Overview

overview

10

Static

static

10

2024-04-28...ry.exe

windows7-x64

9

2024-04-28...ry.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    28-04-2024 03:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-04-28_7f3607674f31dd96e4d6a009cb4dfb7e_wannacry.exe

  • Size

    987KB

  • MD5

    7f3607674f31dd96e4d6a009cb4dfb7e

  • SHA1

    5ebce6ec9924dc24e73a1faef6934128ea46c28c

  • SHA256

    ab1ead6628df92a6cf9e0aee75bdf3ad9e7bf7e9067baf2a5a83adbf4cfd5d02

  • SHA512

    68e0aff21d3ee5d24794c1d46f5a13fdc6af63f299ff175f74f89443b7edbcf09f7a96fdd43d64ed44e8336f37bfdc1c1806a2103846bbb2e14593fc0a125c06

  • SSDEEP

    12288:ut3UkyTa5ziXxqf8FLpqf77yAJKrMCLSoJjvN+MyjLvBG1YJX8ORnu:TkbsLpqDuA7E3cRnu

Score
9/10
evasionransomwarespywarestealer

Malware Config

Signatures

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 1 IoCs
  • Detects command variations typically used by ransomware 1 IoCs
  • Detects executables containing many references to VEEAM. Observed in ransomware 1 IoCs
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Deletes System State backups 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Disables Task Manager via registry modification
    evasion
  • Modifies Windows Firewall 2 TTPs 2 IoCs
    evasion
  • Drops startup file 7 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 64 IoCs
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-28_7f3607674f31dd96e4d6a009cb4dfb7e_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-28_7f3607674f31dd96e4d6a009cb4dfb7e_wannacry.exe"
    1⤵
    • Drops startup file
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3044
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C attrib +h +s "C:\Users\Admin\AppData\Local\Temp\2024-04-28_7f3607674f31dd96e4d6a009cb4dfb7e_wannacry.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2160
      • C:\Windows\system32\attrib.exe
        attrib +h +s "C:\Users\Admin\AppData\Local\Temp\2024-04-28_7f3607674f31dd96e4d6a009cb4dfb7e_wannacry.exe"
        3⤵
        • Views/modifies file attributes
        PID:2564
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "ZEBRA" /tr "C:\Users\Admin\AppData\Local\Temp\2024-04-28_7f3607674f31dd96e4d6a009cb4dfb7e_wannacry.exe"
      2⤵
      • Creates scheduled task(s)
      PID:2656
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2612
      • C:\Windows\system32\vssadmin.exe
        vssadmin delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:2468
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C wbadmin DELETE SYSTEMSTATEBACKUP
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3028
      • C:\Windows\system32\wbadmin.exe
        wbadmin DELETE SYSTEMSTATEBACKUP
        3⤵
        • Deletes System State backups
        • Drops file in Windows directory
        PID:2952
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2720
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic shadowcopy delete
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2684
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:928
      • C:\Windows\system32\wbadmin.exe
        wbadmin delete catalog -quiet
        3⤵
        • Deletes backup catalog
        PID:2644
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1972
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} bootstatuspolicy ignoreallfailures
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:2068
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} recoveryenabled no
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:932
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} recoveryenabled no
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:1780
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C netsh advfirewall set currentprofile state off
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1204
      • C:\Windows\system32\netsh.exe
        netsh advfirewall set currentprofile state off
        3⤵
        • Modifies Windows Firewall
        PID:868
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C netsh firewall set opmode mode=disable
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1404
      • C:\Windows\system32\netsh.exe
        netsh firewall set opmode mode=disable
        3⤵
        • Modifies Windows Firewall
        PID:2688
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C Reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:536
      • C:\Windows\system32\reg.exe
        Reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        3⤵
          PID:1008
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C wmic SHADOWCOPY /nointeractive
        2⤵
          PID:844
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic SHADOWCOPY /nointeractive
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:272
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /C label A: Locked By Zebra
          2⤵
            PID:1728
            • C:\Windows\system32\label.exe
              label A: Locked By Zebra
              3⤵
              • Enumerates connected drives
              PID:2252
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C label B: Locked By Zebra
            2⤵
              PID:788
              • C:\Windows\system32\label.exe
                label B: Locked By Zebra
                3⤵
                • Enumerates connected drives
                PID:1904
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /C label C: Locked By Zebra
              2⤵
                PID:2052
                • C:\Windows\system32\label.exe
                  label C: Locked By Zebra
                  3⤵
                    PID:1776
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C label D: Locked By Zebra
                  2⤵
                    PID:2260
                    • C:\Windows\system32\label.exe
                      label D: Locked By Zebra
                      3⤵
                      • Enumerates connected drives
                      PID:2748
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C label E: Locked By Zebra
                    2⤵
                      PID:840
                      • C:\Windows\system32\label.exe
                        label E: Locked By Zebra
                        3⤵
                        • Enumerates connected drives
                        PID:1544
                    • C:\Windows\System32\cmd.exe
                      "C:\Windows\System32\cmd.exe" /C label F: Locked By Zebra
                      2⤵
                        PID:1816
                        • C:\Windows\system32\label.exe
                          label F: Locked By Zebra
                          3⤵
                          • Enumerates connected drives
