Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05-07-2024 12:28
Static task
static1
Behavioral task
behavioral1
Sample
20240705d92332e476685d0cfe0fca5dc060f625wannacry.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
20240705d92332e476685d0cfe0fca5dc060f625wannacry.exe
Resource
win10v2004-20240704-en
General
-
Target
20240705d92332e476685d0cfe0fca5dc060f625wannacry.exe
-
Size
5.0MB
-
MD5
d92332e476685d0cfe0fca5dc060f625
-
SHA1
5e9ca2efdc4b775ece0f1e1dadeabce0255ba5d3
-
SHA256
b063505b0b1581f2cfd27510b252d690f5ddba4f21c60efe2718292369c40d60
-
SHA512
f8d33be4d060087bfbfe51fbeff3c94453b7f6218d029420b5717865bccceb7ed976d6b997a00edaa7ceff1e08b4e9ea88cfb0c6032593bc702d9e8c750c02f5
-
SSDEEP
49152:UnpENPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnv:EpOoBhz1aRxcSUDk36SAEdhv
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (3152) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 1 IoCs
Processes:
tasksche.exepid process 2380 tasksche.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in System32 directory 5 IoCs
Processes:
20240705d92332e476685d0cfe0fca5dc060f625wannacry.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat 20240705d92332e476685d0cfe0fca5dc060f625wannacry.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\090MMQGO.txt 20240705d92332e476685d0cfe0fca5dc060f625wannacry.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\090MMQGO.txt 20240705d92332e476685d0cfe0fca5dc060f625wannacry.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\83VVQHZ5.txt 20240705d92332e476685d0cfe0fca5dc060f625wannacry.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\83VVQHZ5.txt 20240705d92332e476685d0cfe0fca5dc060f625wannacry.exe -
Drops file in Windows directory 3 IoCs
Processes:
20240705d92332e476685d0cfe0fca5dc060f625wannacry.exetasksche.exedescription ioc process File created C:\WINDOWS\tasksche.exe 20240705d92332e476685d0cfe0fca5dc060f625wannacry.exe File created C:\Windows\__tmp_rar_sfx_access_check_259404718 tasksche.exe File created C:\Windows\eee.exe tasksche.exe -
Modifies data under HKEY_USERS 24 IoCs
Processes:
20240705d92332e476685d0cfe0fca5dc060f625wannacry.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9e-2b-5f-05-fd-0a\WpadDecision = "0" 20240705d92332e476685d0cfe0fca5dc060f625wannacry.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 20240705d92332e476685d0cfe0fca5dc060f625wannacry.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 20240705d92332e476685d0cfe0fca5dc060f625wannacry.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4117A01F-A329-431E-ADBE-13CB68E85CE1}\WpadNetworkName = "Network 3" 20240705d92332e476685d0cfe0fca5dc060f625wannacry.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9e-2b-5f-05-fd-0a 20240705d92332e476685d0cfe0fca5dc060f625wannacry.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9e-2b-5f-05-fd-0a\WpadDecisionTime = a0efa8e5d6ceda01 20240705d92332e476685d0cfe0fca5dc060f625wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" 20240705d92332e476685d0cfe0fca5dc060f625wannacry.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 20240705d92332e476685d0cfe0fca5dc060f625wannacry.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 20240705d92332e476685d0cfe0fca5dc060f625wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4117A01F-A329-431E-ADBE-13CB68E85CE1}\WpadDecision = "0" 20240705d92332e476685d0cfe0fca5dc060f625wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9e-2b-5f-05-fd-0a\WpadDecisionReason = "1" 20240705d92332e476685d0cfe0fca5dc060f625wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" 20240705d92332e476685d0cfe0fca5dc060f625wannacry.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0110000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 20240705d92332e476685d0cfe0fca5dc060f625wannacry.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4117A01F-A329-431E-ADBE-13CB68E85CE1} 20240705d92332e476685d0cfe0fca5dc060f625wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4117A01F-A329-431E-ADBE-13CB68E85CE1}\WpadDecisionReason = "1" 20240705d92332e476685d0cfe0fca5dc060f625wannacry.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4117A01F-A329-431E-ADBE-13CB68E85CE1}\9e-2b-5f-05-fd-0a 20240705d92332e476685d0cfe0fca5dc060f625wannacry.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 20240705d92332e476685d0cfe0fca5dc060f625wannacry.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad 20240705d92332e476685d0cfe0fca5dc060f625wannacry.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4117A01F-A329-431E-ADBE-13CB68E85CE1}\WpadDecisionTime = a0efa8e5d6ceda01 20240705d92332e476685d0cfe0fca5dc060f625wannacry.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings 20240705d92332e476685d0cfe0fca5dc060f625wannacry.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections 20240705d92332e476685d0cfe0fca5dc060f625wannacry.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 20240705d92332e476685d0cfe0fca5dc060f625wannacry.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings 20240705d92332e476685d0cfe0fca5dc060f625wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" 20240705d92332e476685d0cfe0fca5dc060f625wannacry.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
tasksche.exepid process 2380 tasksche.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
20240705d92332e476685d0cfe0fca5dc060f625wannacry.exedescription pid process target process PID 2000 wrote to memory of 2380 2000 20240705d92332e476685d0cfe0fca5dc060f625wannacry.exe tasksche.exe PID 2000 wrote to memory of 2380 2000 20240705d92332e476685d0cfe0fca5dc060f625wannacry.exe tasksche.exe PID 2000 wrote to memory of 2380 2000 20240705d92332e476685d0cfe0fca5dc060f625wannacry.exe tasksche.exe PID 2000 wrote to memory of 2380 2000 20240705d92332e476685d0cfe0fca5dc060f625wannacry.exe tasksche.exe PID 2000 wrote to memory of 2380 2000 20240705d92332e476685d0cfe0fca5dc060f625wannacry.exe tasksche.exe PID 2000 wrote to memory of 2380 2000 20240705d92332e476685d0cfe0fca5dc060f625wannacry.exe tasksche.exe PID 2000 wrote to memory of 2380 2000 20240705d92332e476685d0cfe0fca5dc060f625wannacry.exe tasksche.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\20240705d92332e476685d0cfe0fca5dc060f625wannacry.exe"C:\Users\Admin\AppData\Local\Temp\20240705d92332e476685d0cfe0fca5dc060f625wannacry.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
PID:2380
-
C:\Users\Admin\AppData\Local\Temp\20240705d92332e476685d0cfe0fca5dc060f625wannacry.exeC:\Users\Admin\AppData\Local\Temp\20240705d92332e476685d0cfe0fca5dc060f625wannacry.exe -m security1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2952
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
MD540db3b23bf92d4abc4b8968ee0eff3c8
SHA1fcfe3177895813dd8481b3f2015995ceda5ada46
SHA256343a4acdc83be9df0a79e30cde7d4f2e0a0371d09927460e8471c4c2950385f3
SHA5121ddbd88318f266e4ff943737ae098b407a87f8c9fb6d59941e656fd60e359bcf92ebcf0fec8de774c316d444d4f0bc36690af365196335b394b7163f19bab53f