Resubmissions

25-09-2024 15:36

240925-s16qaawfqc 10

25-09-2024 15:33

240925-sza7zswerd 10

Analysis

  • max time kernel
    39s
  • max time network
    40s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-09-2024 15:36

General

  • Target

    01ce2c3c8448bae948c37ceeb6e9631805055738b5b94b22dfa8a005ece895c4.exe

  • Size

    224KB

  • MD5

    75031983cb851f3475c460a40797fe62

  • SHA1

    4ee0238f082123aeb7642ea2e427f57cf4ee954a

  • SHA256

    01ce2c3c8448bae948c37ceeb6e9631805055738b5b94b22dfa8a005ece895c4

  • SHA512

    635b72c7fb8d8b3818364a8a239941d4b4ec608f3d87ee966ce6abd599b847f2aee1e895d996391a1802a57afb41127fbc5e87020b5b280aca2066039e94ca36

  • SSDEEP

    3072:Y059femWRwTs/dbelj0X8/j84pcRXPlU3Upt3or4H84lK8PtpLzLsR/Efc:+5RwTs/dSXj84mRXPemxdBlPvLzLe

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\!Please Read Me!.txt

Family

wannacry

Ransom Note
Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �
Wallets

15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Kills process with taskkill 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 49 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\01ce2c3c8448bae948c37ceeb6e9631805055738b5b94b22dfa8a005ece895c4.exe
    "C:\Users\Admin\AppData\Local\Temp\01ce2c3c8448bae948c37ceeb6e9631805055738b5b94b22dfa8a005ece895c4.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2444
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 265431727278621.bat
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:744
      • C:\Windows\SysWOW64\cscript.exe
        cscript //nologo c.vbs
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3292
    • C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
      !WannaDecryptor!.exe f
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2236
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im MSExchange*
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:4952
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Microsoft.Exchange.*
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:4700
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im sqlserver.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:4680
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im sqlwriter.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:4960
    • C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
      !WannaDecryptor!.exe c
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:3328
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c start /b !WannaDecryptor!.exe v
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1160
      • C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
        !WannaDecryptor!.exe v
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4980
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4412
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            wmic shadowcopy delete
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:1536
    • C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
      !WannaDecryptor!.exe
      2⤵
      • Executes dropped EXE
      • Sets desktop wallpaper using registry
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2968
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4444,i,1330210614411927383,9239043499051775691,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:8
    1⤵
      PID:2216
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4748

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\!Please Read Me!.txt

      Filesize

      797B

      MD5

      afa18cf4aa2660392111763fb93a8c3d

      SHA1

      c219a3654a5f41ce535a09f2a188a464c3f5baf5

      SHA256

      227082c719fd4394c1f2311a0877d8a302c5b092bcc49f853a5cf3d2945f42b0

      SHA512

      4161f250d59b7d4d4a6c4f16639d66d21b2a9606de956d22ec00bedb006643fedbbb8e4cde9f6c0c977285918648314883ca91f3442d1125593bf2605f2d5c6b

    • C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe.lnk

      Filesize

      1KB

      MD5

      75b54ee8b93e7672acb64989ba038617

      SHA1

      e88d6446e2699f8fa196b0fabdb88c20ab016945

      SHA256

      5b978229145d2c21b3a102c6cd30ad360e33dabfce6dbdb7e0fca87f67aa0b92

      SHA512

      0954c0ff585f535377ea5cc26df659905a1541ceea9dc79c3eb415aee8ab0d04f45fed644e203a80933d94ed6ae65e3c906de47047318b959b0eb3ab6d2defb9

    • C:\Users\Admin\AppData\Local\Temp\00000000.res

      Filesize

      136B

      MD5

      0200413ce1920c94f4fc71ac9ca4f098

      SHA1

      173f76e2c42813ad49eca8c7d8324b8ba66d1b69

      SHA256

      8cddb250fdb56f2b3e7b8d0165c102a881d08c718deb3be37df56c14220e2d22

      SHA512

      24d23acc2cdbdd5581d38073db736eb7c29f859a111e2fac1267ef265cb610a16ce7833ee6c2153f50b43d41e10ff7c7ec5dedacfa9e3a125ec760023ec14db7