                          PID:2264
                      • C:\Windows\System32\cmd.exe
                        "C:\Windows\System32\cmd.exe" /C label G: Locked By Zebra
                        2⤵
                          PID:1896
                          • C:\Windows\system32\label.exe
                            label G: Locked By Zebra
                            3⤵
                            • Enumerates connected drives
                            PID:1160
                        • C:\Windows\System32\cmd.exe
                          "C:\Windows\System32\cmd.exe" /C label H: Locked By Zebra
                          2⤵
                            PID:1536
                            • C:\Windows\system32\label.exe
                              label H: Locked By Zebra
                              3⤵
                              • Enumerates connected drives
                              PID:1840
                          • C:\Windows\System32\cmd.exe
                            "C:\Windows\System32\cmd.exe" /C label I: Locked By Zebra
                            2⤵
                              PID:1064
                              • C:\Windows\system32\label.exe
                                label I: Locked By Zebra
                                3⤵
                                • Enumerates connected drives
                                PID:2872
                            • C:\Windows\System32\cmd.exe
                              "C:\Windows\System32\cmd.exe" /C label J: Locked By Zebra
                              2⤵
                                PID:2208
                                • C:\Windows\system32\label.exe
                                  label J: Locked By Zebra
                                  3⤵
                                  • Enumerates connected drives
                                  PID:2364
                              • C:\Windows\System32\cmd.exe
                                "C:\Windows\System32\cmd.exe" /C label K: Locked By Zebra
                                2⤵
                                  PID:1672
                                  • C:\Windows\system32\label.exe
                                    label K: Locked By Zebra
                                    3⤵
                                    • Enumerates connected drives
                                    PID:884
                                • C:\Windows\System32\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /C label L: Locked By Zebra
                                  2⤵
                                    PID:2544
                                    • C:\Windows\system32\label.exe
                                      label L: Locked By Zebra
                                      3⤵
                                      • Enumerates connected drives
                                      PID:2200
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /C label M: Locked By Zebra
                                    2⤵
                                      PID:1916
                                      • C:\Windows\system32\label.exe
                                        label M: Locked By Zebra
                                        3⤵
                                        • Enumerates connected drives
                                        PID:2224
                                    • C:\Windows\System32\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /C label N: Locked By Zebra
                                      2⤵
                                        PID:1600
                                        • C:\Windows\system32\label.exe
                                          label N: Locked By Zebra
                                          3⤵
                                          • Enumerates connected drives
                                          PID:1832
                                      • C:\Windows\System32\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /C label O: Locked By Zebra
                                        2⤵
                                          PID:2824
                                          • C:\Windows\system32\label.exe
                                            label O: Locked By Zebra
                                            3⤵
                                            • Enumerates connected drives
                                            PID:2244
                                        • C:\Windows\System32\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /C label P: Locked By Zebra
                                          2⤵
                                            PID:2732
                                            • C:\Windows\system32\label.exe
                                              label P: Locked By Zebra
                                              3⤵
                                              • Enumerates connected drives
                                              PID:2876
                                          • C:\Windows\System32\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /C label Q: Locked By Zebra
                                            2⤵
                                              PID:2844
                                              • C:\Windows\system32\label.exe
                                                label Q: Locked By Zebra
                                                3⤵
                                                • Enumerates connected drives
                                                PID:2516
                                            • C:\Windows\System32\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /C label R: Locked By Zebra
                                              2⤵
                                                PID:2448
                                                • C:\Windows\system32\label.exe
                                                  label R: Locked By Zebra
                                                  3⤵
                                                  • Enumerates connected drives
                                                  PID:2532
                                              • C:\Windows\System32\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /C label S: Locked By Zebra
                                                2⤵
                                                  PID:2836
                                                  • C:\Windows\system32\label.exe
                                                    label S: Locked By Zebra
                                                    3⤵
