Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
20-09-2022 16:53
Static task
static1
Behavioral task
behavioral1
Sample
34881d8425c4344ef20acea47336e89a.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
34881d8425c4344ef20acea47336e89a.exe
Resource
win10v2004-20220812-en
General
-
Target
34881d8425c4344ef20acea47336e89a.exe
-
Size
3.6MB
-
MD5
34881d8425c4344ef20acea47336e89a
-
SHA1
00a4da44c4dfe13124198e914e5a8a7bbe4dcd15
-
SHA256
c712ab1138d0dbccc4857d5b285ae54d75dd109452c22ad661b8869c5b9bbddf
-
SHA512
9e4f32f17b097a241c86ca756b526bf98afb0728ccfc710edcca97955a253db59a53c4d143d2738b4cf7915404523e7958f7f9a85d03f8ac70e1df6f66f17639
-
SSDEEP
98304:JDqPoBhz1aRxcSUDk36SAI593R8yAVp2:JDqPe1Cxcxk3ZAIzR8yc4
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (1247) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in System32 directory 1 IoCs
Processes:
34881d8425c4344ef20acea47336e89a.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat 34881d8425c4344ef20acea47336e89a.exe -
Drops file in Windows directory 1 IoCs
Processes:
34881d8425c4344ef20acea47336e89a.exedescription ioc process File created C:\WINDOWS\tasksche.exe 34881d8425c4344ef20acea47336e89a.exe -
Modifies data under HKEY_USERS 24 IoCs
Processes:
34881d8425c4344ef20acea47336e89a.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" 34881d8425c4344ef20acea47336e89a.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 34881d8425c4344ef20acea47336e89a.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 34881d8425c4344ef20acea47336e89a.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f007e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 34881d8425c4344ef20acea47336e89a.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{90135F95-9E5B-444E-9D93-373671029C1C}\WpadDecisionReason = "1" 34881d8425c4344ef20acea47336e89a.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{90135F95-9E5B-444E-9D93-373671029C1C}\WpadDecisionTime = 50e4335a22cdd801 34881d8425c4344ef20acea47336e89a.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings 34881d8425c4344ef20acea47336e89a.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections 34881d8425c4344ef20acea47336e89a.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1a-d2-6f-21-cb-cd 34881d8425c4344ef20acea47336e89a.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{90135F95-9E5B-444E-9D93-373671029C1C}\1a-d2-6f-21-cb-cd 34881d8425c4344ef20acea47336e89a.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 34881d8425c4344ef20acea47336e89a.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 34881d8425c4344ef20acea47336e89a.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 34881d8425c4344ef20acea47336e89a.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{90135F95-9E5B-444E-9D93-373671029C1C} 34881d8425c4344ef20acea47336e89a.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{90135F95-9E5B-444E-9D93-373671029C1C}\WpadNetworkName = "Network 3" 34881d8425c4344ef20acea47336e89a.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" 34881d8425c4344ef20acea47336e89a.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 34881d8425c4344ef20acea47336e89a.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad 34881d8425c4344ef20acea47336e89a.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{90135F95-9E5B-444E-9D93-373671029C1C}\WpadDecision = "0" 34881d8425c4344ef20acea47336e89a.