Resubmissions
18-07-2022 04:40
220718-faqj6ahdd3 109-07-2022 10:37
220709-mn992sgcd4 1008-07-2022 15:34
220708-sz77qaadf8 1020-06-2022 11:39
220620-nsq8eacgfk 1013-06-2022 10:07
220613-l5wmjsbff6 1012-06-2022 12:47
220612-p1kw2acbbp 1012-06-2022 07:39
220612-jg55zagca5 1011-06-2022 20:25
220611-y7pcgabdf5 1011-06-2022 20:25
220611-y7fekabde7 1011-06-2022 20:24
220611-y642jafber 1Analysis
-
max time kernel
254s -
max time network
715s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
17-01-2022 11:17
Static task
static1
Behavioral task
behavioral1
Sample
WannaCry.EXE
Resource
win10-en-20211208
General
-
Target
WannaCry.EXE
-
Size
3.4MB
-
MD5
84c82835a5d21bbcf75a61706d8ab549
-
SHA1
5ff465afaabcbf0150d1a3ab2c2e74f3a4426467
-
SHA256
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
-
SHA512
90723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\@[email protected]
wannacry
12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 27 IoCs
pid Process 1344 taskdl.exe 3608 taskdl.exe 3204 @[email protected] 1880 @[email protected] 652 taskhsvc.exe 1540 taskse.exe 1064 @[email protected] 2052 taskdl.exe 3228 taskse.exe 3608 @[email protected] 2180 taskdl.exe 2704 dismhost.exe 3992 taskse.exe 1704 @[email protected] 2096 taskdl.exe 1784 taskse.exe 2332 @[email protected] 1320 taskdl.exe 3356 taskse.exe 3956 @[email protected] 744 taskdl.exe 1856 taskse.exe 2260 @[email protected] 2296 taskdl.exe 1616 taskse.exe 3720 @[email protected] 3852 taskdl.exe -
Modifies extensions of user files 6 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\BackupSuspend.png.WNCRY WannaCry.EXE File created C:\Users\Admin\Pictures\AddRename.tif.WNCRYT WannaCry.EXE File renamed C:\Users\Admin\Pictures\AddRename.tif.WNCRYT => C:\Users\Admin\Pictures\AddRename.tif.WNCRY WannaCry.EXE File opened for modification C:\Users\Admin\Pictures\AddRename.tif.WNCRY WannaCry.EXE File created C:\Users\Admin\Pictures\BackupSuspend.png.WNCRYT WannaCry.EXE File renamed C:\Users\Admin\Pictures\BackupSuspend.png.WNCRYT => C:\Users\Admin\Pictures\BackupSuspend.png.WNCRY WannaCry.EXE -
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SDE4CC.tmp WannaCry.EXE File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SDE4E3.tmp WannaCry.EXE -
Loads dropped DLL 12 IoCs
pid Process 652 taskhsvc.exe 652 taskhsvc.exe 652 taskhsvc.exe 652 taskhsvc.exe 652 taskhsvc.exe 652 taskhsvc.exe 652 taskhsvc.exe 2704 dismhost.exe 2704 dismhost.exe 2704 dismhost.exe 2704 dismhost.exe 2704 dismhost.exe -
Modifies file permissions 1 TTPs 1 IoCs
pid Process 1260 icacls.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\exvqpukpdbbhw483 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\tasksche.exe\"" reg.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\system32\LogFiles\setupcln\setuperr.log cleanmgr.exe File opened for modification C:\Windows\system32\LogFiles\setupcln\diagerr.xml cleanmgr.exe File opened for modification C:\Windows\system32\LogFiles\setupcln\diagwrn.xml cleanmgr.exe File opened for modification C:\Windows\system32\LogFiles\setupcln\setupact.log cleanmgr.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]" WannaCry.EXE Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]" @[email protected] -
Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\rescache\_merged\4183903823\97717462.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\1361672858.pri taskmgr.exe File opened for modification C:\Windows\Logs\DISM\dism.log cleanmgr.exe File opened for modification C:\Windows\Logs\DISM\dism.log dismhost.exe File created C:\Windows\rescache\_merged\421858948\3551649488.pri LogonUI.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 19 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags cleanmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005 cleanmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005\ cleanmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 cleanmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0014 cleanmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0004 cleanmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID cleanmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0004 cleanmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005\ cleanmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs cleanmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID cleanmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs cleanmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 cleanmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags cleanmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005 cleanmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0014 cleanmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1684 vssadmin.exe -
