsgs.eXe Token: SeDebugPrivilege 5780 msmsgs.eXe Token: SeDebugPrivilege 5780 msmsgs.eXe Token: SeDebugPrivilege 5780 msmsgs.eXe Token: SeDebugPrivilege 5780 msmsgs.eXe Token: SeDebugPrivilege 5780 msmsgs.eXe Token: SeDebugPrivilege 5780 msmsgs.eXe Token: SeDebugPrivilege 5780 msmsgs.eXe Token: SeDebugPrivilege 5780 msmsgs.eXe Token: SeDebugPrivilege 5780 msmsgs.eXe Token: SeDebugPrivilege 5780 msmsgs.eXe Token: SeDebugPrivilege 5780 msmsgs.eXe Token: SeDebugPrivilege 5780 msmsgs.eXe Token: SeDebugPrivilege 5780 msmsgs.eXe Token: SeDebugPrivilege 5780 msmsgs.eXe Token: SeDebugPrivilege 5780 msmsgs.eXe Token: SeDebugPrivilege 5780 msmsgs.eXe Token: SeDebugPrivilege 5780 msmsgs.eXe Token: SeDebugPrivilege 5780 msmsgs.eXe Token: SeDebugPrivilege 5780 msmsgs.eXe Token: SeDebugPrivilege 5780 msmsgs.eXe Token: SeDebugPrivilege 5780 msmsgs.eXe Token: SeDebugPrivilege 5780 msmsgs.eXe Token: SeDebugPrivilege 5780 msmsgs.eXe Token: SeDebugPrivilege 5780 msmsgs.eXe Token: SeDebugPrivilege 5780 msmsgs.eXe Token: SeDebugPrivilege 5780 msmsgs.eXe Token: SeDebugPrivilege 5780 msmsgs.eXe Token: SeDebugPrivilege 5780 msmsgs.eXe Token: SeDebugPrivilege 5780 msmsgs.eXe Token: SeDebugPrivilege 5780 msmsgs.eXe Token: SeDebugPrivilege 5780 msmsgs.eXe Token: SeDebugPrivilege 5780 msmsgs.eXe Token: SeDebugPrivilege 5780 msmsgs.eXe Token: SeDebugPrivilege 5780 msmsgs.eXe Token: SeDebugPrivilege 5780 msmsgs.eXe Token: SeDebugPrivilege 5780 msmsgs.eXe Token: SeDebugPrivilege 5780 msmsgs.eXe Token: SeDebugPrivilege 5780 msmsgs.eXe Token: SeDebugPrivilege 5780 msmsgs.eXe Token: SeDebugPrivilege 5780 msmsgs.eXe Token: SeDebugPrivilege 5780 msmsgs.eXe Token: SeDebugPrivilege 5780 msmsgs.eXe Token: SeDebugPrivilege 5780 msmsgs.eXe Token: SeDebugPrivilege 5780 msmsgs.eXe Token: SeDebugPrivilege 5780 msmsgs.eXe Token: SeDebugPrivilege 5780 msmsgs.eXe Token: SeDebugPrivilege 5780 msmsgs.eXe Token: SeDebugPrivilege 5780 msmsgs.eXe Token: SeDebugPrivilege 5780 msmsgs.eXe Token: SeDebugPrivilege 5780 msmsgs.eXe Token: SeDebugPrivilege 5780 msmsgs.eXe Token: SeDebugPrivilege 5780 msmsgs.eXe Token: SeDebugPrivilege 5780 msmsgs.eXe Token: SeDebugPrivilege 5780 msmsgs.eXe Token: SeDebugPrivilege 5780 msmsgs.eXe Token: SeDebugPrivilege 5780 msmsgs.eXe Token: SeDebugPrivilege 5780 msmsgs.eXe - Suspicious use of SetWindowsHookEx 14 IoCs
pid Process 2536 2026-11-03_414637098cf469414321e4b86b1b1d8a_elex_wannacry.exe 2536 2026-11-03_414637098cf469414321e4b86b1b1d8a_elex_wannacry.exe 1112 svchost.eXe 1112 svchost.eXe 1396 svchost.eXe 1396 svchost.eXe 5780 msmsgs.eXe 5780 msmsgs.eXe 364 angle.eXe 364 angle.eXe 5780 msmsgs.eXe 1112 svchost.eXe 1396 svchost.eXe 1112 svchost.eXe - Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 2536 wrote to memory of 3616 2536 2026-11-03_414637098cf469414321e4b86b1b1d8a_elex_wannacry.exe 89 PID 2536 wrote to memory of 564 2536 2026-11-03_414637098cf469414321e4b86b1b1d8a_elex_wannacry.exe 91 PID 2536 wrote to memory of 1112 2536 2026-11-03_414637098cf469414321e4b86b1b1d8a_elex_wannacry.exe 93 PID 2536 wrote to memory of 1396 2536 2026-11-03_414637098cf469414321e4b86b1b1d8a_elex_wannacry.exe 94 PID 1112 wrote to memory of 3876 1112 svchost.eXe 95 PID 2536 wrote to memory of 5780 2536 2026-11-03_414637098cf469414321e4b86b1b1d8a_elex_wannacry.exe 97 PID 1396 wrote to memory of 712 1396 svchost.eXe 98 PID 2536 wrote to memory of 364 2536 2026-11-03_414637098cf469414321e4b86b1b1d8a_elex_wannacry.exe 100 PID 5780 wrote to memory of 1976 5780 msmsgs.eXe 101 PID 364 wrote to memory of 5788 364 angle.eXe 103 PID 1112 wrote to memory of 1756 1112 svchost.eXe 105 PID 1396 wrote to memory of 4716 1396 svchost.eXe 107 PID 5780 wrote to memory of 5776 5780 msmsgs.eXe 109 PID 364 wrote to memory of 1152 364 angle.eXe 111 PID 1112 wrote to memory of 424 1112 svchost.eXe 