Analysis
-
max time kernel
150s -
max time network
179s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
15-05-2021 01:58
Static task
static1
Behavioral task
behavioral1
Sample
eef286cdabd330b86d70570bef7cdb2d876c1ca6a667b814a55e1d92135bfa8e.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
eef286cdabd330b86d70570bef7cdb2d876c1ca6a667b814a55e1d92135bfa8e.exe
Resource
win10v20210408
General
-
Target
eef286cdabd330b86d70570bef7cdb2d876c1ca6a667b814a55e1d92135bfa8e.exe
-
Size
3.6MB
-
MD5
12cdc27e902e5bfa819b530ef2c03a2e
-
SHA1
d896e6ce5603d242d1d7934786fe11f61b2200ab
-
SHA256
eef286cdabd330b86d70570bef7cdb2d876c1ca6a667b814a55e1d92135bfa8e
-
SHA512
ace93097c839708726841ca10da35eab3693c7a4ebbdcaf1d75c24b78565fd715d711667bba2a6cedc3cd16744b4e97a2dc19132876879d5b62518ecd23f8bf6
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Executes dropped EXE 1 IoCs
Processes:
tasksche.exepid process 2020 tasksche.exe -
Drops file in System32 directory 1 IoCs
Processes:
eef286cdabd330b86d70570bef7cdb2d876c1ca6a667b814a55e1d92135bfa8e.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat eef286cdabd330b86d70570bef7cdb2d876c1ca6a667b814a55e1d92135bfa8e.exe -
Drops file in Windows directory 1 IoCs
Processes:
eef286cdabd330b86d70570bef7cdb2d876c1ca6a667b814a55e1d92135bfa8e.exedescription ioc process File created C:\WINDOWS\tasksche.exe eef286cdabd330b86d70570bef7cdb2d876c1ca6a667b814a55e1d92135bfa8e.exe -
Modifies data under HKEY_USERS 24 IoCs
Processes:
eef286cdabd330b86d70570bef7cdb2d876c1ca6a667b814a55e1d92135bfa8e.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" eef286cdabd330b86d70570bef7cdb2d876c1ca6a667b814a55e1d92135bfa8e.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a070012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 eef286cdabd330b86d70570bef7cdb2d876c1ca6a667b814a55e1d92135bfa8e.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadNetworkName = "Network" eef286cdabd330b86d70570bef7cdb2d876c1ca6a667b814a55e1d92135bfa8e.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections eef286cdabd330b86d70570bef7cdb2d876c1ca6a667b814a55e1d92135bfa8e.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings eef286cdabd330b86d70570bef7cdb2d876c1ca6a667b814a55e1d92135bfa8e.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 eef286cdabd330b86d70570bef7cdb2d876c1ca6a667b814a55e1d92135bfa8e.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix eef286cdabd330b86d70570bef7cdb2d876c1ca6a667b814a55e1d92135bfa8e.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" eef286cdabd330b86d70570bef7cdb2d876c1ca6a667b814a55e1d92135bfa8e.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecision = "0" eef286cdabd330b86d70570bef7cdb2d876c1ca6a667b814a55e1d92135bfa8e.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-79-7c-ce-90-a9 eef286cdabd330b86d70570bef7cdb2d876c1ca6a667b814a55e1d92135bfa8e.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-79-7c-ce-90-a9\WpadDecisionReason = "1" eef286cdabd330b86d70570bef7cdb2d876c1ca6a667b814a55e1d92135bfa8e.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings eef286cdabd330b86d70570bef7cdb2d876c1ca6a667b814a55e1d92135bfa8e.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" eef286cdabd330b86d70570bef7cdb2d876c1ca6a667b814a55e1d92135bfa8e.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" eef286cdabd330b86d70570bef7cdb2d876c1ca6a667b814a55e1d92135bfa8e.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" eef286cdabd330b86d70570bef7cdb2d876c1ca6a667b814a55e1d92135bfa8e.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecisionReason = "1" eef286cdabd330b86d70570bef7cdb2d876c1ca6a667b814a55e1d92135bfa8e.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-79-7c-ce-90-a9\WpadDecisionTime = 50eb462f5049d701 eef286cdabd330b86d70570bef7cdb2d876c1ca6a667b814a55e1d92135bfa8e.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-79-7c-ce-90-a9\WpadDecision = "0" eef286cdabd330b86d70570bef7cdb2d876c1ca6a667b814a55e1d92135bfa8e.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 eef286cdabd330b86d70570bef7cdb2d876c1ca6a667b814a55e1d92135bfa8e.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ eef286cdabd330b86d70570bef7cdb2d876c1ca6a667b814a55e1d92135bfa8e.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad eef286cdabd330b86d70570bef7cdb2d876c1ca6a667b814a55e1d92135bfa8e.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7} eef286cdabd330b86d70570bef7cdb2d876c1ca6a667b814a55e1d92135bfa8e.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\aa-79-7c-ce-90-a9 eef286cdabd330b86d70570bef7cdb2d876c1ca6a667b814a55e1d92135bfa8e.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecisionTime = 50eb462f5049d701 eef286cdabd330b86d70570bef7cdb2d876c1ca6a667b814a55e1d92135bfa8e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\eef286cdabd330b86d70570bef7cdb2d876c1ca6a667b814a55e1d92135bfa8e.exe"C:\Users\Admin\AppData\Local\Temp\eef286cdabd330b86d70570bef7cdb2d876c1ca6a667b814a55e1d92135bfa8e.exe"1⤵
- Drops file in Windows directory
-
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\eef286cdabd330b86d70570bef7cdb2d876c1ca6a667b814a55e1d92135bfa8e.exeC:\Users\Admin\AppData\Local\Temp\eef286cdabd330b86d70570bef7cdb2d876c1ca6a667b814a55e1d92135bfa8e.exe -m security1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\tasksche.exeMD5
72a0273e5bdad2089ab90020265fcbce
SHA14a64856c9b86cc9f74fc6e74524d3cb09c3668a4
SHA25645dc98a814d1bfd4ba7790b607da53678df7c99e3e1747f7ad4f56899e3805e4
SHA512e02a324565dee584ba64e47936c5ab6a70d0c00e69e9767bf82d8c8195771a8270699f72ad0d64a490d22b0be32b54ce04c3df973baa8e8b65434781e848eb02
-
memory/364-59-0x0000000075451000-0x0000000075453000-memory.dmpFilesize
8KB