Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    298s
  • max time network
    258s
  • platform
    windows10-1703_x64
  • resource
    win10-20230703-en
  • resource tags

    arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
  • submitted
    17/08/2023, 16:42

General

  • Target

    be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe

  • Size

    224KB

  • MD5

    5c7fb0927db37372da25f270708103a2

  • SHA1

    120ed9279d85cbfa56e5b7779ffa7162074f7a29

  • SHA256

    be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844

  • SHA512

    a15f97fad744ccf5f620e5aabb81f48507327b898a9aa4287051464019e0f89224c484e9691812e166471af9beaddcfc3deb2ba878658761f4800663beef7206

  • SSDEEP

    3072:Y059femWRwTs/dbelj0X8/j84pcRXPlU3Upt3or4H84lK8PtpLzLsR/EfcZ:+5RwTs/dSXj84mRXPemxdBlPvLzLeZ

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\!Please Read Me!.txt

Family

wannacry

Ransom Note
Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �
Wallets

15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Kills process with taskkill 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 49 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe
    "C:\Users\Admin\AppData\Local\Temp\be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4452
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 205511692290611.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2932
      • C:\Windows\SysWOW64\cscript.exe
        cscript //nologo c.vbs
        3⤵
          PID:892
      • C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
        !WannaDecryptor!.exe f
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:4304
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /f /im sqlwriter.exe
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3100
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /f /im sqlserver.exe
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4016
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /f /im Microsoft.Exchange.*
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4040
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /f /im MSExchange*
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4104
      • C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
        !WannaDecryptor!.exe c
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2636
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c start /b !WannaDecryptor!.exe v
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4876
        • C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
          !WannaDecryptor!.exe v
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4404
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2584
            • C:\Windows\SysWOW64\vssadmin.exe
              vssadmin delete shadows /all /quiet
              5⤵
              • Interacts with shadow copies
              PID:3128
            • C:\Windows\SysWOW64\Wbem\WMIC.exe
              wmic shadowcopy delete
              5⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:340
      • C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
        !WannaDecryptor!.exe
        2⤵
        • Executes dropped EXE
        • Sets desktop wallpaper using registry
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        PID:4616
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4036
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:2592

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Recovery\WindowsRE\!WannaDecryptor!.exe.lnk

        Filesize

        1KB

        MD5

        f9dabe69470c1d2631e29aef786d12c1

        SHA1

        aafa09058aba409d0bd8ce20b7d0caec963a6faa

        SHA256

        aee8426cfb173d3af9bdf5e82dc2f2380a7d69deef92495e897ff78b31e21b5a

        SHA512

        1765aa16c864a18c15babacb8d1310ca825e8558f307f131c71da1f688cfea8269627e4ff180ec6db6ac2158576d7b7029872f396a822fefda413a166a9cc9b1

      • C:\Users\Admin\AppData\Local\Temp\!Please Read Me!.txt

        Filesize

        797B

        MD5

        afa18cf4aa2660392111763fb93a8c3d

        SHA1

        c219a3654a5f41ce535a09f2a188a464c3f5baf5

        SHA256

        227082c719fd4394c1f2311a0877d8a302c5b092bcc49f853a5cf3d2945f42b0

        SHA512

        4161f250d59b7d4d4a6c4f16639d66d21b2a9606de956d22ec00bedb006643fedbbb8e4cde9f6c0c977285918648314883ca91f3442d1125593bf2605f2d5c6b

      • C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe

        Filesize

        236KB

        MD5

        cf1416074cd7791ab80a18f9e7e219d9

        SHA1

        276d2ec82c518d887a8a3608e51c56fa28716ded

        SHA256

        78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df

        SHA512

        0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

      • C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe

        Filesize

        236KB

        MD5

        cf1416074cd7791ab80a18f9e7e219d9

        SHA1

        276d2ec82c518d887a8a3608e51c56fa28716ded

        SHA256

        78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df

        SHA512

        0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

      • C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe

        Filesize

        236KB

        MD5

        cf1416074cd7791ab80a18f9e7e219d9

        SHA1

        276d2ec82c518d887a8a3608e51c56fa28716ded

        SHA256

        78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df

        SHA512

        0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

      • C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe

        Filesize

        236KB

        MD5

        cf1416074cd7791ab80a18f9e7e219d9

        SHA1

        276d2ec82c518d887a8a3608e51c56fa28716ded

        SHA256

        78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df

        SHA512

        0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

      • C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe

        Filesize

        236KB

        MD5

        cf1416074cd7791ab80a18f9e7e219d9

        SHA1

        276d2ec82c518d887a8a3608e51c56fa28716ded

        SHA256

        78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df

        SHA512

        0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

      • C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe.lnk

        Filesize

        1KB

        MD5

        f9dabe69470c1d2631e29aef786d12c1

        SHA1

        aafa09058aba409d0bd8ce20b7d0caec963a6faa

        SHA256

        aee8426cfb173d3af9bdf5e82dc2f2380a7d69deef92495e897ff78b31e21b5a

        SHA512

        1765aa16c864a18c15babacb8d1310ca825e8558f307f131c71da1f688cfea8269627e4ff180ec6db6ac2158576d7b7029872f396a822fefda413a166a9cc9b1

