Analysis
-
max time kernel
146s -
max time network
151s -
resource
win10v191014
Task
task1
Sample
wannacry.exe
Resource
win7v191014
0 signatures
Task
task2
Sample
wannacry.exe
Resource
win10v191014
0 signatures
General
-
Target
wannacry.exe
-
Sample
191030-35tdg7dqen
-
SHA256
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
Score
N/A
Malware Config
Extracted
Path
C:\Users\Admin\AppData\Local\Temp\@[email protected]
Family
wannacry
Ransom Note
Q: What's wrong with my files?
A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted.
If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!
Let's start decrypting!
Q: What do I do?
A: First, you need to pay service fees for the decryption.
Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn
Next, please find an application file named "@[email protected]". It is the decrypt software.
Run and follow the instructions! (You may need to disable your antivirus for a while.)
Q: How can I trust?
A: Don't worry about decryption.
We will decrypt your files surely because nobody will trust us if we cheat users.
* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window.
�
Wallets
115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn
Signatures
-
Checks system information in the registry (likely anti-VM) 2 TTPs 2 IoCs
description ioc pid Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer 5004 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName 5004 svchost.exe -
Modifies file permissions 1 TTPs 1 IoCs
pid Process 4960 icacls.exe -
Wannacry file encrypt 64 IoCs
description ioc pid Process File renamed C:\Users\Admin\Desktop\WaitRevoke.txt.WNCRYT => C:\Users\Admin\Desktop\WaitRevoke.txt.WNCRY 4932 wannacry.exe File opened for modification C:\Users\Admin\Desktop\WaitRevoke.txt.WNCRY 4932 wannacry.exe File renamed C:\Users\Admin\Desktop\WritePop.pptx.WNCRYT => C:\Users\Admin\Desktop\WritePop.pptx.WNCRY 4932 wannacry.exe File opened for modification C:\Users\Admin\Desktop\WritePop.pptx.WNCRY 4932 wannacry.exe File renamed C:\Users\Admin\Desktop\CloseAdd.3gp.WNCRYT => C:\Users\Admin\Desktop\CloseAdd.3gp.WNCRY 4932 wannacry.exe File opened for modification C:\Users\Admin\Desktop\CloseAdd.3gp.WNCRY 4932 wannacry.exe File renamed C:\Users\Admin\Desktop\DismountHide.php.WNCRYT => C:\Users\Admin\Desktop\DismountHide.php.WNCRY 4932 wannacry.exe File opened for modification C:\Users\Admin\Desktop\DismountHide.php.WNCRY 4932 wannacry.exe File renamed C:\Users\Admin\Desktop\JoinPush.wmv.WNCRYT => C:\Users\Admin\Desktop\JoinPush.wmv.WNCRY 4932 wannacry.exe File opened for modification C:\Users\Admin\Desktop\JoinPush.wmv.WNCRY 4932 wannacry.exe File renamed C:\Users\Admin\Desktop\OpenSplit.xltx.WNCRYT => C:\Users\Admin\Desktop\OpenSplit.xltx.WNCRY 4932 wannacry.exe File opened for modification C:\Users\Admin\Desktop\OpenSplit.xltx.WNCRY 4932 wannacry.exe File renamed C:\Users\Admin\Desktop\SkipUnlock.xltx.WNCRYT => C:\Users\Admin\Desktop\SkipUnlock.xltx.WNCRY 4932 wannacry.exe File opened for modification C:\Users\Admin\Desktop\SkipUnlock.xltx.WNCRY 4932 wannacry.exe File renamed C:\Users\Admin\Desktop\StartLock.zip.WNCRYT => C:\Users\Admin\Desktop\StartLock.zip.WNCRY 4932 wannacry.exe File opened for modification C:\Users\Admin\Desktop\StartLock.zip.WNCRY 4932 wannacry.exe File renamed C:\Users\Admin\Desktop\StopBlock.bat.WNCRYT => C:\Users\Admin\Desktop\StopBlock.bat.WNCRY 4932 wannacry.exe File opened for modification C:\Users\Admin\Desktop\StopBlock.bat.WNCRY 4932 wannacry.exe File renamed C:\Users\Admin\Desktop\SuspendAssert.xlsm.WNCRYT => C:\Users\Admin\Desktop\SuspendAssert.xlsm.WNCRY 4932 wannacry.exe File opened for modification C:\Users\Admin\Desktop\SuspendAssert.xlsm.WNCRY 4932 