Overview

overview

10

Static

static

10

2024-03-06...ry.exe

windows7-x64

10

2024-03-06...ry.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    145s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-03-2024 18:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-03-06_e396682fa41f62fc399419848377f59f_destroyer_wannacry.exe

  • Size

    22KB

  • MD5

    e396682fa41f62fc399419848377f59f

  • SHA1

    69e6c685ea1312bc58148cfa4654d939c23d3d3d

  • SHA256

    345b8405ff606f8542ed48fc44c6da3a35df6afacf198698ea52e6e9642eac06

  • SHA512

    97184d7296f0c6d623fc1f4978fe71b7a05331f8230261a3ab21f5bf0a98bbd1920aaa68839570c6360d7b95079f66627f38ed381c5ddcfc7f4ba7a9d3cf9027

  • SSDEEP

    192:e1p2Dl10jI4fnw4S9KNPGwRFZKjhdcAhkYe//h9JsAa96cIKjwEYV83edpnHoCYE:U9f5pkwAhkcAa95BYljgmslC97C

Score
10/10
evasionpersistenceransomware

Malware Config

Extracted

Path

C:\Users\Public\Libraries\RESTORE_FILES-DBXSZVGV.txt

Ransom Note
--- What happened? --- All of your files are encrypted and stolen. Stolen data will be published soon on our tor website. There is no way to recover your data and prevent data leakage without us Decryption is not possible without private key. Don't waste your and our time to recover your files. It is impossible without our help --- How to recover files & prevent leakage? --- To make sure that we REALLY CAN recover your data - we offer FREE DECRYPTION for warranty. We promise that you can recover all your files safely and prevent data leakage. We can do it! --- Contact Us--- Download Tox chat from https://tox.chat/download.html Send us friend request to ID B1087CC15FFA75368DD104E9E37B6B9EC113DFFF4D03895CC6FD0640BA98296F6AA40E410BC4 OR Download Tor Browser - https://www.torproject.org/download/ and install it Open website: http://nfdxsippmdr5gxgt4slqpdljxoyeuugnwuil55xzdhl7kz2jiqbahpqd.onion Decryption ID: 1LN0Mgj0K8whNHLgKT7frA7fWF3z7Ap4
URLs

https://tox.chat/download.html

http://nfdxsippmdr5gxgt4slqpdljxoyeuugnwuil55xzdhl7kz2jiqbahpqd.onion

Signatures

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Detects command variations typically used by ransomware 1 IoCs
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Renames multiple (131) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 50 IoCs
  • Suspicious use of AdjustPrivilegeToken 49 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-06_e396682fa41f62fc399419848377f59f_destroyer_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-06_e396682fa41f62fc399419848377f59f_destroyer_wannacry.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4384
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4584
      • C:\Windows\system32\vssadmin.exe
        vssadmin delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:1060
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic shadowcopy delete
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2476
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4312
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} bootstatuspolicy ignoreallfailures
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:4976
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} recoveryenabled no
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:2324
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4488
      • C:\Windows\system32\wbadmin.exe
        wbadmin delete catalog -quiet
        3⤵
        • Deletes backup catalog
        PID:912
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2780
  • C:\Windows\system32\wbengine.exe
    "C:\Windows\system32\wbengine.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3516
  • C:\Windows\System32\vdsldr.exe
    C:\Windows\System32\vdsldr.exe -Embedding
    1⤵
      PID:3360
    • C:\Windows\System32\vds.exe
      C:\Windows\System32\vds.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:3276

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Public\Libraries\RESTORE_FILES-DBXSZVGV.txt
      Filesize

      980B

      MD5

      b03e1440f4eceab9261bd4e510f9f65f

      SHA1

      81b1823766821fad95715aad80a704c5c559814f

      SHA256

      fb3d2c0289575674595a1130928bf078e4fe47b2ce0836fd567f9ebcbdccf77f

      SHA512

      d1ace7be5a1952af9cd57f61374e3b28bf7be70b5641aa79ec8ea88630f9c1a9b8eeae149f9656ad35d0c1386677ab3b6a431a6e7db48b8bbca8177900e12981

      Download Submit

    • memory/4384-0-0x0000000000520000-0x000000000052C000-memory.dmp

      Filesize

      48KB

      Download

    • memory/4384-43-0x00007FF868EC0000-0x00007FF869981000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4384-44-0x000000001B180000-0x000000001B190000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4384-280-0x00007FF868EC0000-0x00007FF869981000-memory.dmp

      Filesize

      10.8MB

      Download