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe -
Modifies registry class 25 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\WorkFolders rundll32.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 4e003100000000008c531932120054656d7000003a0009000400efbe8853537a8c5319322e000000ba5201000000010000000000000000000000000000001e6e7200540065006d007000000014000000 taskmgr.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\NodeSlot = "2" taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 820074001c004346534616003100000000008c531a32120041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbe8853537a8c531a322e000000a65201000000010000000000000000000000000000001308cd004100700070004400610074006100000042000000 taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags taskmgr.exe Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}" taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe10000000b447a5df46ecd701ed99b9d91fefd701ed99b9d91fefd70114000000 taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = ffffffff taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 50003100000000008c531d3210004c6f63616c003c0009000400efbe8853537a8c531d322e000000b9520100000001000000000000000000000000000000bfba61004c006f00630061006c00000014000000 taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 taskmgr.exe -
Modifies registry key 1 TTPs 1 IoCs
pid Process 1624 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 652 taskhsvc.exe 652 taskhsvc.exe 1564 taskmgr.exe 652 taskhsvc.exe 652 taskhsvc.exe 1564 taskmgr.exe 1564 taskmgr.exe 652 taskhsvc.exe 652 taskhsvc.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2904 cleanmgr.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1564 taskmgr.exe Token: SeSystemProfilePrivilege 1564 taskmgr.exe Token: SeCreateGlobalPrivilege 1564 taskmgr.exe Token: SeBackupPrivilege 680 vssvc.exe Token: SeRestorePrivilege 680 vssvc.exe Token: SeAuditPrivilege 680 vssvc.exe Token: SeIncreaseQuotaPrivilege 2900 WMIC.exe Token: SeSecurityPrivilege 2900 WMIC.exe Token: SeTakeOwnershipPrivilege 2900 WMIC.exe Token: SeLoadDriverPrivilege 2900 WMIC.exe Token: SeSystemProfilePrivilege 2900 WMIC.exe Token: SeSystemtimePrivilege 2900 WMIC.exe Token: SeProfSingleProcessPrivilege 2900 WMIC.exe Token: SeIncBasePriorityPrivilege 2900 WMIC.exe Token: SeCreatePagefilePrivilege 2900 WMIC.exe Token: SeBackupPrivilege 2900 WMIC.exe Token: SeRestorePrivilege 2900 WMIC.exe Token: SeShutdownPrivilege 2900 WMIC.exe Token: SeDebugPrivilege 2900 WMIC.exe Token: SeSystemEnvironmentPrivilege 2900 WMIC.exe Token: SeRemoteShutdownPrivilege 2900 WMIC.exe Token: SeUndockPrivilege 2900 WMIC.exe Token: SeManageVolumePrivilege 2900 WMIC.exe Token: 33 2900 WMIC.exe Token: 34 2900 WMIC.exe Token: 35 2900 WMIC.exe Token: 36 2900 WMIC.exe Token: SeIncreaseQuotaPrivilege 2900 WMIC.exe Token: SeSecurityPrivilege 2900 WMIC.exe Token: SeTakeOwnershipPrivilege 2900 WMIC.exe Token: SeLoadDriverPrivilege 2900 WMIC.exe Token: SeSystemProfilePrivilege 2900 WMIC.exe Token: SeSystemtimePrivilege 2900 WMIC.exe Token: SeProfSingleProcessPrivilege 2900 WMIC.exe Token: SeIncBasePriorityPrivilege 2900 WMIC.exe Token: SeCreatePagefilePrivilege 2900 WMIC.exe Token: SeBackupPrivilege 2900 WMIC.exe Token: SeRestorePrivilege 2900 WMIC.exe Token: SeShutdownPrivilege 2900 WMIC.exe Token: SeDebugPrivilege 2900 WMIC.exe Token: SeSystemEnvironmentPrivilege 2900 WMIC.exe Token: SeRemoteShutdownPrivilege 2900 WMIC.exe Token: SeUndockPrivilege 2900 WMIC.exe Token: SeManageVolumePrivilege 2900 WMIC.exe Token: 33 2900 WMIC.exe Token: 34 2900 