wannacry.exe File renamed C:\Users\Admin\Documents\Are.docx.WNCRYT => C:\Users\Admin\Documents\Are.docx.WNCRY 4932 wannacry.exe File opened for modification C:\Users\Admin\Documents\Are.docx.WNCRY 4932 wannacry.exe File renamed C:\Users\Admin\Documents\Files.docx.WNCRYT => C:\Users\Admin\Documents\Files.docx.WNCRY 4932 wannacry.exe File opened for modification C:\Users\Admin\Documents\Files.docx.WNCRY 4932 wannacry.exe File renamed C:\Users\Admin\Documents\MergeStep.vsdx.WNCRYT => C:\Users\Admin\Documents\MergeStep.vsdx.WNCRY 4932 wannacry.exe File opened for modification C:\Users\Admin\Documents\MergeStep.vsdx.WNCRY 4932 wannacry.exe File renamed C:\Users\Admin\Documents\Opened.docx.WNCRYT => C:\Users\Admin\Documents\Opened.docx.WNCRY 4932 wannacry.exe File opened for modification C:\Users\Admin\Documents\Opened.docx.WNCRY 4932 wannacry.exe File renamed C:\Users\Admin\Documents\OptimizeGroup.txt.WNCRYT => C:\Users\Admin\Documents\OptimizeGroup.txt.WNCRY 4932 wannacry.exe File opened for modification C:\Users\Admin\Documents\OptimizeGroup.txt.WNCRY 4932 wannacry.exe File renamed C:\Users\Admin\Documents\Recently.docx.WNCRYT => C:\Users\Admin\Documents\Recently.docx.WNCRY 4932 wannacry.exe File opened for modification C:\Users\Admin\Documents\Recently.docx.WNCRY 4932 wannacry.exe File renamed C:\Users\Admin\Documents\SubmitDebug.ppt.WNCRYT => C:\Users\Admin\Documents\SubmitDebug.ppt.WNCRY 4932 wannacry.exe File opened for modification C:\Users\Admin\Documents\SubmitDebug.ppt.WNCRY 4932 wannacry.exe File renamed C:\Users\Admin\Documents\These.docx.WNCRYT => C:\Users\Admin\Documents\These.docx.WNCRY 4932 wannacry.exe File opened for modification C:\Users\Admin\Documents\These.docx.WNCRY 4932 wannacry.exe File renamed C:\Users\Admin\Documents\UnblockExport.csv.WNCRYT => C:\Users\Admin\Documents\UnblockExport.csv.WNCRY 4932 wannacry.exe File opened for modification C:\Users\Admin\Documents\UnblockExport.csv.WNCRY 4932 wannacry.exe File renamed C:\Users\Admin\Documents\WriteDismount.xlsx.WNCRYT => C:\Users\Admin\Documents\WriteDismount.xlsx.WNCRY 4932 wannacry.exe File opened for modification C:\Users\Admin\Documents\WriteDismount.xlsx.WNCRY 4932 wannacry.exe File renamed C:\Users\Admin\Documents\AddDismount.pptm.WNCRYT => C:\Users\Admin\Documents\AddDismount.pptm.WNCRY 4932 wannacry.exe File opened for modification C:\Users\Admin\Documents\AddDismount.pptm.WNCRY 4932 wannacry.exe File renamed C:\Users\Admin\Documents\ApproveMeasure.docm.WNCRYT => C:\Users\Admin\Documents\ApproveMeasure.docm.WNCRY 4932 wannacry.exe File opened for modification C:\Users\Admin\Documents\ApproveMeasure.docm.WNCRY 4932 wannacry.exe File renamed C:\Users\Admin\Documents\CloseLock.potx.WNCRYT => C:\Users\Admin\Documents\CloseLock.potx.WNCRY 4932 wannacry.exe File opened for modification C:\Users\Admin\Documents\CloseLock.potx.WNCRY 4932 wannacry.exe File renamed C:\Users\Admin\Documents\DisconnectCompare.xltm.WNCRYT => C:\Users\Admin\Documents\DisconnectCompare.xltm.WNCRY 4932 wannacry.exe File opened for modification C:\Users\Admin\Documents\DisconnectCompare.xltm.WNCRY 4932 wannacry.exe File renamed C:\Users\Admin\Documents\DismountUse.odp.WNCRYT => C:\Users\Admin\Documents\DismountUse.odp.WNCRY 4932 wannacry.exe File opened for modification C:\Users\Admin\Documents\DismountUse.odp.WNCRY 4932 wannacry.exe File renamed C:\Users\Admin\Documents\NewUnprotect.xltm.WNCRYT => C:\Users\Admin\Documents\NewUnprotect.xltm.WNCRY 4932 wannacry.exe File opened for modification C:\Users\Admin\Documents\NewUnprotect.xltm.WNCRY 4932 wannacry.exe File renamed C:\Users\Admin\Documents\OutConvert.docm.WNCRYT => C:\Users\Admin\Documents\OutConvert.docm.WNCRY 4932 wannacry.exe File