Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-08-2022 19:30
Static task
static1
Behavioral task
behavioral1
Sample
db28383ba1d804c5c224bfb865d71f14.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
db28383ba1d804c5c224bfb865d71f14.exe
Resource
win10v2004-20220812-en
General
-
Target
db28383ba1d804c5c224bfb865d71f14.exe
-
Size
3.6MB
-
MD5
db28383ba1d804c5c224bfb865d71f14
-
SHA1
8e7286ca8cb98cc4804c8bb917e43ead79480506
-
SHA256
cf713cb4ecf1aee0756285012464f6b9e9e46a6d15afa432faf8c4d3576e8f73
-
SHA512
b7436ca4b2acf89080caafb37e2252ebf5ffa5e2caf06bcc7e57c033f83a5724e34cda237eab03cd484e427a8ad35d2fcf7ddb4008e12493344776b73853442f
-
SSDEEP
24576:xbLgddQhfdmMSirYbcMNgef0QeQjG/D8kIqvO1Dq:xnAQqMSPbcBVQej/zOhq
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (1223) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in System32 directory 1 IoCs
Processes:
db28383ba1d804c5c224bfb865d71f14.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat db28383ba1d804c5c224bfb865d71f14.exe -
Drops file in Windows directory 1 IoCs
Processes:
db28383ba1d804c5c224bfb865d71f14.exedescription ioc process File created C:\WINDOWS\tasksche.exe db28383ba1d804c5c224bfb865d71f14.exe -
Modifies data under HKEY_USERS 24 IoCs
Processes:
db28383ba1d804c5c224bfb865d71f14.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" db28383ba1d804c5c224bfb865d71f14.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B5C41A55-ABA5-4056-8C3E-4357DD0AD4E1}\WpadDecisionTime = f03cb43bb9b8d801 db28383ba1d804c5c224bfb865d71f14.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-08-4e-06-19-f4 db28383ba1d804c5c224bfb865d71f14.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 db28383ba1d804c5c224bfb865d71f14.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix db28383ba1d804c5c224bfb865d71f14.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 db28383ba1d804c5c224bfb865d71f14.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ db28383ba1d804c5c224bfb865d71f14.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" db28383ba1d804c5c224bfb865d71f14.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad db28383ba1d804c5c224bfb865d71f14.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f004f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 db28383ba1d804c5c224bfb865d71f14.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings db28383ba1d804c5c224bfb865d71f14.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections db28383ba1d804c5c224bfb865d71f14.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" db28383ba1d804c5c224bfb865d71f14.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B5C41A55-ABA5-4056-8C3E-4357DD0AD4E1}\WpadDecision = "0" db28383ba1d804c5c224bfb865d71f14.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B5C41A55-ABA5-4056-8C3E-4357DD0AD4E1}\WpadNetworkName = "Network 2" db28383ba1d804c5c224bfb865d71f14.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-08-4e-06-19-f4\WpadDecisionReason = "1" db28383ba1d804c5c224bfb865d71f14.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B5C41A55-ABA5-4056-8C3E-4357DD0AD4E1} db28383ba1d804c5c224bfb865d71f14.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B5C41A55-ABA5-4056-8C3E-4357DD0AD4E1}\WpadDecisionReason = "1" db28383ba1d804c5c224bfb865d71f14.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B5C41A55-ABA5-4056-8C3E-4357DD0AD4E1}\9a-08-4e-06-19-f4 db28383ba1d804c5c224bfb865d71f14.