Resubmissions
11-06-2024 12:56
240611-p6qz8sxeqc 1011-06-2024 12:56
240611-p6cgvaxhrn 1011-06-2024 12:53
240611-p4mj2axhmj 10Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
11-06-2024 12:56
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-11_bf86e3bba6212a58f4923dfee37f360d_wannacry.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-06-11_bf86e3bba6212a58f4923dfee37f360d_wannacry.exe
-
Size
5.0MB
-
MD5
bf86e3bba6212a58f4923dfee37f360d
-
SHA1
82827607dc32ab560618267ea3551b4b2068da71
-
SHA256
baad53c5f4c4165efb6e03a911abd3a3afda33eeeb046625ede7fccbb32509ff
-
SHA512
cd4fc73059583196957caee2c4942b0adf2d9e9b05358f20ee2a9b5dc1d654d47e7b04968733a4a519c3d3f424858c4c204c2751d8a99916f9e0a63092cbc396
-
SSDEEP
49152:2nAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9P:yDqPoBhz1aRxcSUDk36SAEdhvxWa9P
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (2936) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 4 IoCs
Processes:
tasksche.exetasksche.exetasksche.exetasksche.exepid process 2204 tasksche.exe 4616 tasksche.exe 3384 tasksche.exe 4584 tasksche.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in Windows directory 4 IoCs
Processes:
2024-06-11_bf86e3bba6212a58f4923dfee37f360d_wannacry.exe2024-06-11_bf86e3bba6212a58f4923dfee37f360d_wannacry.exe2024-06-11_bf86e3bba6212a58f4923dfee37f360d_wannacry.exe2024-06-11_bf86e3bba6212a58f4923dfee37f360d_wannacry.exedescription ioc process File created C:\WINDOWS\tasksche.exe 2024-06-11_bf86e3bba6212a58f4923dfee37f360d_wannacry.exe File created C:\WINDOWS\tasksche.exe 2024-06-11_bf86e3bba6212a58f4923dfee37f360d_wannacry.exe File created C:\WINDOWS\tasksche.exe 2024-06-11_bf86e3bba6212a58f4923dfee37f360d_wannacry.exe File created C:\WINDOWS\tasksche.exe 2024-06-11_bf86e3bba6212a58f4923dfee37f360d_wannacry.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
SearchProtocolHost.exeSearchFilterHost.exe2024-06-11_bf86e3bba6212a58f4923dfee37f360d_wannacry.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001f8096f6febbda01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000163cfbf8febbda01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009670ebf7febbda01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008835f9f9febbda01 SearchProtocolHost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 2024-06-11_bf86e3bba6212a58f4923dfee37f360d_wannacry.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008554ecf6febbda01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList SearchProtocolHost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 2024-06-11_bf86e3bba6212a58f4923dfee37f360d_wannacry.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" SearchProtocolHost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 2024-06-11_bf86e3bba6212a58f4923dfee37f360d_wannacry.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c9c29cf7febbda01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006941d9f6febbda01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000444360f8febbda01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList SearchProtocolHost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 2024-06-11_bf86e3bba6212a58f4923dfee37f360d_wannacry.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f3c1bbf7febbda01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ac031cf7febbda01 SearchProtocolHost.exe -
Suspicious behavior: EnumeratesProcesses 48 IoCs
Processes:
taskmgr.exepid process 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 29 IoCs
Processes:
SearchIndexer.exetaskmgr.exedescription pid process Token: 33 2684 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 2684 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2684 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2684 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2684 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2684 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2684 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2684 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2684 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2684 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2684 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2684 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2684 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2684 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2684 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2684 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2684 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2684 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2684 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2684 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2684 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2684 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2684 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2684 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2684 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2684 SearchIndexer.exe Token: SeDebugPrivilege 3060 taskmgr.exe Token: SeSystemProfilePrivilege 3060 taskmgr.exe Token: SeCreateGlobalPrivilege 3060 taskmgr.exe -
Suspicious use of FindShellTrayWindow 60 IoCs
Processes:
taskmgr.exepid process 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe -
Suspicious use of SendNotifyMessage 59 IoCs
Processes:
taskmgr.exepid process 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe 3060 taskmgr.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
SearchIndexer.exedescription pid process target process PID 2684 wrote to memory of 4500 2684 SearchIndexer.exe SearchProtocolHost.exe PID 2684 wrote to memory of 4500 2684 SearchIndexer.exe SearchProtocolHost.exe PID 2684 wrote to memory of 1148 2684 SearchIndexer.exe SearchFilterHost.exe PID 2684 wrote to memory of 1148 2684 SearchIndexer.exe SearchFilterHost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_bf86e3bba6212a58f4923dfee37f360d_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-11_bf86e3bba6212a58f4923dfee37f360d_wannacry.exe"1⤵
- Drops file in Windows directory
PID:1152 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i2⤵
- Executes dropped EXE
PID:2204
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_bf86e3bba6212a58f4923dfee37f360d_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2024-06-11_bf86e3bba6212a58f4923dfee37f360d_wannacry.exe -m security1⤵
- Modifies data under HKEY_USERS
PID:2720
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:512
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:4500 -
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 7842⤵
- Modifies data under HKEY_USERS
PID:1148
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_bf86e3bba6212a58f4923dfee37f360d_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-11_bf86e3bba6212a58f4923dfee37f360d_wannacry.exe"1⤵
- Drops file in Windows directory
PID:4932 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i2⤵
- Executes dropped EXE
PID:4616
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_bf86e3bba6212a58f4923dfee37f360d_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-11_bf86e3bba6212a58f4923dfee37f360d_wannacry.exe"1⤵
- Drops file in Windows directory
PID:4608 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i2⤵
- Executes dropped EXE
PID:3384
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_bf86e3bba6212a58f4923dfee37f360d_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-11_bf86e3bba6212a58f4923dfee37f360d_wannacry.exe"1⤵
- Drops file in Windows directory
PID:4636 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i2⤵
- Executes dropped EXE
PID:4584
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3060
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.4MB
MD5469ea6f2c5d9d4ac749651e2f5a0f6a9
SHA15c7c3b5cd9f518c3922bb907836fbad662c8729f
SHA25629b50bde6dac39948c22579248c96a3488c5c94c6f127a4bd11d24abfcb6569f
SHA51296ec39bcdca9a4a2352e377cb20676a7a197dbe015ef0a61eb281a65c867955d9f065cf6e102ef2083aab27a501bc34e07536abbfc19bafe225f628803fd083a