Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
16-05-2024 18:58
Static task
static1
Behavioral task
behavioral1
Sample
133c67eb527809b01c5977c560949ec03c3fb5b87c8ed4bcd38c580c8bfdbd10.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
133c67eb527809b01c5977c560949ec03c3fb5b87c8ed4bcd38c580c8bfdbd10.exe
Resource
win10v2004-20240426-en
General
-
Target
133c67eb527809b01c5977c560949ec03c3fb5b87c8ed4bcd38c580c8bfdbd10.exe
-
Size
3.6MB
-
MD5
7b43d71dbfb4dc8eba0e3e2a010c5a31
-
SHA1
ebaca15297aa0a266c5ebf7f22f08891dc83903d
-
SHA256
133c67eb527809b01c5977c560949ec03c3fb5b87c8ed4bcd38c580c8bfdbd10
-
SHA512
dbff1d2971ffd81f1a3635b8dd6cbbc0543c4f0215f620bbdff04bbf984bf512a9891e177c14f19e5294455b25b1ca8548d532bd47971fb5eb578603ecc91349
-
SSDEEP
49152:2nAQJGx+TSqTdX1HkQo6SAASxJM0H9PAMEcaEau3R8yAH1plAHI:yDwxcSUDk36SA7xWa9P593R8yAVp2HI
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (3284) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 1 IoCs
Processes:
tasksche.exepid process 2588 tasksche.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in System32 directory 1 IoCs
Processes:
133c67eb527809b01c5977c560949ec03c3fb5b87c8ed4bcd38c580c8bfdbd10.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat 133c67eb527809b01c5977c560949ec03c3fb5b87c8ed4bcd38c580c8bfdbd10.exe -
Drops file in Windows directory 1 IoCs
Processes:
133c67eb527809b01c5977c560949ec03c3fb5b87c8ed4bcd38c580c8bfdbd10.exedescription ioc process File created C:\WINDOWS\tasksche.exe 133c67eb527809b01c5977c560949ec03c3fb5b87c8ed4bcd38c580c8bfdbd10.exe -
Modifies data under HKEY_USERS 24 IoCs
Processes:
133c67eb527809b01c5977c560949ec03c3fb5b87c8ed4bcd38c580c8bfdbd10.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{16B8C21C-FCFD-4320-935D-98F49C0D03A4} 133c67eb527809b01c5977c560949ec03c3fb5b87c8ed4bcd38c580c8bfdbd10.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{16B8C21C-FCFD-4320-935D-98F49C0D03A4}\WpadDecision = "0" 133c67eb527809b01c5977c560949ec03c3fb5b87c8ed4bcd38c580c8bfdbd10.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-0e-c6-f9-27-49 133c67eb527809b01c5977c560949ec03c3fb5b87c8ed4bcd38c580c8bfdbd10.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-0e-c6-f9-27-49\WpadDecisionReason = "1" 133c67eb527809b01c5977c560949ec03c3fb5b87c8ed4bcd38c580c8bfdbd10.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-0e-c6-f9-27-49\WpadDecisionTime = b008b103c3a7da01 133c67eb527809b01c5977c560949ec03c3fb5b87c8ed4bcd38c580c8bfdbd10.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 133c67eb527809b01c5977c560949ec03c3fb5b87c8ed4bcd38c580c8bfdbd10.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 133c67eb527809b01c5977c560949ec03c3fb5b87c8ed4bcd38c580c8bfdbd10.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 133c67eb527809b01c5977c560949ec03c3fb5b87c8ed4bcd38c580c8bfdbd10.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-0e-c6-f9-27-49\WpadDecision = "0" 133c67eb527809b01c5977c560949ec03c3fb5b87c8ed4bcd38c580c8bfdbd10.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 133c67eb527809b01c5977c560949ec03c3fb5b87c8ed4bcd38c580c8bfdbd10.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{16B8C21C-FCFD-4320-935D-98F49C0D03A4}\WpadDecisionReason = "1" 133c67eb527809b01c5977c560949ec03c3fb5b87c8ed4bcd38c580c8bfdbd10.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 133c67eb527809b01c5977c560949ec03c3fb5b87c8ed4bcd38c580c8bfdbd10.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" 133c67eb527809b01c5977c560949ec03c3fb5b87c8ed4bcd38c580c8bfdbd10.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" 133c67eb527809b01c5977c560949ec03c3fb5b87c8ed4bcd38c580c8bfdbd10.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad 133c67eb527809b01c5977c560949ec03c3fb5b87c8ed4bcd38c580c8bfdbd10.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f005e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 133c67eb527809b01c5977c560949ec03c3fb5b87c8ed4bcd38c580c8bfdbd10.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{16B8C21C-FCFD-4320-935D-98F49C0D03A4}\WpadDecisionTime = b008b103c3a7da01 133c67eb527809b01c5977c560949ec03c3fb5b87c8ed4bcd38c580c8bfdbd10.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections 133c67eb527809b01c5977c560949ec03c3fb5b87c8ed4bcd38c580c8bfdbd10.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings 133c67eb527809b01c5977c560949ec03c3fb5b87c8ed4bcd38c580c8bfdbd10.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 133c67eb527809b01c5977c560949ec03c3fb5b87c8ed4bcd38c580c8bfdbd10.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{16B8C21C-FCFD-4320-935D-98F49C0D03A4}\ea-0e-c6-f9-27-49 133c67eb527809b01c5977c560949ec03c3fb5b87c8ed4bcd38c580c8bfdbd10.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings 133c67eb527809b01c5977c560949ec03c3fb5b87c8ed4bcd38c580c8bfdbd10.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" 133c67eb527809b01c5977c560949ec03c3fb5b87c8ed4bcd38c580c8bfdbd10.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{16B8C21C-FCFD-4320-935D-98F49C0D03A4}\WpadNetworkName = "Network 3" 133c67eb527809b01c5977c560949ec03c3fb5b87c8ed4bcd38c580c8bfdbd10.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\133c67eb527809b01c5977c560949ec03c3fb5b87c8ed4bcd38c580c8bfdbd10.exe"C:\Users\Admin\AppData\Local\Temp\133c67eb527809b01c5977c560949ec03c3fb5b87c8ed4bcd38c580c8bfdbd10.exe"1⤵
- Drops file in Windows directory
-
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\133c67eb527809b01c5977c560949ec03c3fb5b87c8ed4bcd38c580c8bfdbd10.exeC:\Users\Admin\AppData\Local\Temp\133c67eb527809b01c5977c560949ec03c3fb5b87c8ed4bcd38c580c8bfdbd10.exe -m security1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\tasksche.exeFilesize
3.4MB
MD5aa7f6c30c24531e82018968e7aaf8138
SHA11d0723bcd706cbc0ba7b4111b4d18d549ad7a8f7
SHA256dc3fe9a318d69f41e20f378fbd3368b8b7ce30cf1fa17f8d8318612acd24c80c
SHA5122a267267bfa44f74cda7e5f58d1c994381b290ac9c0a46ea8276f60db042fb50f7ba32352478910493a4318b2e8436e9468627d2704921a1203079d3fffce0c1