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-08-4e-06-19-f4\WpadDecisionTime = f03cb43bb9b8d801 db28383ba1d804c5c224bfb865d71f14.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-08-4e-06-19-f4\WpadDecision = "0" db28383ba1d804c5c224bfb865d71f14.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings db28383ba1d804c5c224bfb865d71f14.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" db28383ba1d804c5c224bfb865d71f14.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" db28383ba1d804c5c224bfb865d71f14.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
db28383ba1d804c5c224bfb865d71f14.exedb28383ba1d804c5c224bfb865d71f14.exepid process 1944 db28383ba1d804c5c224bfb865d71f14.exe 1028 db28383ba1d804c5c224bfb865d71f14.exe -
Suspicious behavior: MapViewOfSection 44 IoCs
Processes:
db28383ba1d804c5c224bfb865d71f14.exedb28383ba1d804c5c224bfb865d71f14.exepid process 1944 db28383ba1d804c5c224bfb865d71f14.exe 1944 db28383ba1d804c5c224bfb865d71f14.exe 1944 db28383ba1d804c5c224bfb865d71f14.exe 1944 db28383ba1d804c5c224bfb865d71f14.exe 1944 db28383ba1d804c5c224bfb865d71f14.exe 1944 db28383ba1d804c5c224bfb865d71f14.exe 1944 db28383ba1d804c5c224bfb865d71f14.exe 1944 db28383ba1d804c5c224bfb865d71f14.exe 1944 db28383ba1d804c5c224bfb865d71f14.exe 1944 db28383ba1d804c5c224bfb865d71f14.exe 1944 db28383ba1d804c5c224bfb865d71f14.exe 1944 db28383ba1d804c5c224bfb865d71f14.exe 1944 db28383ba1d804c5c224bfb865d71f14.exe 1944 db28383ba1d804c5c224bfb865d71f14.exe 1944 db28383ba1d804c5c224bfb865d71f14.exe 1944 db28383ba1d804c5c224bfb865d71f14.exe 1944 db28383ba1d804c5c224bfb865d71f14.exe 1944 db28383ba1d804c5c224bfb865d71f14.exe 1944 db28383ba1d804c5c224bfb865d71f14.exe 1944 db28383ba1d804c5c224bfb865d71f14.exe 1944 db28383ba1d804c5c224bfb865d71f14.exe 1028 db28383ba1d804c5c224bfb865d71f14.exe 1028 db28383ba1d804c5c224bfb865d71f14.exe 1028 db28383ba1d804c5c224bfb865d71f14.exe 1028 db28383ba1d804c5c224bfb865d71f14.exe 1028 db28383ba1d804c5c224bfb865d71f14.exe 1028 db28383ba1d804c5c224bfb865d71f14.exe 1028 db28383ba1d804c5c224bfb865d71f14.exe 1028 db28383ba1d804c5c224bfb865d71f14.exe 1028 db28383ba1d804c5c224bfb865d71f14.exe 1028 db28383ba1d804c5c224bfb865d71f14.exe 1028 db28383ba1d804c5c224bfb865d71f14.exe 1028 db28383ba1d804c5c224bfb865d71f14.exe 1028 db28383ba1d804c5c224bfb865d71f14.exe 1028 db28383ba1d804c5c224bfb865d71f14.exe 1028 db28383ba1d804c5c224bfb865d71f14.exe 1028 db28383ba1d804c5c224bfb865d71f14.exe 1028 db28383ba1d804c5c224bfb865d71f14.exe 1028 db28383ba1d804c5c224bfb865d71f14.exe 1028 db28383ba1d804c5c224bfb865d71f14.exe 1028 db28383ba1d804c5c224bfb865d71f14.exe 1028 db28383ba1d804c5c224bfb865d71f14.exe 1028 db28383ba1d804c5c224bfb865d71f14.exe 1028 db28383ba1d804c5c224bfb865d71f14.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
db28383ba1d804c5c224bfb865d71f14.exedb28383ba1d804c5c224bfb865d71f14.exedescription pid process Token: SeDebugPrivilege 1944 db28383ba1d804c5c224bfb865d71f14.exe Token: SeDebugPrivilege 1028 db28383ba1d804c5c224bfb865d71f14.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