opened for modification C:\Users\Admin\Documents\OutConvert.docm.WNCRY 4932 wannacry.exe File renamed C:\Users\Admin\Documents\ReceiveEnable.pot.WNCRYT => C:\Users\Admin\Documents\ReceiveEnable.pot.WNCRY 4932 wannacry.exe File opened for modification C:\Users\Admin\Documents\ReceiveEnable.pot.WNCRY 4932 wannacry.exe File renamed C:\Users\Admin\Documents\UnregisterRead.ods.WNCRYT => C:\Users\Admin\Documents\UnregisterRead.ods.WNCRY 4932 wannacry.exe File opened for modification C:\Users\Admin\Documents\UnregisterRead.ods.WNCRY 4932 wannacry.exe File renamed C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\brndlog.txt.WNCRYT => C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\brndlog.txt.WNCRY 4932 wannacry.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\brndlog.txt.WNCRY 4932 wannacry.exe File renamed C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{3fd336ea-c68e-47df-b2bf-24527681fe24}\0.0.filtertrie.intermediate.txt.WNCRYT => C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{3fd336ea-c68e-47df-b2bf-24527681fe24}\0.0.filtertrie.intermediate.txt.WNCRY 4932 wannacry.exe File opened for modification C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{3fd336ea-c68e-47df-b2bf-24527681fe24}\0.0.filtertrie.intermediate.txt.WNCRY 4932 wannacry.exe File renamed C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{4c7824f5-2f93-430b-a953-417ce8bc1d70}\0.0.filtertrie.intermediate.txt.WNCRYT => C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{4c7824f5-2f93-430b-a953-417ce8bc1d70}\0.0.filtertrie.intermediate.txt.WNCRY 4932 wannacry.exe File opened for modification C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{4c7824f5-2f93-430b-a953-417ce8bc1d70}\0.0.filtertrie.intermediate.txt.WNCRY 4932 wannacry.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc pid Process Set value (str) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]" 4932 wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]" 1072 @[email protected] -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 3172 @[email protected] 4244 @[email protected] 1072 @[email protected] 4816 @[email protected] 3940 @[email protected] -
Deletes shadow copies 2 TTPs 2 IoCs
pid Process 4728 vssadmin.exe 4344 WMIC.exe -
Uses Volume Shadow Copy Service COM API 13 IoCs
description ioc pid Process Key opened \Registry\Machine\Software\Classes\CLSID\{E579AB5F-1CC4-44B4-BED9-DE0991FF0623} 4728 vssadmin.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E579AB5F-1CC4-44b4-BED9-DE0991FF0623} 4728 vssadmin.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E579AB5F-1CC4-44b4-BED9-DE0991FF0623}\TreatAs 4728 vssadmin.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E579AB5F-1CC4-44b4-BED9-DE0991FF0623}\ 4728 vssadmin.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E579AB5F-1CC4-44b4-BED9-DE0991FF0623}\InprocHandler32 4728 vssadmin.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E579AB5F-1CC4-44b4-BED9-DE0991FF0623}\InprocHandler 4728 vssadmin.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E579AB5F-1CC4-44B4-BED9-DE0991FF0623} 3708 vssvc.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E579AB5F-1CC4-44b4-BED9-DE0991FF0623} 3708 vssvc.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E579AB5F-1CC4-44b4-BED9-DE0991FF0623}\TreatAs 3708 vssvc.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E579AB5F-1CC4-44b4-BED9-DE0991FF0623}\ 3708 vssvc.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E579AB5F-1CC4-44b4-BED9-DE0991FF0623}\InprocServer32 3708 vssvc.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E579AB5F-1CC4-44b4-BED9-DE0991FF0623}\InprocHandler32 3708 vssvc.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E579AB5F-1CC4-44b4-BED9-DE0991FF0623}\InprocHandler 3708 vssvc.exe -
