Analysis
-
max time kernel
146s -
resource
win7v191014 -
submitted
30-12-2019 14:17
Task
task1
Sample
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
Resource
win7v191014
0 signatures
Task
task2
Sample
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
Resource
win10v191014
0 signatures
General
-
Target
test.zip
-
Sample
191230-y8z7sllm8a
-
SHA256
72b228f51cf5a1b7600f0e0848145e4e54e54838977a5a5b1c85f69b64b92cf5
Score
10/10
Malware Config
Extracted
Path
C:\Users\Admin\AppData\Local\Temp\@[email protected]
Family
wannacry
Ransom Note
Q: What's wrong with my files?
A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted.
If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!
Let's start decrypting!
Q: What do I do?
A: First, you need to pay service fees for the decryption.
Please send $300 worth of bitcoin to this bitcoin address: 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw
Next, please find an application file named "@[email protected]". It is the decrypt software.
Run and follow the instructions! (You may need to disable your antivirus for a while.)
Q: How can I trust?
A: Don't worry about decryption.
We will decrypt your files surely because nobody will trust us if we cheat users.
* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window.
�
Wallets
12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw
Signatures
-
Deletes shadow copies 2 TTPs 2 IoCs
pid Process 1136 WMIC.exe 1964 vssadmin.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 2024 wrote to memory of 2020 2024 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 27 PID 2024 wrote to memory of 1116 2024 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 29 PID 2024 wrote to memory of 1240 2024 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 31 PID 2024 wrote to memory of 1988 2024 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 32 PID 1988 wrote to memory of 1960 1988 cmd.exe 34 PID 2024 wrote to memory of 848 2024 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 36 PID 2024 wrote to memory of 1800 2024 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 37 PID 1800 wrote to memory of 900 1800 cmd.exe 39 PID 848 wrote to memory of 1488 848 @[email protected] 41 PID 900 wrote to memory of 488 900 @[email protected] 43 PID 488 wrote to memory of 1964 488 cmd.exe 45 PID 488 wrote to memory of 1136 488 cmd.exe 47 PID 2024 wrote to memory of 2020 2024 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 48 PID 2024 wrote to memory of 1988 2024 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 49 PID 2024 wrote to memory of 1976 2024 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 50 PID 2024 wrote to memory of 1796 2024 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 51 PID 1796 wrote to memory of 1312 1796 cmd.exe 53 PID 2024 wrote to memory of 1312 2024 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 55 PID 2024 wrote to memory of 1392 2024 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 56 PID 2024 wrote to memory of 1204 2024 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 57 PID 2024 wrote to memory of 1664 2024 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 59 PID 2024 wrote to memory of 1572 2024 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 60 PID 2024 wrote to memory of 1096 2024 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 61 PID 2024 wrote to memory of 1548 2024 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 64 PID 2024 wrote to memory of 280 2024 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 65 PID 2024 wrote to memory of 1796 2024 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 66 -
Executes dropped EXE 16 IoCs
pid Process 1240 taskdl.exe 848 @[email protected] 900 @[email protected] 1488 taskhsvc.exe 2020 taskdl.exe 1988 taskse.exe 1976 @[email protected] 1312 taskdl.exe 1392 taskse.exe 1204 @[email protected] 1664 taskdl.exe 1096 @[email protected] 1572 taskse.exe 1548 taskdl.exe 280 taskse.exe 1796 @[email protected] -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 848 @[email protected] 900 @[email protected] 1976 @[email protected] 1204 @[email protected] 1096 @[email protected] 1796 @[email protected] -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1976 @[email protected] -
Drops startup file 6 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD62D5.tmp ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe File deleted C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD62D5.tmp ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe File created (read-only) C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD6307.tmp ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD6307.tmp ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe File deleted C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD6307.tmp ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe File created (read-only) C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD62D5.tmp ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe -
Wannacry
WannaCry is a ransomware cryptoworm.