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1a-d2-6f-21-cb-cd\WpadDecisionReason = "1" 34881d8425c4344ef20acea47336e89a.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1a-d2-6f-21-cb-cd\WpadDecisionTime = 50e4335a22cdd801 34881d8425c4344ef20acea47336e89a.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1a-d2-6f-21-cb-cd\WpadDecision = "0" 34881d8425c4344ef20acea47336e89a.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings 34881d8425c4344ef20acea47336e89a.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" 34881d8425c4344ef20acea47336e89a.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
34881d8425c4344ef20acea47336e89a.exe34881d8425c4344ef20acea47336e89a.exepid process 1736 34881d8425c4344ef20acea47336e89a.exe 1756 34881d8425c4344ef20acea47336e89a.exe -
Suspicious behavior: MapViewOfSection 44 IoCs
Processes:
34881d8425c4344ef20acea47336e89a.exe34881d8425c4344ef20acea47336e89a.exepid process 1736 34881d8425c4344ef20acea47336e89a.exe 1736 34881d8425c4344ef20acea47336e89a.exe 1736 34881d8425c4344ef20acea47336e89a.exe 1736 34881d8425c4344ef20acea47336e89a.exe 1736 34881d8425c4344ef20acea47336e89a.exe 1736 34881d8425c4344ef20acea47336e89a.exe 1736 34881d8425c4344ef20acea47336e89a.exe 1736 34881d8425c4344ef20acea47336e89a.exe 1736 34881d8425c4344ef20acea47336e89a.exe 1736 34881d8425c4344ef20acea47336e89a.exe 1736 34881d8425c4344ef20acea47336e89a.exe 1736 34881d8425c4344ef20acea47336e89a.exe 1736 34881d8425c4344ef20acea47336e89a.exe 1736 34881d8425c4344ef20acea47336e89a.exe 1736 34881d8425c4344ef20acea47336e89a.exe 1736 34881d8425c4344ef20acea47336e89a.exe 1736 34881d8425c4344ef20acea47336e89a.exe 1736 34881d8425c4344ef20acea47336e89a.exe 1736 34881d8425c4344ef20acea47336e89a.exe 1736 34881d8425c4344ef20acea47336e89a.exe 1736 34881d8425c4344ef20acea47336e89a.exe 1756 34881d8425c4344ef20acea47336e89a.exe 1756 34881d8425c4344ef20acea47336e89a.exe 1756 34881d8425c4344ef20acea47336e89a.exe 1756 34881d8425c4344ef20acea47336e89a.exe 1756 34881d8425c4344ef20acea47336e89a.exe 1756 34881d8425c4344ef20acea47336e89a.exe 1756 34881d8425c4344ef20acea47336e89a.exe 1756 34881d8425c4344ef20acea47336e89a.exe 1756 34881d8425c4344ef20acea47336e89a.exe 1756 34881d8425c4344ef20acea47336e89a.exe 1756 34881d8425c4344ef20acea47336e89a.exe 1756 34881d8425c4344ef20acea47336e89a.exe 1756 34881d8425c4344ef20acea47336e89a.exe 1756 34881d8425c4344ef20acea47336e89a.exe 1756 34881d8425c4344ef20acea47336e89a.exe 1756 34881d8425c4344ef20acea47336e89a.exe 1756 34881d8425c4344ef20acea47336e89a.exe 1756 34881d8425c4344ef20acea47336e89a.exe 1756 34881d8425c4344ef20acea47336e89a.exe 1756 34881d8425c4344ef20acea47336e89a.exe 1756 34881d8425c4344ef20acea47336e89a.exe 1756 34881d8425c4344ef20acea47336e89a.exe 1756 34881d8425c4344ef20acea47336e89a.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
34881d8425c4344ef20acea47336e89a.exe34881d8425c4344ef20acea47336e89a.exedescription pid process Token: SeDebugPrivilege 1736 34881d8425c4344ef20acea47336e89a.exe Token: SeDebugPrivilege 1756 34881d8425c4344ef20acea47336e89a.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