Suspicious use of AdjustPrivilegeToken 27 IoCs
description pid Process Token: SeBackupPrivilege 3708 vssvc.exe Token: SeRestorePrivilege 3708 vssvc.exe Token: SeAuditPrivilege 3708 vssvc.exe Token: SeIncreaseQuotaPrivilege 4344 WMIC.exe Token: SeSecurityPrivilege 4344 WMIC.exe Token: SeTakeOwnershipPrivilege 4344 WMIC.exe Token: SeLoadDriverPrivilege 4344 WMIC.exe Token: SeSystemProfilePrivilege 4344 WMIC.exe Token: SeSystemtimePrivilege 4344 WMIC.exe Token: SeProfSingleProcessPrivilege 4344 WMIC.exe Token: SeIncBasePriorityPrivilege 4344 WMIC.exe Token: SeCreatePagefilePrivilege 4344 WMIC.exe Token: SeBackupPrivilege 4344 WMIC.exe Token: SeRestorePrivilege 4344 WMIC.exe Token: SeShutdownPrivilege 4344 WMIC.exe Token: SeDebugPrivilege 4344 WMIC.exe Token: SeSystemEnvironmentPrivilege 4344 WMIC.exe Token: SeRemoteShutdownPrivilege 4344 WMIC.exe Token: SeUndockPrivilege 4344 WMIC.exe Token: SeManageVolumePrivilege 4344 WMIC.exe Token: 33 4344 WMIC.exe Token: 34 4344 WMIC.exe Token: 35 4344 WMIC.exe Token: 36 4344 WMIC.exe Token: SeTcbPrivilege 892 taskse.exe Token: SeTcbPrivilege 2548 taskse.exe Token: SeTcbPrivilege 4968 taskse.exe -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 4952 attrib.exe -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 4932 wrote to memory of 4952 4932 wannacry.exe 72 PID 4932 wrote to memory of 4960 4932 wannacry.exe 73 PID 4932 wrote to memory of 992 4932 wannacry.exe 78 PID 4932 wrote to memory of 4032 4932 wannacry.exe 79 PID 4032 wrote to memory of 3652 4032 cmd.exe 81 PID 4932 wrote to memory of 4744 4932 wannacry.exe 85 PID 4932 wrote to memory of 4244 4932 wannacry.exe 86 PID 4932 wrote to memory of 4212 4932 wannacry.exe 87 PID 4212 wrote to memory of 3172 4212 cmd.exe 89 PID 4244 wrote to memory of 4840 4244 @[email protected] 91 PID 4584 wrote to memory of 5000 4584 SppExtComObj.exe 94 PID 3172 wrote to memory of 4712 3172 @[email protected] 96 PID 4712 wrote to memory of 4728 4712 cmd.exe 98 PID 4712 wrote to memory of 4344 4712 cmd.exe 100 PID 4932 wrote to memory of 892 4932 wannacry.exe 103 PID 4932 wrote to memory of 1072 4932 wannacry.exe 104 PID 4932 wrote to memory of 1120 4932 wannacry.exe 105 PID 1120 wrote to memory of 1396 1120 cmd.exe 107 PID 4932 wrote to memory of 1412 4932 wannacry.exe 108 PID 4932 wrote to memory of 2548 4932 wannacry.exe 112 PID 4932 wrote to memory of 4816 4932 wannacry.exe 113 PID 4932 wrote to memory of 4536 4932 wannacry.exe 114 PID 4932 wrote to memory of 4968 4932 wannacry.exe 120 PID 4932 wrote to memory of 3940 4932 wannacry.exe 121 PID 4932 wrote to memory of 3524 4932 wannacry.exe 122 -
Executes dropped EXE 14 IoCs
pid Process 992 taskdl.exe 4744 taskdl.exe 4244 @[email protected] 3172 @[email protected] 4840 taskhsvc.exe 892 taskse.exe 1072 @[email protected] 1412 taskdl.exe 2548 taskse.exe 4816 @[email protected] 4536 taskdl.exe 4968 taskse.exe 3940 @[email protected] 3524 taskdl.exe -
Drops startup file 6 IoCs
description ioc pid Process File created (read-only) C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SDCA67.tmp 4932 wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SDCA67.tmp 4932 wannacry.exe File deleted C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SDCA67.tmp 4932 wannacry.exe File created (read-only) C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SDCA8D.tmp 4932 wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SDCA8D.tmp 4932 wannacry.exe File deleted C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SDCA8D.tmp 4932 wannacry.exe -
Drops file in system dir 5 IoCs