-
Loads dropped DLL 5 IoCs
pid Process 2024 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 1960 cscript.exe 1800 cmd.exe 848 @[email protected] 1488 taskhsvc.exe -
Adds Run entry to start application 2 TTPs 1 IoCs
description ioc Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ftqqepmlkbmm513 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\tasksche.exe\"" -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Set value (str) \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]" -
Modifies registry key 1 TTPs 1 IoCs
pid Process 1312 reg.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1488 taskhsvc.exe -
Suspicious use of AdjustPrivilegeToken 27 IoCs
description pid Process Token: SeBackupPrivilege 1800 vssvc.exe Token: SeRestorePrivilege 1800 vssvc.exe Token: SeAuditPrivilege 1800 vssvc.exe Token: SeIncreaseQuotaPrivilege 1136 WMIC.exe Token: SeSecurityPrivilege 1136 WMIC.exe Token: SeTakeOwnershipPrivilege 1136 WMIC.exe Token: SeLoadDriverPrivilege 1136 WMIC.exe Token: SeSystemProfilePrivilege 1136 WMIC.exe Token: SeSystemtimePrivilege 1136 WMIC.exe Token: SeProfSingleProcessPrivilege 1136 WMIC.exe Token: SeIncBasePriorityPrivilege 1136 WMIC.exe Token: SeCreatePagefilePrivilege 1136 WMIC.exe Token: SeBackupPrivilege 1136 WMIC.exe Token: SeRestorePrivilege 1136 WMIC.exe Token: SeShutdownPrivilege 1136 WMIC.exe Token: SeDebugPrivilege 1136 WMIC.exe Token: SeSystemEnvironmentPrivilege 1136 WMIC.exe Token: SeRemoteShutdownPrivilege 1136 WMIC.exe Token: SeUndockPrivilege 1136 WMIC.exe Token: SeManageVolumePrivilege 1136 WMIC.exe Token: 33 1136 WMIC.exe Token: 34 1136 WMIC.exe Token: 35 1136 WMIC.exe Token: SeTcbPrivilege 1988 taskse.exe Token: SeTcbPrivilege 1392 taskse.exe Token: SeTcbPrivilege 1572 taskse.exe Token: SeTcbPrivilege 280 taskse.exe -
Modifies file permissions 1 TTPs 1 IoCs
pid Process 1116 icacls.exe -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 2020 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"C:\Users\Admin\AppData\Local\Temp\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"1⤵
- Suspicious use of WriteProcessMemory
- Drops startup file
- Loads dropped DLL
PID:2024 -
C:\Windows\SysWOW64\attrib.exeattrib +h .2⤵
- Views/modifies file attributes
PID:2020
-
-
C:\Windows\SysWOW64\icacls.exeicacls . /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
PID:1116
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:1240
-
-
C:\Windows\SysWOW64\cmd.execmd /c 26121577719080.bat2⤵
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\SysWOW64\cscript.execscript.exe //nologo m.vbs3⤵
- Loads dropped DLL
PID:1960
-
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Loads dropped DLL
PID:848 -
C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\taskhsvc.exeTaskData\Tor\taskhsvc.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1488
-
-
-
C:\Windows\SysWOW64\cmd.exePID:1800
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]3⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:900 -
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet4⤵
- Suspicious use of WriteProcessMemory
PID:488 -
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet5⤵
- Deletes shadow copies
PID:1964
-
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete5⤵
- Deletes shadow copies
- Suspicious use of AdjustPrivilegeToken
PID:1136
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:2020
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1988
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: GetForegroundWindowSpam
PID:1976
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "ftqqepmlkbmm513" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\tasksche.exe\"" /f2⤵
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "ftqqepmlkbmm513" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\tasksche.exe\"" /f3⤵
- Modifies registry key
PID:1312
-
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:1312
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1392
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:1204
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:1664
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1572
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:1096
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:1548
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:280
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:1796
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1800