34881d8425c4344ef20acea47336e89a.exedescription pid process target process PID 1736 wrote to memory of 372 1736 34881d8425c4344ef20acea47336e89a.exe wininit.exe PID 1736 wrote to memory of 372 1736 34881d8425c4344ef20acea47336e89a.exe wininit.exe PID 1736 wrote to memory of 372 1736 34881d8425c4344ef20acea47336e89a.exe wininit.exe PID 1736 wrote to memory of 372 1736 34881d8425c4344ef20acea47336e89a.exe wininit.exe PID 1736 wrote to memory of 372 1736 34881d8425c4344ef20acea47336e89a.exe wininit.exe PID 1736 wrote to memory of 372 1736 34881d8425c4344ef20acea47336e89a.exe wininit.exe PID 1736 wrote to memory of 372 1736 34881d8425c4344ef20acea47336e89a.exe wininit.exe PID 1736 wrote to memory of 384 1736 34881d8425c4344ef20acea47336e89a.exe csrss.exe PID 1736 wrote to memory of 384 1736 34881d8425c4344ef20acea47336e89a.exe csrss.exe PID 1736 wrote to memory of 384 1736 34881d8425c4344ef20acea47336e89a.exe csrss.exe PID 1736 wrote to memory of 384 1736 34881d8425c4344ef20acea47336e89a.exe csrss.exe PID 1736 wrote to memory of 384 1736 34881d8425c4344ef20acea47336e89a.exe csrss.exe PID 1736 wrote to memory of 384 1736 34881d8425c4344ef20acea47336e89a.exe csrss.exe PID 1736 wrote to memory of 384 1736 34881d8425c4344ef20acea47336e89a.exe csrss.exe PID 1736 wrote to memory of 420 1736 34881d8425c4344ef20acea47336e89a.exe winlogon.exe PID 1736 wrote to memory of 420 1736 34881d8425c4344ef20acea47336e89a.exe winlogon.exe PID 1736 wrote to memory of 420 1736 34881d8425c4344ef20acea47336e89a.exe winlogon.exe PID 1736 wrote to memory of 420 1736 34881d8425c4344ef20acea47336e89a.exe winlogon.exe PID 1736 wrote to memory of 420 1736 34881d8425c4344ef20acea47336e89a.exe winlogon.exe PID 1736 wrote to memory of 420 1736 34881d8425c4344ef20acea47336e89a.exe winlogon.exe PID 1736 wrote to memory of 420 1736 34881d8425c4344ef20acea47336e89a.exe winlogon.exe PID 1736 wrote to memory of 464 1736 34881d8425c4344ef20acea47336e89a.exe services.exe PID 1736 wrote to memory of 464 1736 34881d8425c4344ef20acea47336e89a.exe services.exe PID 1736 wrote to memory of 464 1736 34881d8425c4344ef20acea47336e89a.exe services.exe PID 1736 wrote to memory of 464 1736 34881d8425c4344ef20acea47336e89a.exe services.exe PID 1736 wrote to memory of 464 1736 34881d8425c4344ef20acea47336e89a.exe services.exe PID 1736 wrote to memory of 464 1736 34881d8425c4344ef20acea47336e89a.exe services.exe PID 1736 wrote to memory of 464 1736 34881d8425c4344ef20acea47336e89a.exe services.exe PID 1736 wrote to memory of 480 1736 34881d8425c4344ef20acea47336e89a.exe lsass.exe PID 1736 wrote to memory of 480 1736 34881d8425c4344ef20acea47336e89a.exe lsass.exe PID 1736 wrote to memory of 480 1736 34881d8425c4344ef20acea47336e89a.exe lsass.exe PID 1736 wrote to memory of 480 1736 34881d8425c4344ef20acea47336e89a.exe lsass.exe PID 1736 wrote to memory of 480 1736 34881d8425c4344ef20acea47336e89a.exe lsass.exe PID 1736 wrote to memory of 480 1736 34881d8425c4344ef20acea47336e89a.exe lsass.exe PID 1736 wrote to memory of 480 1736 34881d8425c4344ef20acea47336e89a.exe lsass.exe PID 1736 wrote to memory of 488 1736 34881d8425c4344ef20acea47336e89a.exe lsm.exe PID 1736 wrote to memory of 488 1736 34881d8425c4344ef20acea47336e89a.exe lsm.exe PID 1736 wrote to memory of 488 1736 34881d8425c4344ef20acea47336e89a.exe lsm.exe PID 1736 wrote to memory of 488 1736 34881d8425c4344ef20acea47336e89a.exe lsm.exe PID 1736 wrote to memory of 488 1736 34881d8425c4344ef20acea47336e89a.exe lsm.exe PID 1736 wrote to memory of 488 1736 34881d8425c4344ef20acea47336e89a.exe lsm.exe PID 1736 wrote to memory