wannacry | e72193fe924b374245e1588110df8b95b5db7adb8a360932ff9741b108d50cc4

Resubmissions

31-12-2024 22:05

241231-1znr3s1qdw 10

03-08-2024 09:22

240803-lb278sygmp 10

03-08-2024 09:16

240803-k8x44stenh 10

Analysis

max time kernel
226s
max time network
224s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03-08-2024 09:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-08-03_deb24d34e3b6f271369605c8c0e734a0_wannacry.exe
Size

5.0MB
MD5

deb24d34e3b6f271369605c8c0e734a0
SHA1

3ca024882307e131d554221972e8dcf80879608a
SHA256

e72193fe924b374245e1588110df8b95b5db7adb8a360932ff9741b108d50cc4
SHA512

e0ade5414431536a40db5c3fec6990db8e94cf2f6bc8d9558619b10ac704662ad6c9426b70ca6613ab0f408612b79c402cfe6d82a8b6db13b033d8401e91541a
SSDEEP

98304:yDqPoBhz1aRxcSUDk36SAEdhvxWa9P5h3R8yAVp2H:yDqPe1Cxcxk3ZAEUadvR8yc4H

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (878) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 9 IoCs

pid	Process
3236	tasksche.exe
2096	tasksche.exe
2628	tasksche.exe
4116	tasksche.exe
1356	tasksche.exe
1456	tasksche.exe
3600	tasksche.exe
1136	tasksche.exe
2348	tasksche.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	2024-08-03_deb24d34e3b6f271369605c8c0e734a0_wannacry.exe
File created	C:\WINDOWS\tasksche.exe	2024-08-03_deb24d34e3b6f271369605c8c0e734a0_wannacry.exe
File opened for modification	C:\WINDOWS\tasksche.exe	2024-08-03_deb24d34e3b6f271369605c8c0e734a0_wannacry.exe
File created	C:\WINDOWS\tasksche.exe	2024-08-03_deb24d34e3b6f271369605c8c0e734a0_wannacry.exe
File created	C:\WINDOWS\tasksche.exe	2024-08-03_deb24d34e3b6f271369605c8c0e734a0_wannacry.exe
File created	C:\WINDOWS\tasksche.exe	2024-08-03_deb24d34e3b6f271369605c8c0e734a0_wannacry.exe
File created	C:\WINDOWS\tasksche.exe	2024-08-03_deb24d34e3b6f271369605c8c0e734a0_wannacry.exe
File created	C:\WINDOWS\tasksche.exe	2024-08-03_deb24d34e3b6f271369605c8c0e734a0_wannacry.exe
File opened for modification	C:\WINDOWS\tasksche.exe	2024-08-03_deb24d34e3b6f271369605c8c0e734a0_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-08-03_deb24d34e3b6f271369605c8c0e734a0_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-08-03_deb24d34e3b6f271369605c8c0e734a0_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-08-03_deb24d34e3b6f271369605c8c0e734a0_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-08-03_deb24d34e3b6f271369605c8c0e734a0_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-08-03_deb24d34e3b6f271369605c8c0e734a0_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-08-03_deb24d34e3b6f271369605c8c0e734a0_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-08-03_deb24d34e3b6f271369605c8c0e734a0_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-08-03_deb24d34e3b6f271369605c8c0e734a0_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-08-03_deb24d34e3b6f271369605c8c0e734a0_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-08-03_deb24d34e3b6f271369605c8c0e734a0_wannacry.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	2024-08-03_deb24d34e3b6f271369605c8c0e734a0_wannacry.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000401c560187e5da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009be6de0087e5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f8bb340187e5da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000042eccb0387e5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	2024-08-03_deb24d34e3b6f271369605c8c0e734a0_wannacry.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	2024-08-03_deb24d34e3b6f271369605c8c0e734a0_wannacry.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 60 IoCs

