Analysis

  • max time kernel
    144s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-05-2024 13:33

General

  • Target

    Ransomware.WannaCrypt0r.v1.exe

  • Size

    224KB

  • MD5

    5c7fb0927db37372da25f270708103a2

  • SHA1

    120ed9279d85cbfa56e5b7779ffa7162074f7a29

  • SHA256

    be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844

  • SHA512

    a15f97fad744ccf5f620e5aabb81f48507327b898a9aa4287051464019e0f89224c484e9691812e166471af9beaddcfc3deb2ba878658761f4800663beef7206

  • SSDEEP

    3072:Y059femWRwTs/dbelj0X8/j84pcRXPlU3Upt3or4H84lK8PtpLzLsR/EfcZ:+5RwTs/dSXj84mRXPemxdBlPvLzLeZ

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\!Please Read Me!.txt

Family

wannacry

Ransom Note
Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �
Wallets

15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Kills process with taskkill 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 49 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Ransomware.WannaCrypt0r.v1.exe
    "C:\Users\Admin\AppData\Local\Temp\Ransomware.WannaCrypt0r.v1.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2740
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 195101716212027.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2028
      • C:\Windows\SysWOW64\cscript.exe
        cscript //nologo c.vbs
        3⤵
          PID:2928
      • C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
        !WannaDecryptor!.exe f
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:3692
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /f /im MSExchange*
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3220
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /f /im Microsoft.Exchange.*
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3708
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /f /im sqlserver.exe
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4456
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /f /im sqlwriter.exe
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2432
      • C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
        !WannaDecryptor!.exe c
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1248
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c start /b !WannaDecryptor!.exe v
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2036
        • C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
          !WannaDecryptor!.exe v
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2304
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:4356
            • C:\Windows\SysWOW64\Wbem\WMIC.exe
              wmic shadowcopy delete
              5⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:3656
      • C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
        !WannaDecryptor!.exe
        2⤵
        • Executes dropped EXE
        • Sets desktop wallpaper using registry
        • Suspicious use of SetWindowsHookEx
        PID:2452
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4612,i,16710585221322798697,8586257254049248207,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:8
      1⤵
        PID:3224
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4392

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\!Please Read Me!.txt

        Filesize

        797B

        MD5

        afa18cf4aa2660392111763fb93a8c3d

        SHA1

        c219a3654a5f41ce535a09f2a188a464c3f5baf5

        SHA256

        227082c719fd4394c1f2311a0877d8a302c5b092bcc49f853a5cf3d2945f42b0

        SHA512

        4161f250d59b7d4d4a6c4f16639d66d21b2a9606de956d22ec00bedb006643fedbbb8e4cde9f6c0c977285918648314883ca91f3442d1125593bf2605f2d5c6b

      • C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe.lnk

        Filesize

        1KB

        MD5

        3357134959ef9dfd0f9c9ff2881be928

        SHA1

        b68a8f2b41712eed0da67ffaf18c2e2b12c0af14

        SHA256

        a74f12ee79c4cc284ecf5003470e1bb22921f1debd972531c23ec1131d3995a0

        SHA512

        ec39d95bd9fdac7b4745f2e722c8e49eaddd117e3b1ebf9f4025af6bef85896b39dac8777815c50181d60c5409c9de9b4ab5bc79b3e29fd412c73861d7da3e5f

      • C:\Users\Admin\AppData\Local\Temp\00000000.res

        Filesize

        136B

        MD5

        806f22e364cf36a6fd4edd7cfa98a185

        SHA1

        9d6056e12264eea2e0ee84b08a3938e6224210c1

        SHA256

        1f757f557bcf2c772e7288e0212b9baef11deaa4d81003a63a48d6cf167da9a3

        SHA512

        0bb3bedc176b8ed0bdf354a1e23f7ca845d2b1be34c87a725b7aadefaa2b64cdaff6b7a908d9f0c3802a471701684df74953925d9d97a251a1e69689ffd37f3f

