Overview

overview

10

task1

 

10

task2

 

10

Analysis

  • max time kernel
    58s
  • resource
    win7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    wanacryptor.exe

  • Sample

    190914-r8yvytde4n

  • SHA256

    ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa

Score
N/A

Malware Config

Signatures

  • Views/modifies file attributes 1 TTPs
    evasion
  • Suspicious use of WriteProcessMemory 17 IoCs
  • Modifies file permissions 1 TTPs
  • Loads dropped DLL
  • Executes dropped EXE
  • Wannacry file encrypt 396 IoCs
  • Drops startup file 4 IoCs
  • Sets desktop wallpaper registry value 2 TTPs 2 IoCs
    ransomware
  • Suspicious use of SetWindowsHookEx
  • Suspicious behavior: EnumeratesProcesses
  • Modifies registry key 1 TTPs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Adds Run entry to start application 2 TTPs 2 IoCs
    persistence
  • Known Tor node 6 IoCs
  • Interacts with shadow copies 2 TTPs
    ransomware
  • Modifies service 2 TTPs 4 IoCs
    persistence
  • Deletes shadow copies 2 TTPs
    ransomware
  • wannacry family
    family

Processes

  • C:\Users\Admin\AppData\Local\Temp\wanacryptor.exe
    C:\Users\Admin\AppData\Local\Temp\wanacryptor.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    • Wannacry file encrypt
    • Drops startup file
    • Sets desktop wallpaper registry value
    PID:1396
  • C:\Windows\SysWOW64\attrib.exe
    attrib +h .
    1⤵
      PID:1340
    • C:\Windows\system32\conhost.exe
      \??\C:\Windows\system32\conhost.exe "178101617820419049321885077359-87789090-191727426984886390-6711845102105673393"
      1⤵
        PID:1380
      • C:\Windows\SysWOW64\icacls.exe
        icacls . /grant Everyone:F /T /C /Q
        1⤵
          PID:844
        • C:\Windows\system32\conhost.exe
          \??\C:\Windows\system32\conhost.exe "68380638-134117025015965239272017080203-436434211-11862560892050406990-298502429"
          1⤵
            PID:1184
          • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
            taskdl.exe
            1⤵
              PID:2036
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c 139481568464772.bat
              1⤵
              • Suspicious use of WriteProcessMemory
              PID:2024
            • C:\Windows\system32\conhost.exe
              \??\C:\Windows\system32\conhost.exe "-1690689405-1506149047231406383-1911316898631372605275143358-242892880-1530755520"
              1⤵
                PID:1944
              • C:\Windows\SysWOW64\cscript.exe
                cscript.exe //nologo m.vbs
                1⤵
                  PID:1992
                • C:\Windows\SysWOW64\cmd.exe
                  cmd.exe /c start /b @[email protected] vs
                  1⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1852
                • C:\Windows\system32\conhost.exe
                  \??\C:\Windows\system32\conhost.exe "15804464931282432220-2256829231953425047327404231840102483-1247746587-1867096663"
                  1⤵
                    PID:1344
                  • C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\taskhsvc.exe
                    TaskData\Tor\taskhsvc.exe
                    1⤵
                      PID:1676
                    • C:\Windows\system32\conhost.exe
                      \??\C:\Windows\system32\conhost.exe "148124263116397275361090110393-4470268301547177365-543692993-569028428-1023424954"
                      1⤵
                        PID:1308
                      • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
                        taskdl.exe
                        1⤵
                          PID:1168
                        • C:\Users\Admin\AppData\Local\Temp\taskse.exe
                          taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
                          1⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1276
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "cyvxzzxok869" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\tasksche.exe\"" /f
                          1⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2020
                        • C:\Windows\system32\conhost.exe
                          \??\C:\Windows\system32\conhost.exe "1305222551-109869974663209089623338521831648504-755834288-581640509-679532229"
                          1⤵
                            PID:320
                          • C:\Windows\SysWOW64\reg.exe
                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "cyvxzzxok869" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\tasksche.exe\"" /f
                            1⤵
                            • Adds Run entry to start application
                            PID:1804
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
                            1⤵
                            • Suspicious use of WriteProcessMemory
                            PID:1220
                          • C:\Windows\system32\conhost.exe
                            \??\C:\Windows\system32\conhost.exe "-1686866176-1627706350-13825995481855397851892833719333043900-1974993625-1599686765"
                            1⤵
                              PID:1996
                            • C:\Windows\SysWOW64\vssadmin.exe
                              vssadmin delete shadows /all /quiet
                              1⤵
                                PID:2008
                              • C:\Windows\system32\vssvc.exe
                                C:\Windows\system32\vssvc.exe
                                1⤵
                                • Suspicious use of AdjustPrivilegeToken
                                • Modifies service
                                PID:852
                              • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                wmic shadowcopy delete
                                1⤵
                                • Suspicious use of AdjustPrivilegeToken
                                PID:944

                              Network

                              MITRE ATT&CK Enterprise v15

                              MITRE ATT&CK Additional techniques

                              • T1158
                              • T1060
                              • T1107
                              • T1031

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads