Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system -
submitted
05-12-2023 17:41
Static task
static1
Behavioral task
behavioral1
Sample
eed86ba53d4d84ceef045203667f3a4a4636948c36d4bb45ba8de5d69bf87778.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
eed86ba53d4d84ceef045203667f3a4a4636948c36d4bb45ba8de5d69bf87778.exe
Resource
win10v2004-20231127-en
General
-
Target
eed86ba53d4d84ceef045203667f3a4a4636948c36d4bb45ba8de5d69bf87778.exe
-
Size
5.0MB
-
MD5
58a71165053c76d81f99b3d46d4739a2
-
SHA1
7ed53c7f2c2628e576ee2436d3493aaa7d371265
-
SHA256
eed86ba53d4d84ceef045203667f3a4a4636948c36d4bb45ba8de5d69bf87778
-
SHA512
4b43646a9590b5e5c95daae4b71f6e5c676d69461bd209b8b6c0cdf41c196921df0b57438f27f242918f85f4d68d642d213a6da910542e686ce7238f1c97608e
-
SSDEEP
98304:yDqPoB2SUDk36SAEdhvxWa9P593R8yAVp2H:yDqPDxk3ZAEUadzR8yc4H
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (3196) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 1 IoCs
Processes:
tasksche.exepid process 4060 tasksche.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in Windows directory 1 IoCs
Processes:
eed86ba53d4d84ceef045203667f3a4a4636948c36d4bb45ba8de5d69bf87778.exedescription ioc process File created C:\WINDOWS\tasksche.exe eed86ba53d4d84ceef045203667f3a4a4636948c36d4bb45ba8de5d69bf87778.exe -
Modifies data under HKEY_USERS 5 IoCs
Processes:
eed86ba53d4d84ceef045203667f3a4a4636948c36d4bb45ba8de5d69bf87778.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" eed86ba53d4d84ceef045203667f3a4a4636948c36d4bb45ba8de5d69bf87778.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" eed86ba53d4d84ceef045203667f3a4a4636948c36d4bb45ba8de5d69bf87778.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" eed86ba53d4d84ceef045203667f3a4a4636948c36d4bb45ba8de5d69bf87778.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" eed86ba53d4d84ceef045203667f3a4a4636948c36d4bb45ba8de5d69bf87778.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ eed86ba53d4d84ceef045203667f3a4a4636948c36d4bb45ba8de5d69bf87778.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
svchost.exedescription pid process Token: SeManageVolumePrivilege 3676 svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\eed86ba53d4d84ceef045203667f3a4a4636948c36d4bb45ba8de5d69bf87778.exe"C:\Users\Admin\AppData\Local\Temp\eed86ba53d4d84ceef045203667f3a4a4636948c36d4bb45ba8de5d69bf87778.exe"1⤵
- Drops file in Windows directory
-
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\eed86ba53d4d84ceef045203667f3a4a4636948c36d4bb45ba8de5d69bf87778.exeC:\Users\Admin\AppData\Local\Temp\eed86ba53d4d84ceef045203667f3a4a4636948c36d4bb45ba8de5d69bf87778.exe -m security1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\tasksche.exeFilesize
3.4MB
MD542feb8cfc81e600a9dffb27dc4d98aaa
SHA1ab166680c392b9e5cb5ffd5204304c57744c75d1
SHA2563e0134e6498eaf17a3195849491877e1f08ccc4ed2663c4ab42a96321f2b9475
SHA5122a147e989d8e174f3ca192593c2229a0232d6e9897bf3add55ffeb4f2078dbf0f0d450fb5f5515d517d51829f4da0c2b2166c03fcc7bdd2a3709617065eb492b
-
memory/3676-3-0x00000296D6F80000-0x00000296D6F90000-memory.dmpFilesize
64KB
-
memory/3676-19-0x00000296D7080000-0x00000296D7090000-memory.dmpFilesize
64KB
-
memory/3676-35-0x00000296DF3F0000-0x00000296DF3F1000-memory.dmpFilesize
4KB
-
memory/3676-37-0x00000296DF420000-0x00000296DF421000-memory.dmpFilesize
4KB
-
memory/3676-38-0x00000296DF420000-0x00000296DF421000-memory.dmpFilesize
4KB
-
memory/3676-39-0x00000296DF530000-0x00000296DF531000-memory.dmpFilesize
4KB