WannaCrypt.RSM_2 is a Trojan. A Trojan is a program that pretends to have a valid use, but in fact modifies the user's computer in malicious ways. Trojans do not replicate or spread to other computers.
Mutexes created
Directory level activity
File level activity- write - file - C:\DOCUME~1\TestMachine\LOCALS~1\Temp\c.wnry
Registry level activity
Library level activity- load - library - RICHED32.DLL
- load - library - C:\WINDOWS\system32\uxtheme.dll
- load - library - uxtheme.dll
- load - library - COMCTL32.DLL
- load - library - COMCTL32.dll
- load - library - UxTheme.dll
- load - library - C:\DOCUME~1\TestMachine\LOCALS~1\Temp\7bf2b57f2a205768755c07f238fb32cc.bin
- load - library - advapi32.dll
- load - library - kernel32.dll
- load - library - USERENV.dll
- load - library - SHELL32
- load - library - USER32
Process API calls used
- ZwMapViewOfSection
- NtFreeVirtualMemory
Registry API calls used
- NtOpenKey
- NtQueryValueKey
- NtQueryKey
- RegCreateKeyExW
- RegQueryValueExA
- RegCloseKey
- RegOpenKeyExW
- RegQueryValueExW
- NtCreateKey
- NtOpenKey
System API calls used
- SetWindowsHookExA
- LdrLoadDll
- IsDebuggerPresent
- LdrGetProcedureAddress
- LdrGetDllHandle
- LdrGetProcedureAddress
Filesystem API calls used
- NtOpenFile
- Argument - ShareAccess and Value - 7
- Argument - FileName and Value - C:\WINDOWS\win.ini
- Argument - DesiredAccess and Value - 0x80100000
- Argument - FileHandle and Value - 0x000000bc
- NtQueryInformationFile
- NtReadFile
- NtCreateFile
- Argument - ShareAccess and Value - 3
- Argument - FileName and Value - C:\DOCUME~1\TestMachine\LOCALS~1\Temp\c.wnry
- Argument - DesiredAccess and Value - 0x80100080
- Argument - CreateDisposition and Value - 1
- Argument - FileHandle and Value - 0x00000000
- Argument - DesiredAccess and Value - 0x40100080
- Argument - CreateDisposition and Value - 5
- NtWriteFile
- CopyFileW
- Argument - ExistingFileName and Value - b.wnry
- Argument - FileName and Value - C:\
- Argument - DesiredAccess and Value - 0x00100001
- Argument - FileHandle and Value - 0x000000c0
- Argument - FileInformation and Value - \x02\x00\x00\x00\\x00
- Argument - ShareAccess and Value - 0
- Argument - FileName and Value - C:\DOCUME~1\TestMachine\LOCALS~1\Temp\msg\m_English.wnry
- Argument - FileHandle and Value - 0x00000000
DLL related data
Number of DLL's imported = 13
- MFC42.DLL
- MSVCRT.dll
- KERNEL32.dll
- USER32.dll
- GDI32.dll
- ADVAPI32.dll
- SHELL32.dll
- COMCTL32.dll
- OLEAUT32.dll
- urlmon.dll
- MSVCP60.dll
- WS2_32.dll
- WININET.dll
Network
UDP source >> destination
- 192.168.30.254 >> 192.168.30.6
- 192.168.30.6 >> 192.168.30.255
TCP source >> destination
- 192.168.30.6 >> 192.168.30.254
VirusTotal
- Scans show 49 positive out of 61 scanners
|