                                                    • Enumerates connected drives
                                                    PID:216
                                                • C:\Windows\System32\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /C label T: Locked By Zebra
                                                  2⤵
                                                    PID:228
                                                    • C:\Windows\system32\label.exe
                                                      label T: Locked By Zebra
                                                      3⤵
                                                      • Enumerates connected drives
                                                      PID:3036
                                                  • C:\Windows\System32\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /C label U: Locked By Zebra
                                                    2⤵
                                                      PID:2468
                                                      • C:\Windows\system32\label.exe
                                                        label U: Locked By Zebra
                                                        3⤵
                                                        • Enumerates connected drives
                                                        PID:2476
                                                    • C:\Windows\System32\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /C label V: Locked By Zebra
                                                      2⤵
                                                        PID:2956
                                                        • C:\Windows\system32\label.exe
                                                          label V: Locked By Zebra
                                                          3⤵
                                                          • Enumerates connected drives
                                                          PID:2728
                                                      • C:\Windows\System32\cmd.exe
                                                        "C:\Windows\System32\cmd.exe" /C label W: Locked By Zebra
                                                        2⤵
                                                          PID:936
                                                          • C:\Windows\system32\label.exe
                                                            label W: Locked By Zebra
                                                            3⤵
                                                            • Enumerates connected drives
                                                            PID:2548
                                                        • C:\Windows\System32\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" /C label X: Locked By Zebra
                                                          2⤵
                                                            PID:2156
                                                            • C:\Windows\system32\label.exe
                                                              label X: Locked By Zebra
                                                              3⤵
                                                              • Enumerates connected drives
                                                              PID:1984
                                                          • C:\Windows\System32\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /C label Y: Locked By Zebra
                                                            2⤵
                                                              PID:1312
                                                              • C:\Windows\system32\label.exe
                                                                label Y: Locked By Zebra
                                                                3⤵
                                                                • Enumerates connected drives
                                                                PID:1628
                                                            • C:\Windows\System32\cmd.exe
                                                              "C:\Windows\System32\cmd.exe" /C label Z: Locked By Zebra
                                                              2⤵
                                                                PID:1584
                                                                • C:\Windows\system32\label.exe
                                                                  label Z: Locked By Zebra
                                                                  3⤵
                                                                  • Enumerates connected drives
                                                                  PID:1780
                                                              • C:\Windows\system32\NOTEPAD.EXE
                                                                "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\!HELP FILES ENCRYPTED!.txt
                                                                2⤵
                                                                  PID:2352
                                                              • C:\Windows\system32\vssvc.exe
                                                                C:\Windows\system32\vssvc.exe
                                                                1⤵
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:2776
                                                              • C:\Windows\system32\wbengine.exe
                                                                "C:\Windows\system32\wbengine.exe"
                                                                1⤵
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:852
                                                              • C:\Windows\System32\vdsldr.exe
                                                                C:\Windows\System32\vdsldr.exe -Embedding
                                                                1⤵
                                                                  PID:2712
                                                                • C:\Windows\System32\vds.exe
                                                                  C:\Windows\System32\vds.exe
                                                                  1⤵
                                                                    PID:2796

