24d004a104d4d54034dbcffc2a4b19a11f39008a575aa614ea04703480b1022c

Resubmissions

09/07/2024, 00:43

240709-a2wmlaxcpj 4

09/07/2024, 00:37

09/07/2024, 00:35

09/07/2024, 00:32

05/07/2024, 08:57

11/12/2023, 16:03

Analysis

max time kernel
108s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 00:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

wncry_sample1.exe
Size

3.6MB
MD5

db349b97c37d22f5ea1d1841e3c89eb4
SHA1

e889544aff85ffaf8b0d0da705105dee7c97fe26
SHA256

24d004a104d4d54034dbcffc2a4b19a11f39008a575aa614ea04703480b1022c
SHA512

d6c60b8f22f89cbd1262c0aa7ae240577a82002fb149e9127d4edf775a25abcda4e585b6113e79ab4a24bb65f4280532529c2f06f7ffe4d5db45c0caf74fea38
SSDEEP

98304:wDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2g3R:wDqPe1Cxcxk3ZAEUadzR8yc4gB

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2753856825-3907105642-1818461144-1000_Classes\Local Settings	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-2753856825-3907105642-1818461144-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4840	mspaint.exe
4840	mspaint.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5000	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1476	firefox.exe
Token: SeDebugPrivilege	1476	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1476	firefox.exe
1476	firefox.exe
1476	firefox.exe
1476	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1476	firefox.exe
1476	firefox.exe
1476	firefox.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4840	mspaint.exe
5000	OpenWith.exe
1476	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4516 wrote to memory of 1476	4516	firefox.exe	102
PID 4516 wrote to memory of 1476	4516	firefox.exe	102
PID 4516 wrote to memory of 1476	4516	firefox.exe	102
PID 4516 wrote to memory of 1476	4516	firefox.exe	102
PID 4516 wrote to memory of 1476	4516	firefox.exe	102
PID 4516 wrote to memory of 1476	4516	firefox.exe	102
PID 4516 wrote to memory of 1476	4516	firefox.exe	102
PID 4516 wrote to memory of 1476	4516	firefox.exe	102
PID 4516 wrote to memory of 1476	4516	firefox.exe	102
PID 4516 wrote to memory of 1476	4516	firefox.exe	102
PID 4516 wrote to memory of 1476	4516	firefox.exe	102
PID 1476 wrote to memory of 3840	1476	firefox.exe	103
PID 1476 wrote to memory of 3840	1476	firefox.exe	103
PID 1476 wrote to memory of 3840	1476	firefox.exe	103
PID 1476 wrote to memory of 3840	1476	firefox.exe	103
PID 1476 wrote to memory of 3840	1476	firefox.exe	103
PID 1476 wrote to memory of 3840	1476	firefox.exe	103
PID 1476 wrote to memory of 3840	1476	firefox.exe	103
PID 1476 wrote to memory of 3840	1476	firefox.exe	103
PID 1476 wrote to memory of 3840	1476	firefox.exe	103
PID 1476 wrote to memory of 3840	1476	firefox.exe	103
PID 1476 wrote to memory of 3840	1476	firefox.exe	103
PID 1476 wrote to memory of 3840	1476	firefox.exe	103
PID 1476 wrote to memory of 3840	1476	firefox.exe	103
PID 1476 wrote to memory of 3840	1476	firefox.exe	103
PID 1476 wrote to memory of 3840	1476	firefox.exe	103
PID 1476 wrote to memory of 3840	1476	firefox.exe	103
PID 1476 wrote to memory of 3840	1476	firefox.exe	103
PID 1476 wrote to memory of 3840	1476	firefox.exe	103
PID 1476 wrote to memory of 3840	1476	firefox.exe	103
PID 1476 wrote to memory of 3840	1476	firefox.exe	103
PID 1476 wrote to memory of 3840	1476	firefox.exe	103
PID 1476 wrote to memory of 3840	1476	firefox.exe	103
PID 1476 wrote to memory of 3840	1476	firefox.exe	103
PID 1476 wrote to memory of 3840	1476	firefox.exe	103
PID 1476 wrote to memory of 3840	1476	firefox.exe	103
PID 1476 wrote to memory of 3840	1476	firefox.exe	103
PID 1476 wrote to memory of 3840	1476	firefox.exe	103
PID 1476 wrote to memory of 3840	1476	firefox.exe	103
PID 1476 wrote to memory of 3840	1476	firefox.exe	103
PID 1476 wrote to memory of 3840	1476	firefox.exe	103
PID 1476 wrote to memory of 3840	1476	firefox.exe	103
PID 1476 wrote to memory of 3840	1476	firefox.exe	103
PID 1476 wrote to memory of 3840	1476	firefox.exe	103
PID 1476 wrote to memory of 3840	1476	firefox.exe	103
PID 1476 wrote to memory of 3840	1476	firefox.exe	103
PID 1476 wrote to memory of 3840	1476	firefox.exe	103
PID 1476 wrote to memory of 3840	1476	firefox.exe	103
PID 1476 wrote to memory of 3840	1476	firefox.exe	103
PID 1476 wrote to memory of 3840	1476	firefox.exe	103
PID 1476 wrote to memory of 3840	1476	firefox.exe	103
PID 1476 wrote to memory of 3840	1476	firefox.exe	103
PID 1476 wrote to memory of 3840	1476	firefox.exe	103
PID 1476 wrote to memory of 3840	1476	firefox.exe	103
PID 1476 wrote to memory of 1580	1476	firefox.exe	104
PID 1476 wrote to memory of 1580	1476	firefox.exe	104
PID 1476 wrote to memory of 1580	1476	firefox.exe	104
PID 1476 wrote to memory of 1580	1476	firefox.exe	104
PID 1476 wrote to memory of 1580	1476	firefox.exe	104
PID 1476 wrote to memory of 1580	1476	firefox.exe	104
PID 1476 wrote to memory of 1580	1476	firefox.exe	104
PID 1476 wrote to memory of 1580	1476	firefox.exe	104
PID 1476 wrote to memory of 1580	1476	firefox.exe	104
PID 1476 wrote to memory of 1580	1476	firefox.exe	104

