Overview

overview

10

task1

 

10

task2

 

10

task3

 

10

task4

 

10

Analysis

  • max time kernel
    52s
  • max time network
    11651379494s
  • resource
    win10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    TwoLayer.zip

  • Sample

    190926-jyftrj55ss

  • SHA256

    aa892cf3eb80b918469a8689eabb240b2ad50784e74885d9e277640e252bbbae

Score
N/A

Malware Config

Signatures

  • Views/modifies file attributes 1 TTPs
    evasion
  • Suspicious use of WriteProcessMemory 13 IoCs
  • Modifies file permissions 1 TTPs
  • Executes dropped EXE
  • Wannacry file encrypt 493 IoCs
  • Drops Office document 12 IoCs
    dropperexploitermaldoc
  • Drops startup file 6 IoCs
  • Sets desktop wallpaper registry value 2 TTPs 1 IoCs
    ransomware
  • Suspicious use of SetWindowsHookEx
  • Loads dropped DLL
  • Suspicious behavior: EnumeratesProcesses
  • Known Tor node 4 IoCs
  • Interacts with shadow copies 2 TTPs
    ransomware
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Modifies service 2 TTPs 4 IoCs
    persistence
  • Deletes shadow copies 2 TTPs
    ransomware
  • wannacry family
    family

Processes

  • C:\Users\Admin\AppData\Local\Temp\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
    "C:\Users\Admin\AppData\Local\Temp\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    • Wannacry file encrypt
    • Drops Office document
    • Drops startup file
    • Sets desktop wallpaper registry value
    PID:3552
  • C:\Windows\SysWOW64\attrib.exe
    attrib +h .
    1⤵
      PID:3568
    • C:\Windows\SysWOW64\icacls.exe
      icacls . /grant Everyone:F /T /C /Q
      1⤵
        PID:3576
      • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
        taskdl.exe
        1⤵
          PID:3140
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c 81091569506326.bat
          1⤵
          • Suspicious use of WriteProcessMemory
          PID:2388
        • C:\Windows\SysWOW64\cscript.exe
          cscript.exe //nologo m.vbs
          1⤵
            PID:3488
          • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
            taskdl.exe
            1⤵
              PID:3320
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /c start /b @[email protected] vs
              1⤵
              • Suspicious use of WriteProcessMemory
              PID:3036
            • C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\taskhsvc.exe
              TaskData\Tor\taskhsvc.exe
              1⤵
                PID:2008
              • C:\Windows\SysWOW64\cmd.exe
                cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
                1⤵
                • Suspicious use of WriteProcessMemory
                PID:3580
              • C:\Windows\SysWOW64\vssadmin.exe
                vssadmin delete shadows /all /quiet
                1⤵
                  PID:2356
                • C:\Windows\system32\vssvc.exe
                  C:\Windows\system32\vssvc.exe
                  1⤵
                  • Suspicious use of AdjustPrivilegeToken
                  • Modifies service
                  PID:3740
                • C:\Windows\SysWOW64\Wbem\WMIC.exe
                  wmic shadowcopy delete
                  1⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3856

                Network

                MITRE ATT&CK Enterprise v15

                MITRE ATT&CK Additional techniques

                • T1158
                • T1107
                • T1031

                Replay Monitor

                Loading Replay Monitor...

                Downloads