of 488 1736 34881d8425c4344ef20acea47336e89a.exe lsm.exe PID 1736 wrote to memory of 584 1736 34881d8425c4344ef20acea47336e89a.exe svchost.exe PID 1736 wrote to memory of 584 1736 34881d8425c4344ef20acea47336e89a.exe svchost.exe PID 1736 wrote to memory of 584 1736 34881d8425c4344ef20acea47336e89a.exe svchost.exe PID 1736 wrote to memory of 584 1736 34881d8425c4344ef20acea47336e89a.exe svchost.exe PID 1736 wrote to memory of 584 1736 34881d8425c4344ef20acea47336e89a.exe svchost.exe PID 1736 wrote to memory of 584 1736 34881d8425c4344ef20acea47336e89a.exe svchost.exe PID 1736 wrote to memory of 584 1736 34881d8425c4344ef20acea47336e89a.exe svchost.exe PID 1736 wrote to memory of 660 1736 34881d8425c4344ef20acea47336e89a.exe svchost.exe PID 1736 wrote to memory of 660 1736 34881d8425c4344ef20acea47336e89a.exe svchost.exe PID 1736 wrote to memory of 660 1736 34881d8425c4344ef20acea47336e89a.exe svchost.exe PID 1736 wrote to memory of 660 1736 34881d8425c4344ef20acea47336e89a.exe svchost.exe PID 1736 wrote to memory of 660 1736 34881d8425c4344ef20acea47336e89a.exe svchost.exe PID 1736 wrote to memory of 660 1736 34881d8425c4344ef20acea47336e89a.exe svchost.exe PID 1736 wrote to memory of 660 1736 34881d8425c4344ef20acea47336e89a.exe svchost.exe PID 1736 wrote to memory of 716 1736 34881d8425c4344ef20acea47336e89a.exe svchost.exe PID 1736 wrote to memory of 716 1736 34881d8425c4344ef20acea47336e89a.exe svchost.exe PID 1736 wrote to memory of 716 1736 34881d8425c4344ef20acea47336e89a.exe svchost.exe PID 1736 wrote to memory of 716 1736 34881d8425c4344ef20acea47336e89a.exe svchost.exe PID 1736 wrote to memory of 716 1736 34881d8425c4344ef20acea47336e89a.exe svchost.exe PID 1736 wrote to memory of 716 1736 34881d8425c4344ef20acea47336e89a.exe svchost.exe PID 1736 wrote to memory of 716 1736 34881d8425c4344ef20acea47336e89a.exe svchost.exe PID 1736 wrote to memory of 792 1736 34881d8425c4344ef20acea47336e89a.exe svchost.exe
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation2⤵
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe2⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork2⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService2⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted2⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch2⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}3⤵
-
C:\Users\Admin\AppData\Local\Temp\34881d8425c4344ef20acea47336e89a.exeC:\Users\Admin\AppData\Local\Temp\34881d8425c4344ef20acea47336e89a.exe -m security2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
-
C:\Windows\system32\wininit.exewininit.exe1⤵
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵
-
\\?\C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\34881d8425c4344ef20acea47336e89a.exe"C:\Users\Admin\AppData\Local\Temp\34881d8425c4344ef20acea47336e89a.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1736-54-0x0000000075A81000-0x0000000075A83000-memory.dmpFilesize
8KB
-
memory/1736-56-0x0000000000400000-0x0000000000A82000-memory.dmpFilesize
6.5MB
-
memory/1736-57-0x000000007EF70000-0x000000007EF7C000-memory.dmpFilesize
48KB
-
memory/1736-58-0x0000000000400000-0x0000000000A82000-memory.dmpFilesize
6.5MB
-
memory/1756-59-0x0000000000400000-0x0000000000A82000-memory.dmpFilesize
6.5MB
-
memory/1756-60-0x0000000000400000-0x0000000000A82000-memory.dmpFilesize
6.5MB