db28383ba1d804c5c224bfb865d71f14.exedescription pid process target process PID 1944 wrote to memory of 368 1944 db28383ba1d804c5c224bfb865d71f14.exe wininit.exe PID 1944 wrote to memory of 368 1944 db28383ba1d804c5c224bfb865d71f14.exe wininit.exe PID 1944 wrote to memory of 368 1944 db28383ba1d804c5c224bfb865d71f14.exe wininit.exe PID 1944 wrote to memory of 368 1944 db28383ba1d804c5c224bfb865d71f14.exe wininit.exe PID 1944 wrote to memory of 368 1944 db28383ba1d804c5c224bfb865d71f14.exe wininit.exe PID 1944 wrote to memory of 368 1944 db28383ba1d804c5c224bfb865d71f14.exe wininit.exe PID 1944 wrote to memory of 368 1944 db28383ba1d804c5c224bfb865d71f14.exe wininit.exe PID 1944 wrote to memory of 384 1944 db28383ba1d804c5c224bfb865d71f14.exe csrss.exe PID 1944 wrote to memory of 384 1944 db28383ba1d804c5c224bfb865d71f14.exe csrss.exe PID 1944 wrote to memory of 384 1944 db28383ba1d804c5c224bfb865d71f14.exe csrss.exe PID 1944 wrote to memory of 384 1944 db28383ba1d804c5c224bfb865d71f14.exe csrss.exe PID 1944 wrote to memory of 384 1944 db28383ba1d804c5c224bfb865d71f14.exe csrss.exe PID 1944 wrote to memory of 384 1944 db28383ba1d804c5c224bfb865d71f14.exe csrss.exe PID 1944 wrote to memory of 384 1944 db28383ba1d804c5c224bfb865d71f14.exe csrss.exe PID 1944 wrote to memory of 420 1944 db28383ba1d804c5c224bfb865d71f14.exe winlogon.exe PID 1944 wrote to memory of 420 1944 db28383ba1d804c5c224bfb865d71f14.exe winlogon.exe PID 1944 wrote to memory of 420 1944 db28383ba1d804c5c224bfb865d71f14.exe winlogon.exe PID 1944 wrote to memory of 420 1944 db28383ba1d804c5c224bfb865d71f14.exe winlogon.exe PID 1944 wrote to memory of 420 1944 db28383ba1d804c5c224bfb865d71f14.exe winlogon.exe PID 1944 wrote to memory of 420 1944 db28383ba1d804c5c224bfb865d71f14.exe winlogon.exe PID 1944 wrote to memory of 420 1944 db28383ba1d804c5c224bfb865d71f14.exe winlogon.exe PID 1944 wrote to memory of 464 1944 db28383ba1d804c5c224bfb865d71f14.exe services.exe PID 1944 wrote to memory of 464 1944 db28383ba1d804c5c224bfb865d71f14.exe services.exe PID 1944 wrote to memory of 464 1944 db28383ba1d804c5c224bfb865d71f14.exe services.exe PID 1944 wrote to memory of 464 1944 db28383ba1d804c5c224bfb865d71f14.exe services.exe PID 1944 wrote to memory of 464 1944 db28383ba1d804c5c224bfb865d71f14.exe services.exe PID 1944 wrote to memory of 464 1944 db28383ba1d804c5c224bfb865d71f14.exe services.exe PID 1944 wrote to memory of 464 1944 db28383ba1d804c5c224bfb865d71f14.exe services.exe PID 1944 wrote to memory of 480 1944 db28383ba1d804c5c224bfb865d71f14.exe lsass.exe PID 1944 wrote to memory of 480 1944 db28383ba1d804c5c224bfb865d71f14.exe lsass.exe PID 1944 wrote to memory of 480 1944 db28383ba1d804c5c224bfb865d71f14.exe lsass.exe PID 1944 wrote to memory of 480 1944 db28383ba1d804c5c224bfb865d71f14.exe lsass.exe PID 1944 wrote to memory of 480 1944 db28383ba1d804c5c224bfb865d71f14.exe lsass.exe PID 1944 wrote to memory of 480 1944 db28383ba1d804c5c224bfb865d71f14.exe lsass.exe PID 1944 wrote to memory of 480 1944 db28383ba1d804c5c224bfb865d71f14.exe lsass.exe PID 1944 wrote to memory of 488 1944 db28383ba1d804c5c224bfb865d71f14.exe lsm.exe PID 1944 wrote to memory of 488 1944 db28383ba1d804c5c224bfb865d71f14.exe lsm.exe PID 1944 wrote to memory of 488 1944 db28383ba1d804c5c224bfb865d71f14.exe lsm.exe PID 1944 wrote to memory of 488 1944 db28383ba1d804c5c224bfb865d71f14.exe lsm.exe PID 1944 wrote to memory of 488 1944 db28383ba1d804c5c224bfb865d71f14.exe lsm.exe PID 1944 wrote to memory of 488 1944 db28383ba1d804c5c224bfb865d71f14.exe lsm.exe PID 1944 wrote to memory