Overview

overview

10

task1

 

10

task2

 

10

Analysis

  • max time kernel
    59s
  • resource
    win10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    wanacryptor.exe

  • Sample

    190914-r8yvytde4n

  • SHA256

    ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa

Score
N/A

Malware Config

Signatures

  • Views/modifies file attributes 1 TTPs
    evasion
  • Suspicious use of WriteProcessMemory 13 IoCs
  • Modifies file permissions 1 TTPs
  • Executes dropped EXE
  • Wannacry file encrypt 437 IoCs
  • Drops startup file 4 IoCs
  • Sets desktop wallpaper registry value 2 TTPs 1 IoCs
    ransomware
  • Suspicious use of SetWindowsHookEx
  • Loads dropped DLL
  • Suspicious behavior: EnumeratesProcesses
  • Known Tor node 5 IoCs
  • Interacts with shadow copies 2 TTPs
    ransomware
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Modifies service 2 TTPs 4 IoCs
    persistence
  • Deletes shadow copies 2 TTPs
    ransomware
  • wannacry family
    family

Processes

  • C:\Users\Admin\AppData\Local\Temp\wanacryptor.exe
    C:\Users\Admin\AppData\Local\Temp\wanacryptor.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    • Wannacry file encrypt
    • Drops startup file
    • Sets desktop wallpaper registry value
    PID:3604
  • C:\Windows\SysWOW64\attrib.exe
    attrib +h .
    1⤵
      PID:3596
    • C:\Windows\SysWOW64\icacls.exe
      icacls . /grant Everyone:F /T /C /Q
      1⤵
        PID:3632
      • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
        taskdl.exe
        1⤵
          PID:2276
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c 174381568464767.bat
          1⤵
          • Suspicious use of WriteProcessMemory
          PID:2828
        • C:\Windows\SysWOW64\cscript.exe
          cscript.exe //nologo m.vbs
          1⤵
            PID:3488
          • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
            taskdl.exe
            1⤵
              PID:3104
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /c start /b @[email protected] vs
              1⤵
              • Suspicious use of WriteProcessMemory
              PID:3228
            • C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\taskhsvc.exe
              TaskData\Tor\taskhsvc.exe
              1⤵
                PID:2716
              • C:\Windows\SysWOW64\cmd.exe
                cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
                1⤵
                • Suspicious use of WriteProcessMemory
                PID:3632
              • C:\Windows\SysWOW64\vssadmin.exe
                vssadmin delete shadows /all /quiet
                1⤵
                  PID:3164
                • C:\Windows\system32\vssvc.exe
                  C:\Windows\system32\vssvc.exe
                  1⤵
                  • Suspicious use of AdjustPrivilegeToken
                  • Modifies service
                  PID:2280
                • C:\Windows\SysWOW64\Wbem\WMIC.exe
                  wmic shadowcopy delete
                  1⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3908

                Network

                MITRE ATT&CK Enterprise v15

                MITRE ATT&CK Additional techniques

                • T1158
                • T1107
                • T1031

                Replay Monitor

                Loading Replay Monitor...

                Downloads