      • C:\Users\Admin\AppData\Local\Temp\00000000.res

        Filesize

        136B

        MD5

        8c26b5d07448e4e9ab85904e388feffe

        SHA1

        ca3be861a057fbd764224103766e236c3109354c

        SHA256

        b57bcd37d09b0ef69797237462aad57230a23c40c8b2ef35b8ad2dfe4e7ad86b

        SHA512

        5d6e11af37e6064d05d5c73681c7f66e9248a38287c6611a2729b1da15b81ff00df0070f6a486b712d13667bed84038ddd5658b95f265c3f0891dd695dba0656

      • C:\Users\Admin\AppData\Local\Temp\00000000.res

        Filesize

        136B

        MD5

        82263c02c6ab2c579660ba4dce9c335a

        SHA1

        3eeb25000ad3b948f424e3341ed27bf12ec51607

        SHA256

        7038dec8669ef109ce920d0caa244a20672efea54f70e5d4629c8745da89e9c2

        SHA512

        3b164fe0a410904771b0c068efb60d4fd68ca6bc929a8d80e3b294638841e98b26cdae5f6156c8825314ed9089e2c02cc683120e711f86b118fcc530a3c9606b

      • C:\Users\Admin\AppData\Local\Temp\195101716212027.bat

        Filesize

        336B

        MD5

        3540e056349c6972905dc9706cd49418

        SHA1

        492c20442d34d45a6d6790c720349b11ec591cde

        SHA256

        73872a89440a2cba9d22bf4961c3d499ea2c72979c30c455f942374292fedadc

        SHA512

        c949d147100aef59e382c03abf7b162ae62a4d43456eebd730fbedcf5f95f5e1a24f6e349690d52d75331878a6ee8f6b88a7162ee9cf2a49e142196b12d0133c

      • C:\Users\Admin\AppData\Local\Temp\c.vbs

        Filesize

        219B

        MD5

        5f6d40ca3c34b470113ed04d06a88ff4

        SHA1

        50629e7211ae43e32060686d6be17ebd492fd7aa

        SHA256

        0fb5039a2fe7e90cdf3f22140d7f2103f94689b15609efe0edcc8430dd772fc1

        SHA512

        4d4aa1abd2c9183202fd3f0a65b37f07ee0166ba6561f094c13c8ea59752c7bdd960e37c49583746d4464bc3b1dc0b63a1fe36a37ce7e5709cd76ed433befe35

      • C:\Users\Admin\AppData\Local\Temp\c.wry

        Filesize

        628B

        MD5

        941f8104d1b4fb61b6916c831eb13634

        SHA1

        a469fdb610d9407716ca8c57ede410ff6e0f346e

        SHA256

        99ff58fe067021cf29ad1ae23ed13d36bd68d0b7c214fa8904e592b0ccccaf31

        SHA512

        f61af008d225e96f8007533897b4a4968aa04f2abe28b58db7b4653d5b9d2850eefcac34de31d5d9ddb30a2195a6767b29799b2e01bf4324d6d4d42fad078240

      • C:\Users\Admin\AppData\Local\Temp\m.wry

        Filesize

        42KB

        MD5

        980b08bac152aff3f9b0136b616affa5

        SHA1

        2a9c9601ea038f790cc29379c79407356a3d25a3

        SHA256

        402046ada270528c9ac38bbfa0152836fe30fb8e12192354e53b8397421430d9

        SHA512

        100cda1f795781042b012498afd783fd6ff03b0068dbd07b2c2e163cd95e6c6e00755ce16b02b017693c9febc149ed02df9df9b607e2b9cca4b07e5bd420f496

      • C:\Users\Admin\AppData\Local\Temp\u.wry

        Filesize

        236KB

        MD5

        cf1416074cd7791ab80a18f9e7e219d9

        SHA1

        276d2ec82c518d887a8a3608e51c56fa28716ded

        SHA256

        78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df

        SHA512

        0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

      • memory/2740-9-0x0000000010000000-0x0000000010012000-memory.dmp

        Filesize

        72KB