Analysis
- max time kernel
141s - max time network
131s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
11/05/2024, 03:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe
Resource
win7-20240221-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe
- Size 224KB
- Sample240511-dmdp1scf49
- SHA256 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844
- MD5 5c7fb0927db37372da25f270708103a2
- SHA1 120ed9279d85cbfa56e5b7779ffa7162074f7a29
- SHA512 a15f97fad744ccf5f620e5aabb81f48507327b898a9aa4287051464019e0f89224c484e9691812e166471af9beaddcfc3deb2ba878658761f4800663beef7206
- SSDEEP 3072:Y059femWRwTs/dbelj0X8/j84pcRXPlU3Upt3or4H84lK8PtpLzLsR/EfcZ:+5RwTs/dSXj84mRXPemxdBlPvLzLeZ
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Path
-
C:\Users\Admin\AppData\Local\Temp\!Please Read Me!.txt
-
wannacry
Ransom Note
- Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �
Wallets
-
15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1
Signatures
- Wannacry
WannaCry is a ransomware cryptoworm.
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD651E.tmp be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD6534.tmp be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe - Executes dropped EXE 4 IoCs
pid Process 1900 !WannaDecryptor!.exe 408 !WannaDecryptor!.exe 2296 !WannaDecryptor!.exe 4532 !WannaDecryptor!.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Update Task Scheduler = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\" /r" be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\!WannaCryptor!.bmp" !WannaDecryptor!.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Kills process with taskkill 4 IoCs
pid Process 1152 taskkill.exe 3212 taskkill.exe 3628 taskkill.exe 3616 taskkill.exe - Suspicious use of AdjustPrivilegeToken 49 IoCs
description pid Process Token: SeDebugPrivilege 3212 taskkill.exe Token: SeDebugPrivilege 1152 taskkill.exe Token: SeDebugPrivilege 3628 taskkill.exe Token: SeDebugPrivilege 3616 taskkill.exe Token: SeIncreaseQuotaPrivilege 2748 WMIC.exe Token: SeSecurityPrivilege 2748 WMIC.exe Token: SeTakeOwnershipPrivilege 2748 WMIC.exe Token: SeLoadDriverPrivilege 2748 WMIC.exe Token: SeSystemProfilePrivilege 2748 WMIC.exe Token: SeSystemtimePrivilege 2748 WMIC.exe Token: SeProfSingleProcessPrivilege 2748 WMIC.exe Token: SeIncBasePriorityPrivilege 2748 WMIC.exe Token: SeCreatePagefilePrivilege 2748 WMIC.exe Token: SeBackupPrivilege 2748 WMIC.exe Token: SeRestorePrivilege 2748 WMIC.exe Token: SeShutdownPrivilege 2748 WMIC.exe Token: SeDebugPrivilege 2748 WMIC.exe Token: SeSystemEnvironmentPrivilege 2748 WMIC.exe Token: SeRemoteShutdownPrivilege 2748 WMIC.exe Token: SeUndockPrivilege 2748 WMIC.exe Token: SeManageVolumePrivilege 2748 WMIC.exe Token: 33 2748 WMIC.exe Token: 34 2748 WMIC.exe Token: 35 2748 WMIC.exe Token: 36 2748 WMIC.exe Token: SeIncreaseQuotaPrivilege 2748 WMIC.exe Token: SeSecurityPrivilege 2748 WMIC.exe Token: SeTakeOwnershipPrivilege 2748 WMIC.exe Token: SeLoadDriverPrivilege 2748 WMIC.exe Token: SeSystemProfilePrivilege 2748 WMIC.exe Token: SeSystemtimePrivilege 2748 WMIC.exe Token: SeProfSingleProcessPrivilege 2748 WMIC.exe Token: SeIncBasePriorityPrivilege 2748 WMIC.exe Token: SeCreatePagefilePrivilege 2748 WMIC.exe Token: SeBackupPrivilege 2748 WMIC.exe Token: SeRestorePrivilege 2748 WMIC.exe Token: SeShutdownPrivilege 2748 WMIC.exe Token: SeDebugPrivilege 2748 WMIC.exe Token: SeSystemEnvironmentPrivilege 2748 WMIC.exe Token: SeRemoteShutdownPrivilege 2748 WMIC.exe Token: SeUndockPrivilege 2748 WMIC.exe Token: SeManageVolumePrivilege 2748 WMIC.exe Token: 33 2748 WMIC.exe Token: 34 2748 WMIC.exe Token: 35 2748 WMIC.exe Token: 36 2748 WMIC.exe Token: SeBackupPrivilege 1156 vssvc.exe Token: SeRestorePrivilege 1156 vssvc.exe Token: SeAuditPrivilege 1156 vssvc.exe - Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 1900 !WannaDecryptor!.exe 1900 !WannaDecryptor!.exe 408 !WannaDecryptor!.exe 408 !WannaDecryptor!.exe 2296 !WannaDecryptor!.exe 2296 !WannaDecryptor!.exe 4532 !WannaDecryptor!.exe 4532 !WannaDecryptor!.exe - Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 4840 wrote to memory of 4416 4840 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 83 PID 4840 wrote to memory of 4416 4840 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 