description ioc pid Process File opened for modification C:\Windows\Debug\ESE.TXT 2236 svchost.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp 2236 svchost.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp 2236 svchost.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-2.tmp 2236 svchost.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-2.tmp 2236 svchost.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 4840 taskhsvc.exe -
Modifies registry key 1 TTPs 1 IoCs
pid Process 1396 reg.exe -
description ioc pid Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\cval = "0" 1604 svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\cval = "1" 1604 svchost.exe -
description ioc pid Process File opened for modification C:\Users\Admin\Desktop\WritePop.pptx 4932 wannacry.exe File opened for modification C:\Users\Admin\Desktop\OpenSplit.xltx 4932 wannacry.exe File opened for modification C:\Users\Admin\Desktop\SkipUnlock.xltx 4932 wannacry.exe File opened for modification C:\Users\Admin\Desktop\SuspendAssert.xlsm 4932 wannacry.exe File opened for modification C:\Users\Admin\Documents\Are.docx 4932 wannacry.exe File opened for modification C:\Users\Admin\Documents\Files.docx 4932 wannacry.exe File opened for modification C:\Users\Admin\Documents\Opened.docx 4932 wannacry.exe File opened for modification C:\Users\Admin\Documents\Recently.docx 4932 wannacry.exe File opened for modification C:\Users\Admin\Documents\SubmitDebug.ppt 4932 wannacry.exe File opened for modification C:\Users\Admin\Documents\These.docx 4932 wannacry.exe File opened for modification C:\Users\Admin\Documents\WriteDismount.xlsx 4932 wannacry.exe File opened for modification C:\Users\Admin\Documents\AddDismount.pptm 4932 wannacry.exe File opened for modification C:\Users\Admin\Documents\ApproveMeasure.docm 4932 wannacry.exe File opened for modification C:\Users\Admin\Documents\CloseLock.potx 4932 wannacry.exe File opened for modification C:\Users\Admin\Documents\DisconnectCompare.xltm 4932 wannacry.exe File opened for modification C:\Users\Admin\Documents\NewUnprotect.xltm 4932 wannacry.exe File opened for modification C:\Users\Admin\Documents\OutConvert.docm 4932 wannacry.exe File opened for modification C:\Users\Admin\Documents\ReceiveEnable.pot 4932 wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\ExpandPing.doc 4932 wannacry.exe File opened for modification C:\Users\Admin\Downloads\SwitchLock.docx 4932 wannacry.exe File opened for modification C:\Users\Admin\Downloads\TraceUninstall.xls 4932 wannacry.exe File opened for modification C:\Users\Admin\Music\UninstallGet.docx 4932 wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\CompleteInvoke.ppsm 4932 wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\OpenTest.dotm 4932 wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\StopPop.xltm 4932 wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Document Building Blocks\1033\16\Built-In Building Blocks.dotx 4932 wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm 4932 wannacry.exe File opened for modification C:\Users\Admin\Downloads\TraceWatch.xlsb 4932 wannacry.exe File opened for modification C:\Users\Admin\Music\RestartPublish.docm 4932 wannacry.exe -
Loads dropped DLL 1 IoCs
pid Process 4840 taskhsvc.exe -
Adds Run entry to start application 2 TTPs 1 IoCs
description ioc pid Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\nmsqcsinudawe237 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\tasksche.exe\"" 1396 reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\wannacry.exe"C:\Users\Admin\AppData\Local\Temp\wannacry.exe"1⤵
- Wannacry file encrypt
- Sets desktop wallpaper using registry
- Suspicious use of WriteProcessMemory
- Drops startup file
- Drops Office document
PID:4932
-
