Analysis
-
max time kernel
152s -
max time network
158s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-08-2022 19:34
Static task
static1
Behavioral task
behavioral1
Sample
1200de7b4adf66300ea22172fad7ed9a.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1200de7b4adf66300ea22172fad7ed9a.exe
Resource
win10v2004-20220812-en
General
-
Target
1200de7b4adf66300ea22172fad7ed9a.exe
-
Size
3.6MB
-
MD5
1200de7b4adf66300ea22172fad7ed9a
-
SHA1
f4a8b2e179251f5b0912150610a215879f16051e
-
SHA256
c75746cd94a393cee3ad01a000e53cac2965cc7a70889a325dadc62a2018fdc1
-
SHA512
d2e9e576604667690b0c7eb2a27a8e8b84c37e84ff42d79b40235c7c021218f5578a9955c7f7e8ef722e748949dd1c65a179ef578b0145e3f3c5375c783420bd
-
SSDEEP
49152:2nAQqMSPbcBVkAMEcaEau3R8yAH1plAHI:yDqPoB2593R8yAVp2HI
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (1259) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 1 IoCs
Processes:
tasksche.exepid process 952 tasksche.exe -
Drops file in System32 directory 1 IoCs
Processes:
1200de7b4adf66300ea22172fad7ed9a.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat 1200de7b4adf66300ea22172fad7ed9a.exe -
Drops file in Windows directory 1 IoCs
Processes:
1200de7b4adf66300ea22172fad7ed9a.exedescription ioc process File created C:\WINDOWS\tasksche.exe 1200de7b4adf66300ea22172fad7ed9a.exe -
Modifies data under HKEY_USERS 24 IoCs
Processes:
1200de7b4adf66300ea22172fad7ed9a.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c6-6c-ae-48-c1-36\WpadDecision = "0" 1200de7b4adf66300ea22172fad7ed9a.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 1200de7b4adf66300ea22172fad7ed9a.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0B3D965A-12AD-41FF-9B63-AD9FA062CEA5} 1200de7b4adf66300ea22172fad7ed9a.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 1200de7b4adf66300ea22172fad7ed9a.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" 1200de7b4adf66300ea22172fad7ed9a.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" 1200de7b4adf66300ea22172fad7ed9a.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad 1200de7b4adf66300ea22172fad7ed9a.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0B3D965A-12AD-41FF-9B63-AD9FA062CEA5}\WpadDecisionTime = 8090c08fcab8d801 1200de7b4adf66300ea22172fad7ed9a.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c6-6c-ae-48-c1-36\WpadDecisionReason = "1" 1200de7b4adf66300ea22172fad7ed9a.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings 1200de7b4adf66300ea22172fad7ed9a.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections 1200de7b4adf66300ea22172fad7ed9a.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 1200de7b4adf66300ea22172fad7ed9a.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 1200de7b4adf66300ea22172fad7ed9a.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f009a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 1200de7b4adf66300ea22172fad7ed9a.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0B3D965A-12AD-41FF-9B63-AD9FA062CEA5}\WpadDecision = "0" 1200de7b4adf66300ea22172fad7ed9a.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0B3D965A-12AD-41FF-9B63-AD9FA062CEA5}\WpadNetworkName = "Network 3" 1200de7b4adf66300ea22172fad7ed9a.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c6-6c-ae-48-c1-36 1200de7b4adf66300ea22172fad7ed9a.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" 1200de7b4adf66300ea22172fad7ed9a.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 1200de7b4adf66300ea22172fad7ed9a.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0B3D965A-12AD-41FF-9B63-AD9FA062CEA5}\WpadDecisionReason = "1" 1200de7b4adf66300ea22172fad7ed9a.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0B3D965A-12AD-41FF-9B63-AD9FA062CEA5}\c6-6c-ae-48-c1-36 1200de7b4adf66300ea22172fad7ed9a.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c6-6c-ae-48-c1-36\WpadDecisionTime = 8090c08fcab8d801 1200de7b4adf66300ea22172fad7ed9a.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings 1200de7b4adf66300ea22172fad7ed9a.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 1200de7b4adf66300ea22172fad7ed9a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1200de7b4adf66300ea22172fad7ed9a.exe"C:\Users\Admin\AppData\Local\Temp\1200de7b4adf66300ea22172fad7ed9a.exe"1⤵
- Drops file in Windows directory
-
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1200de7b4adf66300ea22172fad7ed9a.exeC:\Users\Admin\AppData\Local\Temp\1200de7b4adf66300ea22172fad7ed9a.exe -m security1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\tasksche.exeFilesize
3.4MB
MD5834b15021ab9952db7463a885d4930ab
SHA107c7425edc3686f97c1f36fc62297b5ad97f3180
SHA2565e9a3ae53eae149171c1bf241cdf1144642c8c177f1b08db4de1ffabffdb040a
SHA5128c8949be18f1f85e3cd79e5706557bc9107a6031d412c3dda280694a0e7477c0d18e41399c7a0e873f11b82174eaaf3a8c72188543e69fd3bc4c66daf527a998
-
memory/1416-54-0x0000000075E81000-0x0000000075E83000-memory.dmpFilesize
8KB