83 PID 4840 wrote to memory of 4416 4840 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 83 PID 4416 wrote to memory of 1592 4416 cmd.exe 85 PID 4416 wrote to memory of 1592 4416 cmd.exe 85 PID 4416 wrote to memory of 1592 4416 cmd.exe 85 PID 4840 wrote to memory of 1900 4840 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 88 PID 4840 wrote to memory of 1900 4840 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 88 PID 4840 wrote to memory of 1900 4840 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 88 PID 4840 wrote to memory of 1152 4840 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 91 PID 4840 wrote to memory of 1152 4840 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 91 PID 4840 wrote to memory of 1152 4840 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 91 PID 4840 wrote to memory of 3212 4840 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 92 PID 4840 wrote to memory of 3212 4840 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 92 PID 4840 wrote to memory of 3212 4840 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 92 PID 4840 wrote to memory of 3628 4840 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 93 PID 4840 wrote to memory of 3628 4840 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 93 PID 4840 wrote to memory of 3628 4840 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 93 PID 4840 wrote to memory of 3616 4840 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 94 PID 4840 wrote to memory of 3616 4840 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 94 PID 4840 wrote to memory of 3616 4840 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 94 PID 4840 wrote to memory of 408 4840 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 105 PID 4840 wrote to memory of 408 4840 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 105 PID 4840 wrote to memory of 408 4840 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 105 PID 4840 wrote to memory of 1100 4840 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 106 PID 4840 wrote to memory of 1100 4840 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 106 PID 4840 wrote to memory of 1100 4840 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 106 PID 1100 wrote to memory of 2296 1100 cmd.exe 108 PID 1100 wrote to memory of 2296 1100 cmd.exe 108 PID 1100 wrote to memory of 2296 1100 cmd.exe 108 PID 4840 wrote to memory of 4532 4840 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 110 PID 4840 wrote to memory of 4532 4840 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 110 PID 4840 wrote to memory of 4532 4840 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe 110 PID 2296 wrote to memory of 1128 2296 !WannaDecryptor!.exe 111 PID 2296 wrote to memory of 1128 2296 !WannaDecryptor!.exe 111 PID 2296 wrote to memory of 1128 2296 !WannaDecryptor!.exe 111 PID 1128 wrote to memory of 2748 1128 cmd.exe 113 PID 1128 wrote to memory of 2748 1128 cmd.exe 113 PID 1128 wrote to memory of 2748 1128 cmd.exe 113 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe"C:\Users\Admin\AppData\Local\Temp\be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 221531715396846.bat2⤵
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Windows\SysWOW64\cscript.execscript //nologo c.vbs3⤵PID:1592
-
-
-
C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe!WannaDecryptor!.exe f2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1900
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im MSExchange*2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1152
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Microsoft.Exchange.*2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3212
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im sqlserver.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3628
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im sqlwriter.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3616
-
-
C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe!WannaDecryptor!.exe c2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:408
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start /b !WannaDecryptor!.exe v2⤵
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe!WannaDecryptor!.exe v3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet4⤵
