Analysis

  • max time kernel
    140s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    13/05/2024, 19:05

General

  • Target

    be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe

  • Size

    224KB

  • MD5

    5c7fb0927db37372da25f270708103a2

  • SHA1

    120ed9279d85cbfa56e5b7779ffa7162074f7a29

  • SHA256

    be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844

  • SHA512

    a15f97fad744ccf5f620e5aabb81f48507327b898a9aa4287051464019e0f89224c484e9691812e166471af9beaddcfc3deb2ba878658761f4800663beef7206

  • SSDEEP

    3072:Y059femWRwTs/dbelj0X8/j84pcRXPlU3Upt3or4H84lK8PtpLzLsR/EfcZ:+5RwTs/dSXj84mRXPemxdBlPvLzLeZ

Malware Config

Extracted

Path

C:\Users\Admin\Documents\!Please Read Me!.txt

Family

wannacry

Ransom Note
Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �
Wallets

15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 9 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Kills process with taskkill 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 47 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 56 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe
    "C:\Users\Admin\AppData\Local\Temp\be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe"
    1⤵
    • Drops startup file
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2136
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c 327021715627133.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2740
      • C:\Windows\SysWOW64\cscript.exe
        cscript //nologo c.vbs
        3⤵
        • Loads dropped DLL
        PID:2608
    • C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
      !WannaDecryptor!.exe f
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:2788
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im MSExchange*
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:448
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Microsoft.Exchange.*
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1072
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im sqlserver.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2100
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im sqlwriter.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1852
    • C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
      !WannaDecryptor!.exe c
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:976
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c start /b !WannaDecryptor!.exe v
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1920
      • C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
        !WannaDecryptor!.exe v
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2068
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2100
          • C:\Windows\SysWOW64\vssadmin.exe
            vssadmin delete shadows /all /quiet
            5⤵
            • Interacts with shadow copies
            PID:756
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            wmic shadowcopy delete
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2656
    • C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
      !WannaDecryptor!.exe
      2⤵
      • Executes dropped EXE
      • Sets desktop wallpaper using registry
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:1852
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2308

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe

          Filesize

          236KB

          MD5

          cf1416074cd7791ab80a18f9e7e219d9

          SHA1

          276d2ec82c518d887a8a3608e51c56fa28716ded

          SHA256

          78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df

          SHA512

          0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

        • C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe.lnk

          Filesize

          921B

          MD5

          d2b9bd1a81ab269a9c8a2d81d21d5dc4

          SHA1

          69df191d09ce2d5f028db56601a080c5edb0a34f

          SHA256

          af1ff9a33df5e90f35258c697e27f89358e09b685b7c491a79d9d41f4f17cf22

          SHA512

          da988e1972a0a81c51b115354b9454957465fd83d2a1102c7dadc046a27458d276a3082734bf6acd6a75b68de50587de0ee9de6baf2f55d00917f9ab76b21426

        • C:\Users\Admin\AppData\Local\Temp\00000000.res

          Filesize

          136B

          MD5

          8678a008701f7493cea0517523128650

          SHA1

          3fbdcb5b9d85ec1e4237d257db8fc6fdd6209bde

          SHA256

          2c87c5a9947cfcf2b0bbd673ad615e31f6cad5536542bbceceb1beb505e2329c

          SHA512

          661356f10154a0944342bc1cfc573d9e9167edaec95c0ec955ef1a6f975db1e6e9fe4ab0103244bf01f3ff9aacaba687e68a6480db862fdf410cb55c5b0acbc8

        • C:\Users\Admin\AppData\Local\Temp\00000000.res

          Filesize

          136B

          MD5

          33b3ffa64c04114249da34ec529902cd

          SHA1

          c688230f9fd710e86ffcaa3e84f184d0f253646b

          SHA256

          a456841a625282b52dae26b60cb3b5fadbcf5d562805be83c58d2a11bbb8eb8a

          SHA512

          1739f02bd6377b1fd8dc9c1a5735144f49526ffbcc18865e6deebd95b5b122b6de4ff8605a6e0894de086245f021c549c6c243829d9fc5b0766a23fa4e5956b9