    • C:\Users\Admin\AppData\Local\Temp\00000000.res

      Filesize

      136B

      MD5

      c3c5cc09a7378e97339e62c008bf6ad6

      SHA1

      8827d1208280160025d6307b22999fc53da78cb2

      SHA256

      e052ca9da66d7bb94ae3fb29ea33aba3cbeba7cb7fff428d95730b497de66145

      SHA512

      9dbb611596c5d50370073a0a4c1f8cfb68e8a17a20557c21bb2c53e00c4f76b7d7549ae64ae340142f5b1c62c9fb0c39e422f64ec890ae6d4e3d6fbd18e55ae9

    • C:\Users\Admin\AppData\Local\Temp\00000000.res

      Filesize

      136B

      MD5

      e442bd2901c7ce2045ab771bfe9e6f88

      SHA1

      8fdc0bd974ea3eb181ea6b5409871a1ac3179e23

      SHA256

      4665c1fd8ede82d4d4fdd8f5b38839f0301a21edb59ee569a525fb4d7fa0d868

      SHA512

      6cb314032e47aacee132a7ab78609b34958e1f53d416e1e6c3f608f9ac91d1b07ce8cb5047280e6946d08f8fb22e3fd06a50c3d6a55649ba07e44c03e491521d

    • C:\Users\Admin\AppData\Local\Temp\265431727278621.bat

      Filesize

      336B

      MD5

      3540e056349c6972905dc9706cd49418

      SHA1

      492c20442d34d45a6d6790c720349b11ec591cde

      SHA256

      73872a89440a2cba9d22bf4961c3d499ea2c72979c30c455f942374292fedadc

      SHA512

      c949d147100aef59e382c03abf7b162ae62a4d43456eebd730fbedcf5f95f5e1a24f6e349690d52d75331878a6ee8f6b88a7162ee9cf2a49e142196b12d0133c

    • C:\Users\Admin\AppData\Local\Temp\c.vbs

      Filesize

      219B

      MD5

      5f6d40ca3c34b470113ed04d06a88ff4

      SHA1

      50629e7211ae43e32060686d6be17ebd492fd7aa

      SHA256

      0fb5039a2fe7e90cdf3f22140d7f2103f94689b15609efe0edcc8430dd772fc1

      SHA512

      4d4aa1abd2c9183202fd3f0a65b37f07ee0166ba6561f094c13c8ea59752c7bdd960e37c49583746d4464bc3b1dc0b63a1fe36a37ce7e5709cd76ed433befe35

    • C:\Users\Admin\AppData\Local\Temp\c.wry

      Filesize

      628B

      MD5

      eb3bce62942d80cc565337b1df518da9

      SHA1

      e1205f1bf4de1f7b8ff38194c1b600c35c24afdc

      SHA256

      5d6c9f3f28919f9cf68426e1a0cf6bb1e95d59ff390e42ebf82bd2bdf05e972d

      SHA512

      7f0b11b16e87031cb6b4aeaf606d0fb8c3a033d3b8a83ac06f0bcd6aafc9343602d4e27f7a4ba3a5f0261aee82054f5e714cdc636df91be692ebb89dc8f55f38

    • C:\Users\Admin\AppData\Local\Temp\m.wry

      Filesize

      42KB

      MD5

      980b08bac152aff3f9b0136b616affa5

      SHA1

      2a9c9601ea038f790cc29379c79407356a3d25a3

      SHA256

      402046ada270528c9ac38bbfa0152836fe30fb8e12192354e53b8397421430d9

      SHA512

      100cda1f795781042b012498afd783fd6ff03b0068dbd07b2c2e163cd95e6c6e00755ce16b02b017693c9febc149ed02df9df9b607e2b9cca4b07e5bd420f496

    • C:\Users\Admin\AppData\Local\Temp\u.wry

      Filesize

      236KB

      MD5

      cf1416074cd7791ab80a18f9e7e219d9

      SHA1

      276d2ec82c518d887a8a3608e51c56fa28716ded

      SHA256

      78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df

      SHA512

      0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

    • memory/2444-6-0x0000000010000000-0x0000000010012000-memory.dmp

      Filesize

      72KB