                                                                  Network

                                                                  MITRE ATT&CK Enterprise v15

                                                                  Reconnaissance

                                                                  Resource Development

                                                                  Initial Access

                                                                  Execution

                                                                  Command and Scripting Interpreter

                                                                  2
                                                                  T1059

                                                                  Scheduled Task/Job

                                                                  1
                                                                  T1053

                                                                  Persistence

                                                                  Create or Modify System Process

                                                                  1
                                                                  T1543

                                                                  Windows Service

                                                                  1
                                                                  T1543.003

                                                                  Scheduled Task/Job

                                                                  1
                                                                  T1053

                                                                  Privilege Escalation

                                                                  Create or Modify System Process

                                                                  1
                                                                  T1543

                                                                  Windows Service

                                                                  1
                                                                  T1543.003

                                                                  Scheduled Task/Job

                                                                  1
                                                                  T1053

                                                                  Defense Evasion

                                                                  Hide Artifacts

                                                                  1
                                                                  T1564

                                                                  Hidden Files and Directories

                                                                  1
                                                                  T1564.001

                                                                  Impair Defenses

                                                                  1
                                                                  T1562

                                                                  Disable or Modify System Firewall

                                                                  1
                                                                  T1562.004

                                                                  Indicator Removal

                                                                  4
                                                                  T1070

                                                                  File Deletion

                                                                  4
                                                                  T1070.004

                                                                  Credential Access

                                                                  Unsecured Credentials

                                                                  1
                                                                  T1552

                                                                  Credentials In Files

                                                                  1
                                                                  T1552.001

                                                                  Discovery

                                                                  Peripheral Device Discovery

                                                                  1
                                                                  T1120

                                                                  Query Registry

                                                                  3
                                                                  T1012

                                                                  System Information Discovery

                                                                  3
                                                                  T1082

                                                                  Lateral Movement

                                                                  Collection

                                                                  Data from Local System

                                                                  1
                                                                  T1005

                                                                  Command and Control

                                                                  Exfiltration

                                                                  Impact

                                                                  Inhibit System Recovery

                                                                  5
                                                                  T1490

                                                                  Replay Monitor

                                                                  Loading Replay Monitor...

                                                                  Downloads

                                                                  • C:\!HELP FILES ENCRYPTED!.txt
                                                                    Filesize

                                                                    922B

                                                                    MD5

                                                                    76c36a2be8207db056ecd89b9b6df025

                                                                    SHA1

                                                                    5e86f6eda39e6b1b51bdd6deabdad40d450b4069

                                                                    SHA256

                                                                    624e9f317b2e9d231c9c983976e1e5eec6bae74e7ff9d84239bc2135ebaa1dff

                                                                    SHA512

                                                                    c842cbdf9378848934920595eed61f7def666659ea1e9810e746d83b814dec433d587940fadf34bbad7751b66ac96166f74db3443f781c0df6ec7acb42d0a1c0

                                                                    Download Submit
                                                                  • C:\$Recycle.Bin\S-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini
                                                                    Filesize

                                                                    463B

                                                                    MD5

                                                                    00aafdd13be543dcc56ca24ce4a9885c

                                                                    SHA1

                                                                    dbfa502217bbc3d4e15e9af3cf43841d224d009e

                                                                    SHA256

                                                                    65f2861f81879e6668ffb143f771b7df6ef8788c03eb53671d45996d49542c04

                                                                    SHA512

                                                                    647fcaf2a93b746cf77fe9db6782b29033c43c61e0a19a0a04ac0ed1cb5d32f9313270c96cc3693c8998ef6c3640f9b581131612c83dee899ca5462429244f22

                                                                    Download Submit
                                                                  • memory/3044-0-0x0000000000F80000-0x000000000107C000-memory.dmp
                                                                    Filesize

                                                                    1008KB

                                                                    Download
                                                                  • memory/3044-1-0x000007FEF61B0000-0x000007FEF6B9C000-memory.dmp
                                                                    Filesize

                                                                    9.9MB

                                                                    Download
                                                                  • memory/3044-2-0x0000000000530000-0x00000000005B0000-memory.dmp
                                                                    Filesize

                                                                    512KB

                                                                    Download
                                                                  • memory/3044-2188-0x000007FEF61B0000-0x000007FEF6B9C000-memory.dmp
                                                                    Filesize

                                                                    9.9MB

                                                                    Download
                                                                  • memory/3044-2609-0x0000000000530000-0x00000000005B0000-memory.dmp
                                                                    Filesize

                                                                    512KB

                                                                    Download