C:\Windows\SysWOW64\attrib.exeattrib +h .1⤵
- Views/modifies file attributes
PID:4952
-
C:\Windows\SysWOW64\icacls.exeicacls . /grant Everyone:F /T /C /Q1⤵
- Modifies file permissions
PID:4960
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe1⤵
- Executes dropped EXE
PID:992
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 129661572464202.bat1⤵
- Suspicious use of WriteProcessMemory
PID:4032
-
C:\Windows\SysWOW64\cscript.execscript.exe //nologo m.vbs1⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe1⤵
- Executes dropped EXE
PID:4744
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:4244
-
C:\Windows\SysWOW64\cmd.exePID:4212
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:3172
-
C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\taskhsvc.exeTaskData\Tor\taskhsvc.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Loads dropped DLL
PID:4840
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵
- Suspicious use of WriteProcessMemory
PID:4584
-
C:\Windows\System32\SLUI.exe"C:\Windows\System32\SLUI.exe" RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2de67392-b7a7-462a-b1ca-108dd189f588;NotificationInterval=1440;Trigger=TimerEvent1⤵PID:5000
-
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet1⤵
- Suspicious use of WriteProcessMemory
PID:4712
-
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet1⤵
- Deletes shadow copies
- Uses Volume Shadow Copy Service COM API
PID:4728
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Uses Volume Shadow Copy Service COM API
- Suspicious use of AdjustPrivilegeToken
PID:3708
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete1⤵
- Deletes shadow copies
- Suspicious use of AdjustPrivilegeToken
PID:4344
-
C:\Users\Admin\AppData\Local\Temp\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]1⤵
- Suspicious use of AdjustPrivilegeToken
- Executes dropped EXE
PID:892
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]1⤵
- Sets desktop wallpaper using registry
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
PID:1072
-
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "nmsqcsinudawe237" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\tasksche.exe\"" /f1⤵
- Suspicious use of WriteProcessMemory
PID:1120
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "nmsqcsinudawe237" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\tasksche.exe\"" /f1⤵
- Modifies registry key
- Adds Run entry to start application
PID:1396
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe1⤵
- Executes dropped EXE
PID:1412
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
- Drops file in system dir
PID:2236
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV1⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]1⤵
- Suspicious use of AdjustPrivilegeToken
- Executes dropped EXE
PID:2548
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:4816
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe1⤵
- Executes dropped EXE
PID:4536
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s DoSvc1⤵
- Checks system information in the registry (likely anti-VM)
PID:5004
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup1⤵PID:4904
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservicenetworkrestricted -s wscsvc1⤵
- Windows security modification
PID:1604
-
C:\Users\Admin\AppData\Local\Temp\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]1⤵
- Suspicious use of AdjustPrivilegeToken
- Executes dropped EXE
PID:4968
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:3940
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe1⤵
- Executes dropped EXE
PID:3524
Network
MITRE ATT&CK Enterprise v15
MITRE ATT&CK Additional techniques
- T1107
- T1158
- T1089
- T1060