Analysis
-
max time kernel
112s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
09/06/2024, 10:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
EternalBlue.exe
Resource
win7-20240215-en
windows7-x64
12 signatures
150 seconds
General
-
Target
EternalBlue.exe
-
Size
206KB
-
MD5
60a4b5f51d1d60f315449a294ac1ffff
-
SHA1
4a0f3b076fea64221f137d74a112322da64c3223
-
SHA256
dd3758da10a97e59287c0963462a8130b6a09b4de01755dc718eb994a73bd540
-
SHA512
c0504bab53b542f6ba2d7c027273167d84eb137615a9e382241fef4e837d36b50814e746415dce4b1feefe0f75ea5979deac7e4115d5fcef2397c49957a33534
-
SSDEEP
6144:zorIVENUnBbXDAnDmnsAjmJQ+y/L9S2z1TA+qSa/:oW1XDAnDmnsAjmJQ+yTvz9q
Score
8/10
Malware Config
Signatures
-
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" EternalBlue.exe -
Disables Task Manager via registry modification
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 EternalBlue.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.app.log dispdiag.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\BIOS dispdiag.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily dispdiag.exe -
Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeDebugPrivilege 2952 EternalBlue.exe Token: SeDebugPrivilege 2952 EternalBlue.exe Token: SeRestorePrivilege 2460 dispdiag.exe Token: SeRestorePrivilege 2460 dispdiag.exe Token: SeRestorePrivilege 2460 dispdiag.exe Token: SeRestorePrivilege 2460 dispdiag.exe Token: SeRestorePrivilege 2460 dispdiag.exe Token: SeRestorePrivilege 2460 dispdiag.exe Token: SeRestorePrivilege 2460 dispdiag.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2952 EternalBlue.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe 2952 EternalBlue.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2952 wrote to memory of 2756 2952 EternalBlue.exe 29 PID 2952 wrote to memory of 2756 2952 EternalBlue.exe 29 PID 2952 wrote to memory of 2756 2952 EternalBlue.exe 29 PID 2952 wrote to memory of 2460 2952 EternalBlue.exe 30 PID 2952 wrote to memory of 2460 2952 EternalBlue.exe 30 PID 2952 wrote to memory of 2460 2952 EternalBlue.exe 30 PID 2952 wrote to memory of 848 2952 EternalBlue.exe 32 PID 2952 wrote to memory of 848 2952 EternalBlue.exe 32 PID 2952 wrote to memory of 848 2952 EternalBlue.exe 32 PID 2952 wrote to memory of 2308 2952 EternalBlue.exe 33 PID 2952 wrote to memory of 2308 2952 EternalBlue.exe 33 PID 2952 wrote to memory of 2308 2952 EternalBlue.exe 33 PID 2952 wrote to memory of 1072 2952 EternalBlue.exe 35 PID 2952 wrote to memory of 1072 2952 EternalBlue.exe 35 PID 2952 wrote to memory of 1072 2952 EternalBlue.exe 35 PID 2952 wrote to memory of 1076 2952 EternalBlue.exe 38 PID 2952 wrote to memory of 1076 2952 EternalBlue.exe 38 PID 2952 wrote to memory of 1076 2952 EternalBlue.exe 38 PID 2952 wrote to memory of 572 2952 EternalBlue.exe 39 PID 2952 wrote to memory of 572 2952 EternalBlue.exe 39 PID 2952 wrote to memory of 572 2952 EternalBlue.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\EternalBlue.exe"C:\Users\Admin\AppData\Local\Temp\EternalBlue.exe"1⤵
- Disables RegEdit via registry modification
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exedw20.exe -x -s 11722⤵PID:2756
-
-
C:\Windows\System32\dispdiag.exe"C:\Windows\System32\dispdiag.exe"2⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:2460
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Windows\System32\C_28595.NLS2⤵
- Modifies registry class
PID:848
-
-
C:\Windows\System32\PnPutil.exe"C:\Windows\System32\PnPutil.exe"2⤵PID:2308
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Windows\System32\C_20936.NLS2⤵
- Modifies registry class
PID:1072
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Windows\System32\MSNP.ax2⤵
- Modifies registry class
PID:1076
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Windows\System32\pegibbfc.rs2⤵
- Modifies registry class
PID:572
-