Analysis
-
max time kernel
138s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
11-10-2022 03:58
Static task
static1
Behavioral task
behavioral1
Sample
eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe
Resource
win10v2004-20220812-en
General
-
Target
eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe
-
Size
5.0MB
-
MD5
52b9761a0fb6f9bf4d62d60e512d63cc
-
SHA1
08d125e7c0d547654de44956bdb9d006348069e8
-
SHA256
eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7
-
SHA512
735aedf16fc681a01300543c8a5c13cb8cedbbdb7af85cf79d9dcaf2c559105fb8cf7454807fc3e6fa3ac54481532ab8c76667e6c383603db5da7659a5e589c9
-
SSDEEP
49152:3nwMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvw:3wPoBhz1aRxcSUDk36SAEdhvw
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Drops file in System32 directory 4 IoCs
Processes:
eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exeeafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\KWM98LNQ.txt eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\KWM98LNQ.txt eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe -
Drops file in Windows directory 1 IoCs
Processes:
eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exedescription ioc process File created C:\WINDOWS\tasksche.exe eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 784 2004 WerFault.exe eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe 1068 1004 WerFault.exe eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe -
Modifies data under HKEY_USERS 49 IoCs
Processes:
eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exeeafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a2-a7-2d-2f-50-a6\WpadDecision = "0" eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a2-a7-2d-2f-50-a6\WpadDecision = "0" eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D831DAB2-9806-4224-BB11-1E29A00603E1}\WpadDecisionTime = 2038dfa236ddd801 eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D831DAB2-9806-4224-BB11-1E29A00603E1}\WpadNetworkName = "Network 2" eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D831DAB2-9806-4224-BB11-1E29A00603E1}\a2-a7-2d-2f-50-a6 eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f001b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D831DAB2-9806-4224-BB11-1E29A00603E1}\WpadDecisionReason = "1" eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f001b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D831DAB2-9806-4224-BB11-1E29A00603E1}\WpadDecision = "0" eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D831DAB2-9806-4224-BB11-1E29A00603E1}\WpadDecision = "0" eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a2-a7-2d-2f-50-a6\WpadDecisionTime = 2038dfa236ddd801 eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D831DAB2-9806-4224-BB11-1E29A00603E1} eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a2-a7-2d-2f-50-a6 eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a2-a7-2d-2f-50-a6 eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D831DAB2-9806-4224-BB11-1E29A00603E1}\a2-a7-2d-2f-50-a6 eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a2-a7-2d-2f-50-a6\WpadDetectedUrl eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D831DAB2-9806-4224-BB11-1E29A00603E1} eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D831DAB2-9806-4224-BB11-1E29A00603E1}\WpadDecisionReason = "1" eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D831DAB2-9806-4224-BB11-1E29A00603E1}\WpadNetworkName = "Network 2" eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a2-a7-2d-2f-50-a6\WpadDecisionTime = 20a7d3d536ddd801 eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a2-a7-2d-2f-50-a6\WpadDecisionTime = 2038dfa236ddd801 eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a2-a7-2d-2f-50-a6\WpadDecisionReason = "1" eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f001b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a2-a7-2d-2f-50-a6\WpadDecisionReason = "1" eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D831DAB2-9806-4224-BB11-1E29A00603E1}\WpadDecisionTime = 20a7d3d536ddd801 eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exeeafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exedescription pid process target process PID 2004 wrote to memory of 784 2004 eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe WerFault.exe PID 2004 wrote to memory of 784 2004 eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe WerFault.exe PID 2004 wrote to memory of 784 2004 eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe WerFault.exe PID 2004 wrote to memory of 784 2004 eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe WerFault.exe PID 1004 wrote to memory of 1068 1004 eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe WerFault.exe PID 1004 wrote to memory of 1068 1004 eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe WerFault.exe PID 1004 wrote to memory of 1068 1004 eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe WerFault.exe PID 1004 wrote to memory of 1068 1004 eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe"C:\Users\Admin\AppData\Local\Temp\eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe"1⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exeC:\Users\Admin\AppData\Local\Temp\eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe -m security1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2004 -s 5682⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exeC:\Users\Admin\AppData\Local\Temp\eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe -m security1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1004 -s 5602⤵
- Program crash