114 PID 1112 wrote to memory of 1360 1112 svchost.eXe 116 PID 1112 wrote to memory of 2396 1112 svchost.eXe 118 PID 1112 wrote to memory of 6004 1112 svchost.eXe 120 PID 1112 wrote to memory of 2556 1112 svchost.eXe 122 PID 1112 wrote to memory of 5100 1112 svchost.eXe 124 PID 1112 wrote to memory of 2092 1112 svchost.eXe 126 PID 1112 wrote to memory of 5452 1112 svchost.eXe 128 PID 1112 wrote to memory of 2840 1112 svchost.eXe 130 PID 1112 wrote to memory of 3784 1112 svchost.eXe 132 PID 1112 wrote to memory of 912 1112 svchost.eXe 134 PID 1112 wrote to memory of 3548 1112 svchost.eXe 136
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-03_414637098cf469414321e4b86b1b1d8a_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-03_414637098cf469414321e4b86b1b1d8a_elex_wannacry.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg2⤵
- System Location Discovery: System Language Discovery
PID:3616
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" export HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srservice C:\Windows\regedit.reg2⤵
- System Location Discovery: System Language Discovery
PID:564
-
-
C:\Users\Public\Pictures\svchost.eXe"C:\Users\Public\Pictures\svchost.eXe"2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:3876
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" export HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srservice C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:1756
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:424
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:1360
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:2396
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:6004
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:2556
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:5100
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:2092
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:5452
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:2840
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:3784
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:912
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:3548
-
-
-
C:\Users\Public\Music\svchost.eXe"C:\Users\Public\Music\svchost.eXe"2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:712
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" export HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srservice C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:4716
-
-
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\msmsgs.eXe"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\msmsgs.eXe"2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:1976
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" export HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srservice C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:5776
-
-
-
C:\Windows\SysWOW64\angle.eXe"C:\Windows\system32\angle.eXe"2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" import C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:5788
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" export HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srservice C:\Windows\regedit.reg3⤵
- System Location Discovery: System Language Discovery
PID:1152
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Surat Buat Presiden.htm
- Size 656B
- SHA256 ea7c34f49417b382ff9c872fccd1f5f58636f3001a2fe837ed195a4d239f66e6
- MD5 e0722dddd4442be2d33a6948b7c8d04d
- SHA1 1bc56ec2ca2d1ae3c0cbb2f66289945a32bb3d13
- SHA512 2236ab5c1547e58aee6da04f4fe5f44a1292cd026596b3766eb76d468e6b67a391982baaa5f4698ec1c719c0c89142e136b1c0f17aa1ea19e7c4963655823bec
- TLSH T1BCF02377AD07238E447606C8215E69290C3D1E121A02464D5E107EF881A6981E7149D5
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\Music\RCX2294.tmp
