Overview

overview

10

task1

 

10

task2

 

10

task3

 

10

task4

 

10

Analysis

  • max time kernel
    61s
  • max time network
    11651379494s
  • resource
    win7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    TwoLayer.zip

  • Sample

    190926-jyftrj55ss

  • SHA256

    aa892cf3eb80b918469a8689eabb240b2ad50784e74885d9e277640e252bbbae

Score
N/A

Malware Config

Signatures

  • Views/modifies file attributes 1 TTPs
    evasion
  • Suspicious use of WriteProcessMemory 17 IoCs
  • Modifies file permissions 1 TTPs
  • Loads dropped DLL
  • Executes dropped EXE
  • Wannacry file encrypt 404 IoCs
  • Drops Office document 18 IoCs
    dropperexploitermaldoc
  • Drops startup file 6 IoCs
  • Sets desktop wallpaper registry value 2 TTPs 2 IoCs
    ransomware
  • Suspicious use of SetWindowsHookEx
  • Suspicious behavior: EnumeratesProcesses
  • Known Tor node 4 IoCs
  • Modifies registry key 1 TTPs
  • Adds Run entry to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Interacts with shadow copies 2 TTPs
    ransomware
  • Modifies service 2 TTPs 4 IoCs
    persistence
  • Deletes shadow copies 2 TTPs
    ransomware
  • wannacry family
    family

Processes

  • C:\Users\Admin\AppData\Local\Temp\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
    "C:\Users\Admin\AppData\Local\Temp\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    • Wannacry file encrypt
    • Drops Office document
    • Drops startup file
    • Sets desktop wallpaper registry value
    PID:1976
  • C:\Windows\SysWOW64\attrib.exe
    attrib +h .
    1⤵
      PID:1208
    • C:\Windows\system32\conhost.exe
      \??\C:\Windows\system32\conhost.exe "-1005262567-1287444096183175087443968989-615150670-107780038919523734-994501506"
      1⤵
        PID:848
      • C:\Windows\SysWOW64\icacls.exe
        icacls . /grant Everyone:F /T /C /Q
        1⤵
          PID:880
        • C:\Windows\system32\conhost.exe
          \??\C:\Windows\system32\conhost.exe "-483413442-13104847621034489013948345003-1369318337-18109533411678536547528133237"
          1⤵
            PID:1924
          • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
            taskdl.exe
            1⤵
              PID:772
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c 178731569506335.bat
              1⤵
              • Suspicious use of WriteProcessMemory
              PID:864
            • C:\Windows\system32\conhost.exe
              \??\C:\Windows\system32\conhost.exe "-426808712-18566710791273761319-871795283937277483-641827656-73153519-1362468543"
              1⤵
                PID:2044
              • C:\Windows\SysWOW64\cscript.exe
                cscript.exe //nologo m.vbs
                1⤵
                  PID:1280
                • C:\Windows\SysWOW64\cmd.exe
                  cmd.exe /c start /b @[email protected] vs
                  1⤵
                  • Suspicious use of WriteProcessMemory
                  PID:836
                • C:\Windows\system32\conhost.exe
                  \??\C:\Windows\system32\conhost.exe "-36881974-325030239197330569678350076021884686763741804-343312451-892284949"
                  1⤵
                    PID:2036
                  • C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\taskhsvc.exe
                    TaskData\Tor\taskhsvc.exe
                    1⤵
                      PID:1492
                    • C:\Windows\system32\conhost.exe
                      \??\C:\Windows\system32\conhost.exe "-1142426693-854492000320945150-193821621-123288699113838640351484008132-785066967"
                      1⤵
                        PID:1368
                      • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
                        taskdl.exe
                        1⤵
                          PID:900
                        • C:\Users\Admin\AppData\Local\Temp\taskse.exe
                          taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
                          1⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1876
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "vobbdjxs977" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\tasksche.exe\"" /f
                          1⤵
                          • Suspicious use of WriteProcessMemory
                          PID:836
                        • C:\Windows\system32\conhost.exe
                          \??\C:\Windows\system32\conhost.exe "-172383260-3202013632026295438678614099323359736-675705032537360034-635504174"
                          1⤵
                            PID:1816
                          • C:\Windows\SysWOW64\reg.exe
                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "vobbdjxs977" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\tasksche.exe\"" /f
                            1⤵
                            • Adds Run entry to start application
                            PID:1180
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
                            1⤵
                            • Suspicious use of WriteProcessMemory
                            PID:1324
                          • C:\Windows\system32\conhost.exe
                            \??\C:\Windows\system32\conhost.exe "-1314368239338884374-1480126229-2026551355348758018-1083251307-395748495110074215"
                            1⤵
                              PID:1280
                            • C:\Windows\SysWOW64\vssadmin.exe
                              vssadmin delete shadows /all /quiet
                              1⤵
                                PID:864
                              • C:\Windows\system32\vssvc.exe
                                C:\Windows\system32\vssvc.exe
                                1⤵
                                • Suspicious use of AdjustPrivilegeToken
                                • Modifies service
                                PID:1912
                              • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                wmic shadowcopy delete
                                1⤵
                                • Suspicious use of AdjustPrivilegeToken
                                PID:280

                              Network

                              MITRE ATT&CK Enterprise v15

                              MITRE ATT&CK Additional techniques

                              • T1158
                              • T1060
                              • T1107
                              • T1031

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads