Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

27/05/2024, 22:11

240527-14ae9ada43 10

27/05/2024, 21:15

240527-z3zhbabd59 10

13/02/2024, 12:11

240213-pcwzdshd2w 10

13/02/2024, 12:08

240213-pa6qtahc7y 10

18/12/2023, 08:13

231218-j4g2nabaf5 10

05/12/2023, 08:54

231205-kt32taae27 10

05/12/2023, 07:41

231205-jjdthahh6w 10

05/12/2023, 07:38

231205-jgmcvshh5x 10

26/11/2023, 09:39

231126-lmxf5agd87 10

Analysis

  • max time kernel
    145s
  • max time network
    118s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/02/2024, 12:08

General

  • Target

    Malware-database-main/WannaCry.exe

  • Size

    224KB

  • MD5

    5c7fb0927db37372da25f270708103a2

  • SHA1

    120ed9279d85cbfa56e5b7779ffa7162074f7a29

  • SHA256

    be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844

  • SHA512

    a15f97fad744ccf5f620e5aabb81f48507327b898a9aa4287051464019e0f89224c484e9691812e166471af9beaddcfc3deb2ba878658761f4800663beef7206

  • SSDEEP

    3072:Y059femWRwTs/dbelj0X8/j84pcRXPlU3Upt3or4H84lK8PtpLzLsR/EfcZ:+5RwTs/dSXj84mRXPemxdBlPvLzLeZ

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!Please Read Me!.txt

Family

wannacry

Ransom Note
Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �
Wallets

15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Kills process with taskkill 4 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 49 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe
    "C:\Users\Admin\AppData\Local\Temp\Malware-database-main\WannaCry.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2056
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 201121707826132.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4236
      • C:\Windows\SysWOW64\cscript.exe
        cscript //nologo c.vbs
        3⤵
          PID:5112
      • C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
        !WannaDecryptor!.exe f
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2912
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /f /im MSExchange*
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4160
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /f /im sqlwriter.exe
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:400
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /f /im sqlserver.exe
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4816
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /f /im Microsoft.Exchange.*
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:512
      • C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
        !WannaDecryptor!.exe c
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:4408
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c start /b !WannaDecryptor!.exe v
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2336
        • C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
          !WannaDecryptor!.exe v
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:712
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:4836
            • C:\Windows\SysWOW64\Wbem\WMIC.exe
              wmic shadowcopy delete
              5⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2556
      • C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe
        !WannaDecryptor!.exe
        2⤵
        • Executes dropped EXE
        • Sets desktop wallpaper using registry
        • Suspicious use of SetWindowsHookEx
        PID:4164
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4236
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4276
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4764
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4540

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db

      Filesize

      1024KB

      MD5

      391dbcfd4a3ac2930dde8195498405d7

      SHA1

      69be13cdff4139c830e27ce1902eb30a0e06813a

      SHA256

      5d62fc5e32c3b2c1cec041de27b83c67f6e09765f18f09ec216dff6dd5f1e253

      SHA512

      79ad2d069667bfdbd9e91764d948aa788dc32775aa58618d7a5bae82d5c5904ee3160bc90f78bfa49bfc1829b6abad92b3fb41bcafff8c73d2e627785857c9e2

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

      Filesize

      7KB

      MD5

      c04cbe41be05b451bb105716ab5f722b

      SHA1

      76549ce024a730266168acb2c4a43496c632875c

      SHA256

      61a1747b5a24782c7f18a592c45bf9e13e40ceddc3f0c527166d9e45aed5b0a8

      SHA512

      8ab545c8b43003fd31401c24e49264e011d61089c642593406d941e47ba3b6025fdb0e941f9222d50e7434479d22767a99f2e211b331a7b46172f64e1704568a

    • C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!Please Read Me!.txt

      Filesize

      797B

      MD5

      afa18cf4aa2660392111763fb93a8c3d

      SHA1

      c219a3654a5f41ce535a09f2a188a464c3f5baf5

      SHA256

      227082c719fd4394c1f2311a0877d8a302c5b092bcc49f853a5cf3d2945f42b0

      SHA512

      4161f250d59b7d4d4a6c4f16639d66d21b2a9606de956d22ec00bedb006643fedbbb8e4cde9f6c0c977285918648314883ca91f3442d1125593bf2605f2d5c6b

    • C:\Users\Admin\AppData\Local\Temp\Malware-database-main\!WannaDecryptor!.exe.lnk

      Filesize

      1KB

      MD5

      b729a46991214e3985c176d4a06a0928

      SHA1

      b2a2b04906270a60fd2e56e3e038bfc5923479d5

      SHA256

      d1999faad51a17a684ac2f4222255114863ca5230011c6a6716bd90c64ccf577

      SHA512

      1ccd678b925d5088e0ac6b4ed88c0950c5e4bb2f1d9980fd722382d25819efaa64fe863d445f269cd2e944d75ea14e7e68b24fb9b753816deb430d35ca20862c

    • C:\Users\Admin\AppData\Local\Temp\Malware-database-main\00000000.res

      Filesize

      136B

      MD5

      8fce820475fa35dbeae124fe027fd1a8

      SHA1

      488c629873616f500a7b4baad2f89f6663f1973a

      SHA256

      08fb4dddf967db92d6948e5d87b962d4bd1a0688ee9be3bb930d1115440bf35b

      SHA512

      418312c96fe374f00a0750aacbfb6e5c594c3d3f7f21e9c17c7767ed32e8a464d2e36634de8c2409ccab2dbd5adec5309e2b22923056c3090bcbcc1d2c4765bc

    • C:\Users\Admin\AppData\Local\Temp\Malware-database-main\00000000.res

      Filesize

      136B

      MD5

      db9948dcf1927a1c78479a20d5a4fa76

      SHA1

      eadf94a64ad27074a379ba0976b0f5346cce4726

      SHA256

      0142230245c0034fad9916465f532e370804e02f056b9569539ff11a3de9b763

      SHA512

      c3f34d17b943283e493665680b3599ab898a586bd98deef49543fb02530d6eca561c3f137a1a4ca4049bb909a4e50ab0c46de23e58e143d589c105a6ad2fc7b1

    • C:\Users\Admin\AppData\Local\Temp\Malware-database-main\00000000.res

      Filesize

      136B

      MD5

      6e99784c179a52b2d0f7c9b1c6122ba1

      SHA1

      a255c643cee559bc48b20fdaae3e825677ad2197

      SHA256

      cd2ee3d33b6b392208f3e85358ce90c1a417a18692631232156655611fc573d0

      SHA512

      95dad90e6685cfa2cfeff392b67bfc07222f58ef5c7d6ee920338c55fe96a9cc8839c7ac3ec78d27fd2c9776972a3c370657476a1b1014e210ee714f83b92c9e

    • C:\Users\Admin\AppData\Local\Temp\Malware-database-main\201121707826132.bat

      Filesize

      380B

      MD5

      71e08345a9f96647941595bc404e4304

      SHA1

      207f50600f9d261ff8fa88ba4f52dd2fc5bc13c5

      SHA256

      04ec40a225b6140fd35a92b66db0ddbcf96d31c4accf7183295c2321be9dcb16

      SHA512

      5c4bce405c86f688b2f3e6837dd24fc9db1485325965a17a841c191b25104ee9fdbf08d709b74f1fa9e752ad1374c391f3467dd7e448da38a7f1a27b38bc2e3d

    • C:\Users\Admin\AppData\Local\Temp\Malware-database-main\c.vbs

      Filesize

      263B

      MD5

      897fe8eafbce679f3f2ecae2f678753a

      SHA1

      3e0cef18216c559e6bdf9c1c5331d8d5d2e53398

      SHA256

      04a249282dfa17a672c10ada3dc9a3b71f518b33fdb953ad2f76d88bd60d2c7a

      SHA512

      979460bf2c9761e6f3d9c7f99efd3eaf60ac81dfdc7d7d8882c5f248afb04d2aa27885b6aad7140dc601c90a375e5e9e31bbd2efa06496541a74bcd75d2d71ae

    • C:\Users\Admin\AppData\Local\Temp\Malware-database-main\c.wry

      Filesize

      628B

      MD5

      f302583027f02d8e8dd78c715acd5109

      SHA1

      691f0b1032d91f91b3bfc817178d4bad21e00167

      SHA256

      28e69f63b908045d58f50b4a893558da63d7b771bbdd5a5cf1840e9b069335b8

      SHA512

      0b2b90db891dc1025f5526077f575f2806fcd225ec7ffb3022276fcd88dfbbf5aff4af7f74e035b52006a7bbdb704533e87e33cb2b774046f1acdeb7fb8d8e55

    • C:\Users\Admin\AppData\Local\Temp\Malware-database-main\m.wry

      Filesize

      42KB

      MD5

      980b08bac152aff3f9b0136b616affa5

      SHA1

      2a9c9601ea038f790cc29379c79407356a3d25a3

      SHA256

      402046ada270528c9ac38bbfa0152836fe30fb8e12192354e53b8397421430d9

      SHA512

      100cda1f795781042b012498afd783fd6ff03b0068dbd07b2c2e163cd95e6c6e00755ce16b02b017693c9febc149ed02df9df9b607e2b9cca4b07e5bd420f496

    • C:\Users\Admin\AppData\Local\Temp\Malware-database-main\u.wry

      Filesize

      236KB

      MD5

      cf1416074cd7791ab80a18f9e7e219d9

      SHA1

      276d2ec82c518d887a8a3608e51c56fa28716ded

      SHA256

      78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df

      SHA512

      0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

    • memory/2056-6-0x0000000010000000-0x0000000010012000-memory.dmp

      Filesize

      72KB