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\wncry_sample1.exe
"C:\Users\Admin\AppData\Local\Temp\wncry_sample1.exe"
1⤵
PID:5036

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\RestartSplit.jpe" /ForceBootstrapPaint3D
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4840

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
1⤵
- Drops file in System32 directory
PID:4952

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5000

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2028

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1476
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1476.0.2012012404\210922854" -parentBuildID 20230214051806 -prefsHandle 1820 -prefMapHandle 1812 -prefsLen 22076 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a3d5b3a0-7564-4a26-9ec6-298b8902d93b} 1476 "\\.\pipe\gecko-crash-server-pipe.1476" 1900 244e0526b58 gpu
    3⤵
    PID:3840
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1476.1.1081956463\425331163" -parentBuildID 20230214051806 -prefsHandle 2440 -prefMapHandle 2436 -prefsLen 22112 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {87d91891-62ad-4f33-8746-b3251e48dbef} 1476 "\\.\pipe\gecko-crash-server-pipe.1476" 2468 244d3787b58 socket
    3⤵
    PID:1580
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1476.2.1744054060\1675349793" -childID 1 -isForBrowser -prefsHandle 2816 -prefMapHandle 2804 -prefsLen 22215 -prefMapSize 235121 -jsInitHandle 1264 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6b36e8df-18e1-4d27-a6df-283ef8cf3d2b} 1476 "\\.\pipe\gecko-crash-server-pipe.1476" 3132 244e2dead58 tab
    3⤵
    PID:4232
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1476.3.309625606\1159023063" -childID 2 -isForBrowser -prefsHandle 4148 -prefMapHandle 4144 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1264 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5f544ce8-d703-4c8c-94fa-b32de2ad2d0a} 1476 "\\.\pipe\gecko-crash-server-pipe.1476" 4156 244d373ee58 tab
    3⤵
    PID:1776
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1476.4.2119009465\445628563" -childID 3 -isForBrowser -prefsHandle 4796 -prefMapHandle 4056 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1264 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {665dadb6-4970-4293-8577-477754149674} 1476 "\\.\pipe\gecko-crash-server-pipe.1476" 4808 244e6374558 tab
    3⤵
    PID:4488
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1476.5.219091569\788686116" -childID 4 -isForBrowser -prefsHandle 5004 -prefMapHandle 5008 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1264 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {43711d62-abba-499f-b223-9616b4658f1f} 1476 "\\.\pipe\gecko-crash-server-pipe.1476" 4056 244e6d70258 tab
    3⤵
    PID:2288
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1476.6.1602878958\1767978248" -childID 5 -isForBrowser -prefsHandle 5052 -prefMapHandle 4792 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1264 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b3288d9a-6e13-4f6d-a64b-57d04c449b7d} 1476 "\\.\pipe\gecko-crash-server-pipe.1476" 5168 244e6d6e758 tab
    3⤵
    PID:4372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\caju9pwo.default-release\activity-stream.discovery_stream.json.tmp