pid	Process
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe
1944	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeDebugPrivilege	4380	taskmgr.exe
Token: SeSystemProfilePrivilege	4380	taskmgr.exe
Token: SeCreateGlobalPrivilege	4380	taskmgr.exe
Token: 33	4380	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4380	taskmgr.exe
Token: 33	3016	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3016	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3016	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3016	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3016	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3016	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3016	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3016	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3016	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3016	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3016	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3016	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3016	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3016	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3016	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3016	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3016	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3016	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3016	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3016	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3016	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3016	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3016	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3016	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3016	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3016	SearchIndexer.exe
Token: SeDebugPrivilege	1944	taskmgr.exe
Token: SeSystemProfilePrivilege	1944	taskmgr.exe
Token: SeCreateGlobalPrivilege	1944	taskmgr.exe
Token: 33	1944	taskmgr.exe
Token: SeIncBasePriorityPrivilege	1944	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe
4380	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4572	OpenWith.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 3296	3016	SearchIndexer.exe	96
PID 3016 wrote to memory of 3296	3016	SearchIndexer.exe	96
PID 3016 wrote to memory of 4908	3016	SearchIndexer.exe	97
PID 3016 wrote to memory of 4908	3016	SearchIndexer.exe	97

C:\Users\Admin\AppData\Local\Temp\2024-08-03_deb24d34e3b6f271369605c8c0e734a0_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2024-08-03_deb24d34e3b6f271369605c8c0e734a0_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3560
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:3236

C:\Users\Admin\AppData\Local\Temp\2024-08-03_deb24d34e3b6f271369605c8c0e734a0_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2024-08-03_deb24d34e3b6f271369605c8c0e734a0_wannacry.exe -m security
1⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:512

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4380

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4572

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3296
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 804 808 816 8192 812 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4908

C:\Users\Admin\Desktop\2024-08-03_deb24d34e3b6f271369605c8c0e734a0_wannacry.exe
"C:\Users\Admin\Desktop\2024-08-03_deb24d34e3b6f271369605c8c0e734a0_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2020
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:2096

C:\Users\Admin\Desktop\2024-08-03_deb24d34e3b6f271369605c8c0e734a0_wannacry.exe
"C:\Users\Admin\Desktop\2024-08-03_deb24d34e3b6f271369605c8c0e734a0_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3644
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:2628

C:\Users\Admin\Desktop\2024-08-03_deb24d34e3b6f271369605c8c0e734a0_wannacry.exe
"C:\Users\Admin\Desktop\2024-08-03_deb24d34e3b6f271369605c8c0e734a0_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1844
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:1456

C:\Users\Admin\Desktop\2024-08-03_deb24d34e3b6f271369605c8c0e734a0_wannacry.exe
"C:\Users\Admin\Desktop\2024-08-03_deb24d34e3b6f271369605c8c0e734a0_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4572
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:4116

C:\Users\Admin\Desktop\2024-08-03_deb24d34e3b6f271369605c8c0e734a0_wannacry.exe
"C:\Users\Admin\Desktop\2024-08-03_deb24d34e3b6f271369605c8c0e734a0_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2480
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:1356

C:\Users\Admin\Desktop\2024-08-03_deb24d34e3b6f271369605c8c0e734a0_wannacry.exe
"C:\Users\Admin\Desktop\2024-08-03_deb24d34e3b6f271369605c8c0e734a0_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2852
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:3600

C:\Users\Admin\Desktop\2024-08-03_deb24d34e3b6f271369605c8c0e734a0_wannacry.exe
"C:\Users\Admin\Desktop\2024-08-03_deb24d34e3b6f271369605c8c0e734a0_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4472
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:2348

C:\Users\Admin\Desktop\2024-08-03_deb24d34e3b6f271369605c8c0e734a0_wannacry.exe
"C:\Users\Admin\Desktop\2024-08-03_deb24d34e3b6f271369605c8c0e734a0_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3520
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:1136