WMIC.exe Token: 35 2900 WMIC.exe Token: 36 2900 WMIC.exe Token: SeTcbPrivilege 1540 taskse.exe Token: SeTcbPrivilege 1540 taskse.exe Token: 33 1564 taskmgr.exe Token: SeIncBasePriorityPrivilege 1564 taskmgr.exe Token: SeTcbPrivilege 3228 taskse.exe Token: SeTcbPrivilege 3228 taskse.exe Token: SeTcbPrivilege 3992 taskse.exe Token: SeTcbPrivilege 3992 taskse.exe Token: SeTcbPrivilege 1784 taskse.exe Token: SeTcbPrivilege 1784 taskse.exe Token: SeBackupPrivilege 2904 cleanmgr.exe Token: SeRestorePrivilege 2904 cleanmgr.exe Token: SeTcbPrivilege 3356 taskse.exe Token: SeTcbPrivilege 3356 taskse.exe Token: SeTcbPrivilege 1856 taskse.exe Token: SeTcbPrivilege 1856 taskse.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe 1564 taskmgr.exe -
Suspicious use of SetWindowsHookEx 14 IoCs
pid Process 3204 @[email protected] 1880 @[email protected] 1880 @[email protected] 3204 @[email protected] 1064 @[email protected] 1064 @[email protected] 3608 @[email protected] 1704 @[email protected] 2332 @[email protected] 3956 @[email protected] 2260 @[email protected] 3720 @[email protected] 2244 LogonUI.exe 2244 LogonUI.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4092 wrote to memory of 516 4092 WannaCry.EXE 69 PID 4092 wrote to memory of 516 4092 WannaCry.EXE 69 PID 4092 wrote to memory of 516 4092 WannaCry.EXE 69 PID 4092 wrote to memory of 1260 4092 WannaCry.EXE 71 PID 4092 wrote to memory of 1260 4092 WannaCry.EXE 71 PID 4092 wrote to memory of 1260 4092 WannaCry.EXE 71 PID 4092 wrote to memory of 3564 4092 WannaCry.EXE 74 PID 4092 wrote to memory of 3564 4092 WannaCry.EXE 74 PID 4092 wrote to memory of 3564 4092 WannaCry.EXE 74 PID 4092 wrote to memory of 1344 4092 WannaCry.EXE 73 PID 4092 wrote to memory of 1344 4092 WannaCry.EXE 73 PID 4092 wrote to memory of 1344 4092 WannaCry.EXE 73 PID 3564 wrote to memory of 2900 3564 cmd.exe 76 PID 3564 wrote to memory of 2900 3564 cmd.exe 76 PID 3564 wrote to memory of 2900 3564 cmd.exe 76 PID 4092 wrote to memory of 3608 4092 WannaCry.EXE 80 PID 4092 wrote to memory of 3608 4092 WannaCry.EXE 80 PID 4092 wrote to memory of 3608 4092 WannaCry.EXE 80 PID 4092 wrote to memory of 3204 4092 WannaCry.EXE 81 PID 4092 wrote to memory of 3204 4092 WannaCry.EXE 81 PID 4092 wrote to memory of 3204 4092 WannaCry.EXE 81 PID 4092 wrote to memory of 8 4092 WannaCry.EXE 82 PID 4092 wrote to memory of 8 4092 WannaCry.EXE 82 PID 4092 wrote to memory of 8 4092 WannaCry.EXE 82 PID 8 wrote to memory of 1880 8 cmd.exe 84 PID 8 wrote to memory of 1880 8 cmd.exe 84 PID 8 wrote to memory of 1880 8 cmd.exe 84 PID 3204 wrote to memory of 652 3204 @[email protected] 87 PID 3204 wrote to memory of 652 3204 @[email protected] 87 PID 3204 wrote to memory of 652 3204 @[email protected] 87 PID 1880 wrote to memory of 1344 1880 @[email protected] 89 PID 1880 wrote to memory of 1344 1880 @[email protected] 89 PID 1880 wrote to memory of 1344 1880 @[email protected] 89 PID 1344 wrote to memory of 1684 1344 cmd.exe 91 PID 1344 wrote to memory of 1684 1344 cmd.exe 91 PID 1344 wrote to memory of 1684 1344 cmd.exe 91 PID 1344 wrote to memory of 2900 1344 cmd.exe 93 PID 1344 wrote to memory of 2900 1344 cmd.exe 93 PID 1344 wrote to memory of 2900 1344 cmd.exe 93 PID 4092 wrote to memory of 1540 4092 WannaCry.EXE 95 PID 4092 wrote to memory of 1540 4092 WannaCry.EXE 95 PID 4092 wrote to memory of 1540 4092 WannaCry.EXE 95 PID 4092 wrote to memory of 1064 4092 WannaCry.EXE 96 PID 4092 wrote to memory of 1064 4092 WannaCry.EXE 96 PID 4092 wrote to memory of 1064 4092 WannaCry.EXE 96 PID 4092 wrote to memory of 1756 4092 WannaCry.EXE 97 PID 4092 wrote to memory of 1756 4092 WannaCry.EXE 97 PID 4092 wrote to memory of 1756 4092 WannaCry.EXE 97 PID 1756 wrote to memory of 1624 1756 cmd.exe 99 PID 1756 wrote to memory of 1624 1756 cmd.exe 99 PID 1756 wrote to memory of 1624 1756 cmd.exe 99 PID 4092 wrote to memory of 2052 4092 WannaCry.EXE 100 PID 4092 wrote to memory of 2052 4092 WannaCry.EXE 100 PID 4092 wrote to memory of 2052 4092 WannaCry.EXE 100 PID 4092 wrote to memory of 3228 4092 WannaCry.EXE 103 PID 4092 wrote to memory of 3228 4092 WannaCry.EXE 103 PID 4092 wrote to memory of 3228 4092 WannaCry.EXE 103 PID 4092 wrote to memory of 3608 4092 WannaCry.EXE 104 PID 4092 wrote to memory of 3608 4092 WannaCry.EXE 104 PID 4092 wrote to memory of 3608 4092 WannaCry.EXE 104 PID 4092 wrote to memory of 2180 4092 WannaCry.EXE 105 PID 4092 wrote to memory of 2180 4092 WannaCry.EXE 105 PID 4092 wrote to memory of 2180 4092 WannaCry.EXE 105 PID 2904 wrote to memory of 2704 2904 cleanmgr.exe 111 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 516 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\WannaCry.EXE"C:\Users\Admin\AppData\Local\Temp\WannaCry.EXE"1⤵
