Overview

overview

10

Static

static

3

be22645c61...44.exe

windows7-x64

10

be22645c61...44.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    141s
  • max time network
    100s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/05/2024, 19:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe
  • Size 224KB
  • Sample240513-xp45jaag25
  • SHA256 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
wannacrydefense_evasionexecutionimpactpersistenceransomwarespywarestealerworm

Malware Config

Extracted

Path

  • C:\Users\Admin\AppData\Local\Temp\!Please Read Me!.txt

  • wannacry

Ransom Note
  • Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �
Wallets

  • 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Drops startup file 2 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Kills process with taskkill 4 IoCs
    evasion
  • Suspicious use of AdjustPrivilegeToken 49 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe
    "C:\Users\Admin\AppData\Local\Temp\be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2024
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 291941715626968.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4812
      • C:\Windows\SysWOW64\cscript.exe
        cscript //nologo c.vbs
        3⤵
          PID:3772
      • C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
        !WannaDecryptor!.exe f
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:4968
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /f /im MSExchange*
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2156
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /f /im Microsoft.Exchange.*
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4308
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /f /im sqlserver.exe
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4348
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /f /im sqlwriter.exe
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4904
      • C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
        !WannaDecryptor!.exe c
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:4496
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c start /b !WannaDecryptor!.exe v
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2592
        • C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
          !WannaDecryptor!.exe v
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3940
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1940
            • C:\Windows\SysWOW64\Wbem\WMIC.exe
              wmic shadowcopy delete
              5⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1268
      • C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
        !WannaDecryptor!.exe
        2⤵
        • Executes dropped EXE
        • Sets desktop wallpaper using registry
        • Suspicious use of SetWindowsHookEx
        PID:232
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:384

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          !Please Read Me!.txt
          • Path C:\Users\Admin\AppData\Local\Temp\!Please Read Me!.txt
          • Size 797B
          • SHA256 227082c719fd4394c1f2311a0877d8a302c5b092bcc49f853a5cf3d2945f42b0
          • MD5 SHA1 SHA512
          Submit Download

          !WannaDecryptor!.exe.lnk
          • Path C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe.lnk
          • Size 1KB
          • SHA256 19c62a66a37810ae2e42d908f9f59b0c4140688728ccb1781783e7bc9a2d12e4
          • MD5 SHA1 SHA512
          Submit Download

          00000000.res
          • Path C:\Users\Admin\AppData\Local\Temp\00000000.res
          • Size 136B
          • SHA256 e0b67479842b6081e1697e0aa593ab21036989aed82f8673246b789208a4446c
          • MD5 SHA1 SHA512
          Submit Download

          00000000.res
          • Path C:\Users\Admin\AppData\Local\Temp\00000000.res
          • Size 136B
          • SHA256 87766a6971a21b365a7f91cb9c4a83460dd47fa3572f8bb4e4cbe3c7e873a441
          • MD5 SHA1 SHA512
          Submit Download

          00000000.res
          • Path C:\Users\Admin\AppData\Local\Temp\00000000.res
          • Size 136B
          • SHA256 91f261f427eebc061e37cc40e84dea3caea17b198c7103911efa9dfeb667821a
          • MD5 SHA1 SHA512
          Submit Download

          291941715626968.bat
          • Path C:\Users\Admin\AppData\Local\Temp\291941715626968.bat
          • Size 336B
          • SHA256 73872a89440a2cba9d22bf4961c3d499ea2c72979c30c455f942374292fedadc
          • MD5 SHA1 SHA512
          Submit Download

          c.vbs
          • Path C:\Users\Admin\AppData\Local\Temp\c.vbs
          • Size 219B
          • SHA256 0fb5039a2fe7e90cdf3f22140d7f2103f94689b15609efe0edcc8430dd772fc1
          • MD5 SHA1 SHA512
          Submit Download

          c.wry
          • Path C:\Users\Admin\AppData\Local\Temp\c.wry
          • Size 628B
          • SHA256 62387a669dd2eaf59e40d27b3f5b5ab45e8d5d0087e8979b7a4fd04a51863a84
          • MD5 SHA1 SHA512
          Submit Download

          m.wry
          • Path C:\Users\Admin\AppData\Local\Temp\m.wry
          • Size 42KB
          • SHA256 402046ada270528c9ac38bbfa0152836fe30fb8e12192354e53b8397421430d9
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          u.wry
          • Path C:\Users\Admin\AppData\Local\Temp\u.wry
          • Size 236KB
          • SHA256 78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          memory/2024-6-0x0000000010000000-0x0000000010012000-memory.dmp
          Download