of 488 1944 db28383ba1d804c5c224bfb865d71f14.exe lsm.exe PID 1944 wrote to memory of 604 1944 db28383ba1d804c5c224bfb865d71f14.exe svchost.exe PID 1944 wrote to memory of 604 1944 db28383ba1d804c5c224bfb865d71f14.exe svchost.exe PID 1944 wrote to memory of 604 1944 db28383ba1d804c5c224bfb865d71f14.exe svchost.exe PID 1944 wrote to memory of 604 1944 db28383ba1d804c5c224bfb865d71f14.exe svchost.exe PID 1944 wrote to memory of 604 1944 db28383ba1d804c5c224bfb865d71f14.exe svchost.exe PID 1944 wrote to memory of 604 1944 db28383ba1d804c5c224bfb865d71f14.exe svchost.exe PID 1944 wrote to memory of 604 1944 db28383ba1d804c5c224bfb865d71f14.exe svchost.exe PID 1944 wrote to memory of 684 1944 db28383ba1d804c5c224bfb865d71f14.exe svchost.exe PID 1944 wrote to memory of 684 1944 db28383ba1d804c5c224bfb865d71f14.exe svchost.exe PID 1944 wrote to memory of 684 1944 db28383ba1d804c5c224bfb865d71f14.exe svchost.exe PID 1944 wrote to memory of 684 1944 db28383ba1d804c5c224bfb865d71f14.exe svchost.exe PID 1944 wrote to memory of 684 1944 db28383ba1d804c5c224bfb865d71f14.exe svchost.exe PID 1944 wrote to memory of 684 1944 db28383ba1d804c5c224bfb865d71f14.exe svchost.exe PID 1944 wrote to memory of 684 1944 db28383ba1d804c5c224bfb865d71f14.exe svchost.exe PID 1944 wrote to memory of 768 1944 db28383ba1d804c5c224bfb865d71f14.exe svchost.exe PID 1944 wrote to memory of 768 1944 db28383ba1d804c5c224bfb865d71f14.exe svchost.exe PID 1944 wrote to memory of 768 1944 db28383ba1d804c5c224bfb865d71f14.exe svchost.exe PID 1944 wrote to memory of 768 1944 db28383ba1d804c5c224bfb865d71f14.exe svchost.exe PID 1944 wrote to memory of 768 1944 db28383ba1d804c5c224bfb865d71f14.exe svchost.exe PID 1944 wrote to memory of 768 1944 db28383ba1d804c5c224bfb865d71f14.exe svchost.exe PID 1944 wrote to memory of 768 1944 db28383ba1d804c5c224bfb865d71f14.exe svchost.exe PID 1944 wrote to memory of 816 1944 db28383ba1d804c5c224bfb865d71f14.exe svchost.exe
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation2⤵
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe2⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork2⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService2⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted2⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch2⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}3⤵
-
C:\Users\Admin\AppData\Local\Temp\db28383ba1d804c5c224bfb865d71f14.exeC:\Users\Admin\AppData\Local\Temp\db28383ba1d804c5c224bfb865d71f14.exe -m security2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
-
C:\Windows\system32\wininit.exewininit.exe1⤵
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵
-
\\?\C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\db28383ba1d804c5c224bfb865d71f14.exe"C:\Users\Admin\AppData\Local\Temp\db28383ba1d804c5c224bfb865d71f14.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1028-57-0x0000000000400000-0x0000000000A73000-memory.dmpFilesize
6.4MB
-
memory/1028-60-0x0000000000400000-0x0000000000A73000-memory.dmpFilesize
6.4MB
-
memory/1944-54-0x00000000761A1000-0x00000000761A3000-memory.dmpFilesize
8KB
-
memory/1944-56-0x0000000000400000-0x0000000000A73000-memory.dmpFilesize
6.4MB
-
memory/1944-58-0x0000000000400000-0x0000000000A73000-memory.dmpFilesize
6.4MB
-
memory/1944-59-0x000000007EF70000-0x000000007EF7C000-memory.dmpFilesize
48KB