      • C:\Users\Admin\AppData\Local\Temp\00000000.res

        Filesize

        136B

        MD5

        1cca85218cb2eeac720c49e17084b86e

        SHA1

        d4b541e5e5b33300a13708fc970e8226af2eee1a

        SHA256

        d0f1718086771cec811b7a54d67ff8dc079f18f65ecd1b9e5990d9ada6963b71

        SHA512

        f89bdd63647174c643efb2ff9dc0abb9f34d95d21c8b5c3722a562ab81193467bbfb5237458aa2571bbdb6288736c84859e2767e167c770a96e9e6c0991fc788

      • C:\Users\Admin\AppData\Local\Temp\00000000.res

        Filesize

        136B

        MD5

        5ebcbbbea225a02ae283276a2141ae2d

        SHA1

        68f6f73052b7bd8e1532c201d172c3efebb79f57

        SHA256

        c44abc2eb3d32b03444b66a331031df111bd721e290ea2c189992621497499ae

        SHA512

        ea7ecedfe69aff29b44626c262c1400611f21edc81e05ef349acd1b6e0b984c55ccefac1a518c2935190ce124e073e0afdfd96b897f773facf992cc34db10808

      • C:\Users\Admin\AppData\Local\Temp\00000000.res

        Filesize

        136B

        MD5

        32f3ed46862c72fcedfdb4109800f356

        SHA1

        f6394b1b5de3380c847f8ccd055478b347b4e399

        SHA256

        4378319b9924977c610e13b4b3f478c20200083d41e4dabfd7883848765269b7

        SHA512

        8cbf510fba846c070250d42bdf379d81664e79f3d01f411ad0b40d6ebaab9548fa8bf24a08ca7c6acd5a01be0c3ab16dda362141f27d38962e6f86e1553b3d63

      • C:\Users\Admin\AppData\Local\Temp\205511692290611.bat

        Filesize

        336B

        MD5

        3540e056349c6972905dc9706cd49418

        SHA1

        492c20442d34d45a6d6790c720349b11ec591cde

        SHA256

        73872a89440a2cba9d22bf4961c3d499ea2c72979c30c455f942374292fedadc

        SHA512

        c949d147100aef59e382c03abf7b162ae62a4d43456eebd730fbedcf5f95f5e1a24f6e349690d52d75331878a6ee8f6b88a7162ee9cf2a49e142196b12d0133c

      • C:\Users\Admin\AppData\Local\Temp\c.vbs

        Filesize

        219B

        MD5

        5f6d40ca3c34b470113ed04d06a88ff4

        SHA1

        50629e7211ae43e32060686d6be17ebd492fd7aa

        SHA256

        0fb5039a2fe7e90cdf3f22140d7f2103f94689b15609efe0edcc8430dd772fc1

        SHA512

        4d4aa1abd2c9183202fd3f0a65b37f07ee0166ba6561f094c13c8ea59752c7bdd960e37c49583746d4464bc3b1dc0b63a1fe36a37ce7e5709cd76ed433befe35

      • C:\Users\Admin\AppData\Local\Temp\c.wry

        Filesize

        628B

        MD5

        7b8f0ea9c7054702c38241d18142ab62

        SHA1

        9f65fa73035804a3147a096501607b061434ec9b

        SHA256

        e02e9f6f9b3943474930b6ccc6045c02248525319f67520e65c1539a0b286a81

        SHA512

        272c0124f8868070a6e19091fa18012fecb7846d3fe97601ed58f3fb121e382563f5018e6753d4b58362a244561347711f3e20caac0af15b31277b889883e1d0

      • C:\Users\Admin\AppData\Local\Temp\c.wry

        Filesize

        628B

        MD5

        7b8f0ea9c7054702c38241d18142ab62

        SHA1

        9f65fa73035804a3147a096501607b061434ec9b

        SHA256

        e02e9f6f9b3943474930b6ccc6045c02248525319f67520e65c1539a0b286a81

        SHA512

        272c0124f8868070a6e19091fa18012fecb7846d3fe97601ed58f3fb121e382563f5018e6753d4b58362a244561347711f3e20caac0af15b31277b889883e1d0

      • C:\Users\Admin\AppData\Local\Temp\m.wry

        Filesize

        42KB

        MD5

        980b08bac152aff3f9b0136b616affa5

        SHA1

        2a9c9601ea038f790cc29379c79407356a3d25a3

        SHA256

        402046ada270528c9ac38bbfa0152836fe30fb8e12192354e53b8397421430d9

        SHA512

        100cda1f795781042b012498afd783fd6ff03b0068dbd07b2c2e163cd95e6c6e00755ce16b02b017693c9febc149ed02df9df9b607e2b9cca4b07e5bd420f496

      • C:\Users\Admin\AppData\Local\Temp\u.wry

        Filesize

        236KB

        MD5

        cf1416074cd7791ab80a18f9e7e219d9

        SHA1

        276d2ec82c518d887a8a3608e51c56fa28716ded

        SHA256

        78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df

        SHA512

        0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

      • memory/4452-126-0x0000000010000000-0x0000000010012000-memory.dmp

        Filesize

        72KB