- Size 562KB
- SHA256 0c46961dae6a81edf4003d6067f7468712fc154b702615468c74af6eaa55b018
- MD5 94ea567ac2f8e7dde2253b809b21c83a
- SHA1 a27fe3d6d2193746bdc0a72e250e53de19ef851e
- SHA512 963e96feb1d212e6df5c808fb87e2f6efe6d9704a306a019db4f21dd5cc5e2c319227760bcb4ae76577818253db08bcd9f471370bdb8c2b0508201d2ff63da2b
- SSDEEP 3072:OGC43DksD+XZVp3A30000000000000000000000000000000000000000000000R:OGC43NaVZA0rrrbrrrrr7I
- TLSH T1F5C419D5B68253A3DB410531E01F0FB8226E6DD7804EA815A3E3BB534B761099DED2BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\Music\angle.eXe
- Size 562KB
- SHA256 fbb46ffba3df79b5c40a46f3c2d31338c1a56183116629c218a770a68e49afec
- MD5 c906eae667a12dd683c8d78e910d4421
- SHA1 7860eaed7db1e31db42fa06f3ecfb440284f67df
- SHA512 8e04b57af1ed79ec6dabae2c842be892eda5558bbad6d50f618d03e30a6b1f662de8d09aa384ac25b279152bd17bb47ee7d4b4dc7723793c73f5706f64aee3ca
- SSDEEP 3072:uGC43DksD+XZVpu000000000000000000000000000000000000000000000000t:uGC43NaVRrrrbrrrrr7Q
- TLSH T15EC419D5B68253A3DB410531E01F0FB8226E6DD7804EA815A3E3BB534B761099DED2BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\Pictures\iexplore.eXe
- Size 326KB
- SHA256 e43ab1e4bb702d3ac3f288c7a58e0457564bed0be40d245e90cd72a13957c795
- MD5 39b20725fdfbae2a20aeadb0109f47f2
- SHA1 d03705a369daa7a3c3ecd653f1bb95d0659c7592
- SHA512 051857dc639563bde9e0ede1b376786e58d0789d278d729c74b847cbcace08a8dbf4bccc746378c301b9e03cdac4f9a66c6b4774c760fbeb8fc018782bc1ba7e
- SSDEEP 768:p1GGjmJZkcEkdsH1r9Ov7UsrIMvcHvdSdG74QP+EYHDlZVpYOeK3oRiw5nO4rGQL:LGGjuPg3YP4cdsD+ECZVpHQVgd54v4E
- TLSH T162640911A3A75699EC2866321403073BEBF61C26605F673260B1FF1E7D751686F2B33A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\Pictures\svchost.eXe
- Size 763KB
- SHA256 b9a318de700270cfb31160643b5ca49db9941e5b73a497b34fbf73a423bdeefb
- MD5 708a25daaa74e2999c9b0f09dbe9b0f9
- SHA1 feeb535264b0b7f970920c368a8601e5ea6e13cb
- SHA512 17cb7eb5e556b57072f0d268887c402a63ebf91f03061da6b9127adbea1b36507b9c780f55d16f5595eaf207cd29c43a2ce7eb60c113c1d2a963a2a049cf6b8e
- SSDEEP 6144:/GC43NaVLBhhhhhhhhhhhhhhhhhhhhhhhhhhhorrrbrrrrr7f:/AV
- TLSH T10EF47CC0F95296D2EB020831C42F1F7936EAAD521A5928056527BF172F73186EDED23F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\Pictures\wmplayer.eXe
- Size 772KB
- SHA256 f44ccd726389512d64621b9472f30374bc6b83d7c36b2b30cb2e9d9a4114233a
- MD5 414637098cf469414321e4b86b1b1d8a
- SHA1 362379c5c904dc8407aae8b91b526eea96923414
- SHA512 1152cd80a65affb26bc328ede0154e200e43b39b31fcf18539cd0afaaea3b2b4d629d393e086ea606dddb9665afe17a3dcf50d26a2b0505acf632008eb878bfd
- SSDEEP 6144:XGC43NaVNhhhhhhhhhhhhhhhhhhhhhhhhhhhhorrrbrrrrr7w:XAk
- TLSH T1AAF47CC0F95296D2EB020831C42F1F7D76EAAD521A5928056527BF172F73186ECAD23F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\RCX2245.tmp
- Size 753KB
- SHA256 5f6769c7b45c8274d2bacb89938018726d77534dad7000a94444598c2b215a46
- MD5 92454281435510cb76bb439d71087648
- SHA1 761b062ce01ba38f88e2bcb70e5af84da1dea772
- SHA512 34da8e9c36440c31d7f45ec39036976e9c3191f0e2e152e9720e64fefd000425f27cf7c11cead32a30b9723def701b2bd315d35cf9b7052484471ebfe2ec0efc
- SSDEEP 6144:PGC43NaVNhhhhhhhhhhhhhhhhhhhhhhhhhhhorrrbrrrrr7s:PAi
- TLSH T158F47CC1F94296D2EB020831C42F1F7926EBAD521A5928056527BF172F73186EDED23F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\ziprar.eXe
- Size 646KB
- SHA256 d82dc06867e97c7707dc631935670105a04482a7f92ea5672e207e5c1fbb148e
- MD5 a73bf688aa7c977d9e5e764e862c5f2d
- SHA1 b18626b8645e2ce03925027d287f02b80a26a0ba
- SHA512 24d9befabaa8ea1090fa7ee42c9f1d934b1d7a41c826a5e2c0a0d5c3612b97ff228d15b2d2152f263440505873d6ec4acfdfd55f0a0a9fa672f87bb33d0ce571
- SSDEEP 3072:dGC43DksD+XZVp2hhhhO0000000000000000000l00000000000000000000000m:dGC43NaVghhhhorrrbrrrrr7w
- TLSH T154E44BC1F18252E3EF180832901F5F75179A7D63564A590672A7FB231A731C8AE9E23F
- MD5 SHA1 SHA512 SSDEEP TLSH