- Modifies extensions of user files
- Drops startup file
- Sets desktop wallpaper using registry
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Windows\SysWOW64\attrib.exeattrib +h .2⤵
- Views/modifies file attributes
PID:516
-
-
C:\Windows\SysWOW64\icacls.exeicacls . /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
PID:1260
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:1344
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 111061639289803.bat2⤵
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Windows\SysWOW64\cscript.execscript.exe //nologo m.vbs3⤵PID:2900
-
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:3608
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\taskhsvc.exeTaskData\Tor\taskhsvc.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:652
-
-
-
C:\Windows\SysWOW64\cmd.exePID:8
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet4⤵
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet5⤵
- Interacts with shadow copies
PID:1684
-
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete5⤵
- Suspicious use of AdjustPrivilegeToken
PID:2900
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1540
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Suspicious use of SetWindowsHookEx
PID:1064
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "exvqpukpdbbhw483" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\tasksche.exe\"" /f2⤵
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "exvqpukpdbbhw483" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\tasksche.exe\"" /f3⤵
- Adds Run key to start application
- Modifies registry key
PID:1624
-
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:2052
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3228
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:3608
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:2180
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3992
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:1704
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:2096
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1784
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:2332
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:1320
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3356
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:3956
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:744
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1856
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:2260
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:2296
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:1616
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:3720
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:3852
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1564
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
- Modifies registry class
PID:2580
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:680
-
C:\Windows\System32\cleanmgr.exe"C:\Windows\System32\cleanmgr.exe" /D C1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\5442A9D3-F570-4104-97E4-8A7A58D81E5D\dismhost.exeC:\Users\Admin\AppData\Local\Temp\5442A9D3-F570-4104-97E4-8A7A58D81E5D\dismhost.exe {588D3FBE-0B8E-4815-9BC3-30B89033EDD5}2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2704
-
-
C:\Windows\System32\cleanmgr.exe"C:\Windows\System32\cleanmgr.exe" /D C1⤵PID:2328
-
C:\Windows\system32\NOTEPAD.EXEPID:4088
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x0 /state0:0xa3a85855 /state1:0x41c64e6d1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2244