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete5⤵
- Suspicious use of AdjustPrivilegeToken
PID:2748
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe!WannaDecryptor!.exe2⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Suspicious use of SetWindowsHookEx
PID:4532
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1156
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\!Please Read Me!.txt
- Size 797B
- SHA256 227082c719fd4394c1f2311a0877d8a302c5b092bcc49f853a5cf3d2945f42b0
- MD5 afa18cf4aa2660392111763fb93a8c3d
- SHA1 c219a3654a5f41ce535a09f2a188a464c3f5baf5
- SHA512 4161f250d59b7d4d4a6c4f16639d66d21b2a9606de956d22ec00bedb006643fedbbb8e4cde9f6c0c977285918648314883ca91f3442d1125593bf2605f2d5c6b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe.lnk
- Size 1KB
- SHA256 a65425ee001ee743a31847db0117aa75664b6fd6458bcb747386abd294b9ba9e
- MD5 b0d616a9babcfcb504f03a0ac70fc664
- SHA1 70cc1d29c0cdbe319e8f190270ea7c31300c24e8
- SHA512 1be14e2f069eae9fb45e7216ff65d35464ef32357014bd88879ae703d6f946df35dc498d94506386058b936327c2c81b512c80a3d11a77ea60e1580a2f53e421
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\00000000.res
- Size 136B
- SHA256 958a708b7812bd8bf53fb5df2eea3c814a3f07de2d23eafb08261eaf70e87f66
- MD5 adb9894013eb63ed5482ce606b8abddc
- SHA1 cce6dadd9f690544232b65767334a086b0716701
- SHA512 ea73af63005fe42df99c004ac60be31791c0b62654f3f3802410767aa7f6eaa4e12a3a3a0c260f059f0888cefe81621116ea8c2d2272f284b1e6c7062e829c42
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\00000000.res
- Size 136B
- SHA256 51efbb330d59647e00f1b553ec4922e87df7e5c1d506257af2c207e3d9aee8f4
- MD5 58efae7b2ae6d2f5068373558e88a87d
- SHA1 e0254d7ecadf398832d763b4cd58a5fe3afaea76
- SHA512 50ec2fc6f726f188d94e31598240b0d46f454c46fd094cb3ccee4a92b77e9b703f3b8fbc8e245e82b77cd6201bd58463b2508a928d4c82e31375494a3c63e832
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\00000000.res
- Size 136B
- SHA256 1f7ca5f987be50c1172552de18085ab31518edca50a48d0c3596541807dbc741
- MD5 452faad755e7ded4b7522fc27b80434e
- SHA1 4a8b3305e6ddbfd51002eda8f5ec27d7ce873cd3
- SHA512 6c6b374cbf6573c65e0971cac0e34304c5e4f2043ff842b6af5c18ee6295fbeb02fc3512bf519133b7ef7f0bf85573f7abad7b3c275708e3a904c2345148a619
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\221531715396846.bat
- Size 336B
- SHA256 73872a89440a2cba9d22bf4961c3d499ea2c72979c30c455f942374292fedadc
- MD5 3540e056349c6972905dc9706cd49418
- SHA1 492c20442d34d45a6d6790c720349b11ec591cde
- SHA512 c949d147100aef59e382c03abf7b162ae62a4d43456eebd730fbedcf5f95f5e1a24f6e349690d52d75331878a6ee8f6b88a7162ee9cf2a49e142196b12d0133c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\c.vbs
- Size 219B
- SHA256 0fb5039a2fe7e90cdf3f22140d7f2103f94689b15609efe0edcc8430dd772fc1
- MD5 5f6d40ca3c34b470113ed04d06a88ff4
- SHA1 50629e7211ae43e32060686d6be17ebd492fd7aa
- SHA512 4d4aa1abd2c9183202fd3f0a65b37f07ee0166ba6561f094c13c8ea59752c7bdd960e37c49583746d4464bc3b1dc0b63a1fe36a37ce7e5709cd76ed433befe35
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\c.wry
- Size 628B
- SHA256 6026ed2f18e689a31b9f78530473960ee99dada40cc5d7e54bae7180e4fcfbc7
- MD5 db561dfd894a6cd1e71be0da7b13447c
- SHA1 d6bab08ecff2836229ce3c032b7e97ad5ffc65bb
- SHA512 297936e33f9e33d87884988d1b995c3b76b0455caeb6dd4594ae4a62077a4bf2d04f16390e1c5650fe77531e9138a3167a4c523277f6c34fb56b04c4bc49ce7f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\m.wry
- Size 42KB
- SHA256 402046ada270528c9ac38bbfa0152836fe30fb8e12192354e53b8397421430d9
- MD5 980b08bac152aff3f9b0136b616affa5
- SHA1 2a9c9601ea038f790cc29379c79407356a3d25a3
- SHA512 100cda1f795781042b012498afd783fd6ff03b0068dbd07b2c2e163cd95e6c6e00755ce16b02b017693c9febc149ed02df9df9b607e2b9cca4b07e5bd420f496
- SSDEEP 384:S9sLTK3SWTsPzy3EFejoJQBO21z4oCTeo75Y3kmA31dv61QyU:S9s3mjoJb21zZrS14I
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\u.wry
- Size 236KB
- SHA256 78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
- MD5 cf1416074cd7791ab80a18f9e7e219d9
- SHA1 276d2ec82c518d887a8a3608e51c56fa28716ded
- SHA512 0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5
- SSDEEP 3072:KeJJ0eIVAnbWOECR+uJ/0EJzBelG4t1nXFnQamKNQHFZde5tHEGaa:bqrVOEgZJcYelG4tQamKN2ex
- MD5 SHA1 SHA512 SSDEEP