Filesize
23KB

MD5
5171624a83f481b3fab5ba4d7e0b8a1b

SHA1
adbb3c30b2964752605d1a16202695ae01d3413f

SHA256
789e1f66ab83b94274eec0aa8bcb98e092bf15464f21f367f247a07ee06143cc

SHA512
b1da0a230c848723870d3b6d8e600cbed3ae1fceabba0a14cc9350e535a387aa8a8c8db61e63710c5ded6c0fad4809ddf0e449d3e57985e7bc9e3859a24a5a53

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\caju9pwo.default-release\activity-stream.discovery_stream.json.tmp

Filesize
23KB

MD5
901a147592c08ae8f0a7d8f36245b27d

SHA1
d000e98b765e145921b9104cf0a06340b6e4ef9b

SHA256
1673012b9ef5e97b93ddc772f54ae1a313c9766200559d98eb5301d30837976b

SHA512
b63f3fe6c5c431463e64132445ed32a537ef37e0039835c3c2690bc18bd862ac927844a6bf03efa2bbc2d45c3ec6174ab248c45c45fbc9ec80a6a6043d902a34

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\caju9pwo.default-release\prefs.js

Filesize
7KB

MD5
8473486a170196bc1f96fec0f5bff92b

SHA1
b66c02641f8e021cc676d9a2d7894a1e0acf91b9

SHA256
564dfd83d8bfc1390bf6db954a0b9c84c0cb201bc0d0e4af05ae4a23e7c4d5a6

SHA512
4d530faab2ad04ab140af230cbd73dd5146ddae01ee7483f807b76cc635b7cd2c7045134f0d821eaa659882d5d11acf7a2fbddb3064255689579248b8d0744f2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\caju9pwo.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
1cba396ae6b2506abde61134d8cfc01e

SHA1
55a0d01aabbac7c887b4fc4d996aa408df251c12

SHA256
efefa233452b88756074ff0acf75083cdf49e48f5f5f7a414173e17a5ff8600c

SHA512
54e13ae27a57cac345b34695a793b7ef0dab7c10f549ced0491e81aebac654cfee212ec47c7248d73dac3f35fdba4d0a6ac096a1cd9eb8d6303dd552e695a8f2

Download Submit
memory/4952-13-0x000002C9ED040000-0x000002C9ED041000-memory.dmp

Filesize
4KB

Download
memory/4952-16-0x000002C9ED0D0000-0x000002C9ED0D1000-memory.dmp

Filesize
4KB

Download
memory/4952-17-0x000002C9ED0D0000-0x000002C9ED0D1000-memory.dmp

Filesize
4KB

Download
memory/4952-18-0x000002C9ED0E0000-0x000002C9ED0E1000-memory.dmp

Filesize
4KB

Download
memory/4952-19-0x000002C9ED0E0000-0x000002C9ED0E1000-memory.dmp

Filesize
4KB

Download
memory/4952-15-0x000002C9ED040000-0x000002C9ED041000-memory.dmp

Filesize
4KB

Download
memory/4952-4-0x000002C9E4370000-0x000002C9E4380000-memory.dmp

Filesize
64KB

Download
memory/4952-11-0x000002C9ECFC0000-0x000002C9ECFC1000-memory.dmp

Filesize
4KB

Download
memory/4952-0-0x000002C9E4330000-0x000002C9E4340000-memory.dmp

Filesize
64KB

Download