Analysis
- max time kernel
53s - max time network
57s - platform
windows7_x64 - resource
win7-20220901-en - resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system - submitted
12/10/2022, 04:22
Static task
static1
Behavioral task
behavioral1
Sample
9678763f65e207dde99f4f8723ddfc44bc2d3f9b490aa3d3d4676c661474d59f.exe
Resource
win7-20220901-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
9678763f65e207dde99f4f8723ddfc44bc2d3f9b490aa3d3d4676c661474d59f.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 9678763f65e207dde99f4f8723ddfc44bc2d3f9b490aa3d3d4676c661474d59f.exe
- Size 6.4MB
- Sample221012-ey8vzacdep
- SHA256 9678763f65e207dde99f4f8723ddfc44bc2d3f9b490aa3d3d4676c661474d59f
- MD5 1d38638153085a0a0f0a4f7174e52a9b
- SHA1 f0bb8179052451ac327e6fff048bc27c73bf7310
- SHA512 ff7c5b94ffff6e6d877e18b3fb543235d3bcb3e27b5d27a5fdc60005b4095a1ba21a4365a7a41bf6ed1e42fe547d6ddf0d05ed78442cd7ec42668b80a0a0d8f6
- SSDEEP 98304:5iqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2HI:5iqPe1Cxcxk3ZAEUadzR8yc4HI
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Wannacry
WannaCry is a ransomware cryptoworm.
- Executes dropped EXE 1 IoCs
pid Process 1436 tasksche.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat 9678763f65e207dde99f4f8723ddfc44bc2d3f9b490aa3d3d4676c661474d59f.exe - Drops file in Windows directory 1 IoCs
description ioc Process File created C:\WINDOWS\tasksche.exe 9678763f65e207dde99f4f8723ddfc44bc2d3f9b490aa3d3d4676c661474d59f.exe - Modifies data under HKEY_USERS 24 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings 9678763f65e207dde99f4f8723ddfc44bc2d3f9b490aa3d3d4676c661474d59f.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{17D5C449-538A-4215-A907-44912CD21314}\a6-17-aa-63-f9-ce 9678763f65e207dde99f4f8723ddfc44bc2d3f9b490aa3d3d4676c661474d59f.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" 9678763f65e207dde99f4f8723ddfc44bc2d3f9b490aa3d3d4676c661474d59f.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{17D5C449-538A-4215-A907-44912CD21314}\WpadNetworkName = "Network 2" 9678763f65e207dde99f4f8723ddfc44bc2d3f9b490aa3d3d4676c661474d59f.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a6-17-aa-63-f9-ce\WpadDecision = "0" 9678763f65e207dde99f4f8723ddfc44bc2d3f9b490aa3d3d4676c661474d59f.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0016000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 9678763f65e207dde99f4f8723ddfc44bc2d3f9b490aa3d3d4676c661474d59f.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{17D5C449-538A-4215-A907-44912CD21314} 9678763f65e207dde99f4f8723ddfc44bc2d3f9b490aa3d3d4676c661474d59f.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections 9678763f65e207dde99f4f8723ddfc44bc2d3f9b490aa3d3d4676c661474d59f.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 9678763f65e207dde99f4f8723ddfc44bc2d3f9b490aa3d3d4676c661474d59f.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings 9678763f65e207dde99f4f8723ddfc44bc2d3f9b490aa3d3d4676c661474d59f.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 9678763f65e207dde99f4f8723ddfc44bc2d3f9b490aa3d3d4676c661474d59f.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 9678763f65e207dde99f4f8723ddfc44bc2d3f9b490aa3d3d4676c661474d59f.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 9678763f65e207dde99f4f8723ddfc44bc2d3f9b490aa3d3d4676c661474d59f.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{17D5C449-538A-4215-A907-44912CD21314}\WpadDecisionReason = "1" 9678763f65e207dde99f4f8723ddfc44bc2d3f9b490aa3d3d4676c661474d59f.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{17D5C449-538A-4215-A907-44912CD21314}\WpadDecisionTime = 900bb25cf2ddd801 9678763f65e207dde99f4f8723ddfc44bc2d3f9b490aa3d3d4676c661474d59f.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a6-17-aa-63-f9-ce\WpadDecisionReason = "1" 9678763f65e207dde99f4f8723ddfc44bc2d3f9b490aa3d3d4676c661474d59f.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a6-17-aa-63-f9-ce 9678763f65e207dde99f4f8723ddfc44bc2d3f9b490aa3d3d4676c661474d59f.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a6-17-aa-63-f9-ce\WpadDecisionTime = 900bb25cf2ddd801 9678763f65e207dde99f4f8723ddfc44bc2d3f9b490aa3d3d4676c661474d59f.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" 9678763f65e207dde99f4f8723ddfc44bc2d3f9b490aa3d3d4676c661474d59f.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 9678763f65e207dde99f4f8723ddfc44bc2d3f9b490aa3d3d4676c661474d59f.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" 9678763f65e207dde99f4f8723ddfc44bc2d3f9b490aa3d3d4676c661474d59f.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 9678763f65e207dde99f4f8723ddfc44bc2d3f9b490aa3d3d4676c661474d59f.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad 9678763f65e207dde99f4f8723ddfc44bc2d3f9b490aa3d3d4676c661474d59f.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{17D5C449-538A-4215-A907-44912CD21314}\WpadDecision = "0" 9678763f65e207dde99f4f8723ddfc44bc2d3f9b490aa3d3d4676c661474d59f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9678763f65e207dde99f4f8723ddfc44bc2d3f9b490aa3d3d4676c661474d59f.exe"C:\Users\Admin\AppData\Local\Temp\9678763f65e207dde99f4f8723ddfc44bc2d3f9b490aa3d3d4676c661474d59f.exe"1⤵
- Drops file in Windows directory
PID:1760 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i2⤵
- Executes dropped EXE
PID:1436
-
-
C:\Users\Admin\AppData\Local\Temp\9678763f65e207dde99f4f8723ddfc44bc2d3f9b490aa3d3d4676c661474d59f.exeC:\Users\Admin\AppData\Local\Temp\9678763f65e207dde99f4f8723ddfc44bc2d3f9b490aa3d3d4676c661474d59f.exe -m security1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1640
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\tasksche.exe
- Size 3.4MB
- SHA256 2584e1521065e45ec3c17767c065429038fc6291c091097ea8b22c8a502c41dd
- MD5 7f7ccaa16fb15eb1c7399d422f8363e8
- SHA1 bd44d0ab543bf814d93b719c24e90d8dd7111234
- SHA512 83e334b80de08903cfa9891a3fa349c1ece7e19f8e62b74a017512fa9a7989a0fd31929bf1fc13847bee04f2da3dacf6bc3f5ee58f0e4b9d495f4b9af12ed2b7
- SSDEEP 98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2Hj:QqPe1Cxcxk3ZAEUadzR8yc4Hj
- MD5 SHA1 SHA512 SSDEEP