Analysis
-
max time kernel
603s -
max time network
600s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
20/12/2021, 14:41
Static task
static1
Behavioral task
behavioral1
Sample
WannaBitcoin.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
WannaBitcoin.exe
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
WannaBitcoin.exe
-
Size
12.3MB
-
MD5
114edffe6d90393ac464866ddf138f90
-
SHA1
97ebbf910fd31a626126311453f8ee87171eb92d
-
SHA256
8cdd2fe5990836816361ce46cce780a56b70456ae2b4c6595fcb6cc2601c754a
-
SHA512
1197d4e60bfc67d2b2cb13b424394bb8e6d5086514fc9c8965171a5b544b714405dd861bac058cac9c532e6d18b23344c41111dbb9db353a822910cfb40b155c
Score
8/10
Malware Config
Signatures
-
Modifies extensions of user files 3 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File created C:\Users\Admin\Pictures\FindConvertTo.crw.wannabitcoin WannaBitcoin.exe File created C:\Users\Admin\Pictures\JoinConvertFrom.crw.wannabitcoin WannaBitcoin.exe File created C:\Users\Admin\Pictures\UnpublishConvert.tif.wannabitcoin WannaBitcoin.exe -
Drops desktop.ini file(s) 7 IoCs
description ioc Process File opened for modification C:\Users\Admin\Downloads\desktop.ini WannaBitcoin.exe File opened for modification C:\Users\Admin\Videos\desktop.ini WannaBitcoin.exe File opened for modification C:\Users\Admin\Music\desktop.ini WannaBitcoin.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini WannaBitcoin.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini WannaBitcoin.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini WannaBitcoin.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini WannaBitcoin.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\wallpaper.bmp" WannaBitcoin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2360 WannaBitcoin.exe 2360 WannaBitcoin.exe 2360 WannaBitcoin.exe 2360 WannaBitcoin.exe 2360 WannaBitcoin.exe 2360 WannaBitcoin.exe 2360 WannaBitcoin.exe 2360 WannaBitcoin.exe 2360 WannaBitcoin.exe 2360 WannaBitcoin.exe 2360 WannaBitcoin.exe 2360 WannaBitcoin.exe 2360 WannaBitcoin.exe 2360 WannaBitcoin.exe 2360 WannaBitcoin.exe 2360 WannaBitcoin.exe 2360 WannaBitcoin.exe 2360 WannaBitcoin.exe 2360 WannaBitcoin.exe 2360 WannaBitcoin.exe 2360 WannaBitcoin.exe 2360 WannaBitcoin.exe 2360 WannaBitcoin.exe 2360 WannaBitcoin.exe 2360 WannaBitcoin.exe 2360 WannaBitcoin.exe 2360 WannaBitcoin.exe 2360 WannaBitcoin.exe 2360 WannaBitcoin.exe 2360 WannaBitcoin.exe 2360 WannaBitcoin.exe 2360 WannaBitcoin.exe 2360 WannaBitcoin.exe 2360 WannaBitcoin.exe 2360 WannaBitcoin.exe 2360 WannaBitcoin.exe 2360 WannaBitcoin.exe 2360 WannaBitcoin.exe 2360 WannaBitcoin.exe 2360 WannaBitcoin.exe 2360 WannaBitcoin.exe 2360 WannaBitcoin.exe 2360 WannaBitcoin.exe 2360 WannaBitcoin.exe 2360 WannaBitcoin.exe 2360 WannaBitcoin.exe 2360 WannaBitcoin.exe 2360 WannaBitcoin.exe 2360 WannaBitcoin.exe 2360 WannaBitcoin.exe 2360 WannaBitcoin.exe 2360 WannaBitcoin.exe 2360 WannaBitcoin.exe 2360 WannaBitcoin.exe 2360 WannaBitcoin.exe 2360 WannaBitcoin.exe 2360 WannaBitcoin.exe 2360 WannaBitcoin.exe 2360 WannaBitcoin.exe 2360 WannaBitcoin.exe 2360 WannaBitcoin.exe 2360 WannaBitcoin.exe 2360 WannaBitcoin.exe 2360 WannaBitcoin.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2360 WannaBitcoin.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2360 WannaBitcoin.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2360 WannaBitcoin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\WannaBitcoin.exe"C:\Users\Admin\AppData\Local\Temp\WannaBitcoin.exe"1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2360