        • C:\Users\Admin\AppData\Local\Temp\00000000.res

          Filesize

          136B

          MD5

          5d97b43435e931967b4bc814998e4b79

          SHA1

          1d865e555648e8d2c3a1d5393d07d747ff1d09c0

          SHA256

          98832cd3644b341a5fceb36e62d24985e2a7bacc101329513e53a35eef506b8e

          SHA512

          7a2f406b75783e8ef0c4c2adf536e9c2e58b40521581e8f8b02fd6a548a3c9b7523831864c24d13fa1deab69a82d4336a319c8d847e4a6bf98c098a62f270020

        • C:\Users\Admin\AppData\Local\Temp\327021715627133.bat

          Filesize

          336B

          MD5

          3540e056349c6972905dc9706cd49418

          SHA1

          492c20442d34d45a6d6790c720349b11ec591cde

          SHA256

          73872a89440a2cba9d22bf4961c3d499ea2c72979c30c455f942374292fedadc

          SHA512

          c949d147100aef59e382c03abf7b162ae62a4d43456eebd730fbedcf5f95f5e1a24f6e349690d52d75331878a6ee8f6b88a7162ee9cf2a49e142196b12d0133c

        • C:\Users\Admin\AppData\Local\Temp\c.vbs

          Filesize

          219B

          MD5

          5f6d40ca3c34b470113ed04d06a88ff4

          SHA1

          50629e7211ae43e32060686d6be17ebd492fd7aa

          SHA256

          0fb5039a2fe7e90cdf3f22140d7f2103f94689b15609efe0edcc8430dd772fc1

          SHA512

          4d4aa1abd2c9183202fd3f0a65b37f07ee0166ba6561f094c13c8ea59752c7bdd960e37c49583746d4464bc3b1dc0b63a1fe36a37ce7e5709cd76ed433befe35

        • C:\Users\Admin\AppData\Local\Temp\c.wry

          Filesize

          628B

          MD5

          9686db8adce9dd3976ed878b0a7bad34

          SHA1

          efabf373a90582f9a49e79710be09b2cfd69bccf

          SHA256

          8323ae137b2557a1c40ea8f1e48273832f4b150e2f38e7a091d5c7bba9172b75

          SHA512

          779ea2a490ba0c786f63899dfa92f934f1d52f3cc3f624e3e2ea2f92f1917f473bf047d54db6bdec45bcf8a446bce27b59d974a74090d3bb4b51a9302c233562

        • C:\Users\Admin\AppData\Local\Temp\m.wry

          Filesize

          42KB

          MD5

          980b08bac152aff3f9b0136b616affa5

          SHA1

          2a9c9601ea038f790cc29379c79407356a3d25a3

          SHA256

          402046ada270528c9ac38bbfa0152836fe30fb8e12192354e53b8397421430d9

          SHA512

          100cda1f795781042b012498afd783fd6ff03b0068dbd07b2c2e163cd95e6c6e00755ce16b02b017693c9febc149ed02df9df9b607e2b9cca4b07e5bd420f496

        • C:\Users\Admin\Documents\!Please Read Me!.txt

          Filesize

          797B

          MD5

          afa18cf4aa2660392111763fb93a8c3d

          SHA1

          c219a3654a5f41ce535a09f2a188a464c3f5baf5

          SHA256

          227082c719fd4394c1f2311a0877d8a302c5b092bcc49f853a5cf3d2945f42b0

          SHA512

          4161f250d59b7d4d4a6c4f16639d66d21b2a9606de956d22ec00bedb006643fedbbb8e4cde9f6c0c977285918648314883ca91f3442d1125593bf2605f2d5c6b

        • memory/2136-6-0x0000000010000000-0x0000000010012000-memory.dmp

          Filesize

          72KB