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
d2fb266b97caff2086bf0fa74eddb6b2

SHA1
2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

SHA256
b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

SHA512
c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
944B

MD5
6bd369f7c74a28194c991ed1404da30f

SHA1
0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

SHA256
878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

SHA512
8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

Download Submit
C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
be7f83d3a49d5842456734af764a8bab

SHA1
7e7e0fb529e6dabcb6195c1a0451f6600df0424c

SHA256
1b4b9d18c07dfc10ae5d1bf25fee25eab200ce1db9efe44dd3889ce4507e13c3

SHA512
78bf6270b6abfa6984024c87298b8bf64fa298482a2dde35628cc5adc782f01a760342d5fbcacc08eeeb90c947a86e7ab1e72192e6b13352deb5a76d31240019

Download Submit
memory/3016-16-0x0000024041870000-0x0000024041880000-memory.dmp

Filesize
64KB

Download
memory/3016-52-0x00000240470E0000-0x00000240470E8000-memory.dmp

Filesize
32KB

Download
memory/3016-48-0x0000024045E60000-0x0000024045E68000-memory.dmp

Filesize
32KB

Download
memory/3016-32-0x0000024041B00000-0x0000024041B10000-memory.dmp

Filesize
64KB

Download
memory/4380-10-0x00000293DB6A0000-0x00000293DB6A1000-memory.dmp

Filesize
4KB

Download
memory/4380-11-0x00000293DB6A0000-0x00000293DB6A1000-memory.dmp

Filesize
4KB

Download
memory/4380-9-0x00000293DB6A0000-0x00000293DB6A1000-memory.dmp

Filesize
4KB

Download
memory/4380-12-0x00000293DB6A0000-0x00000293DB6A1000-memory.dmp

Filesize
4KB

Download
memory/4380-13-0x00000293DB6A0000-0x00000293DB6A1000-memory.dmp

Filesize
4KB

Download
memory/4380-14-0x00000293DB6A0000-0x00000293DB6A1000-memory.dmp

Filesize
4KB

Download
memory/4380-15-0x00000293DB6A0000-0x00000293DB6A1000-memory.dmp

Filesize
4KB

Download
memory/4380-5-0x00000293DB6A0000-0x00000293DB6A1000-memory.dmp

Filesize
4KB

Download
memory/4380-4-0x00000293DB6A0000-0x00000293DB6A1000-memory.dmp

Filesize
4KB

Download
memory/4380-3-0x00000293DB6A0000-0x00000293DB6A1000-memory.dmp

Filesize
4KB

Download
memory/4908-59-0x0000028506480000-0x0000028506490000-memory.dmp

Filesize
64KB

Download
memory/4908-68-0x0000028506480000-0x0000028506490000-memory.dmp

Filesize
64KB

Download
memory/4908-57-0x0000028506480000-0x0000028506490000-memory.dmp

Filesize
64KB

Download
memory/4908-60-0x0000028506480000-0x0000028506490000-memory.dmp

Filesize
64KB

Download
memory/4908-62-0x0000028506480000-0x0000028506490000-memory.dmp

Filesize
64KB

Download
memory/4908-65-0x0000028506480000-0x0000028506490000-memory.dmp

Filesize
64KB

Download
memory/4908-64-0x0000028506480000-0x0000028506490000-memory.dmp

Filesize
64KB

Download
memory/4908-67-0x0000028506480000-0x0000028506490000-memory.dmp

Filesize
64KB

Download
memory/4908-69-0x0000028506480000-0x0000028506490000-memory.dmp

Filesize
64KB

Download
memory/4908-58-0x0000028506480000-0x0000028506490000-memory.dmp

Filesize
64KB

Download
memory/4908-66-0x0000028506480000-0x0000028506490000-memory.dmp

Filesize
64KB

Download
memory/4908-63-0x0000028506480000-0x0000028506490000-memory.dmp

Filesize
64KB

Download
memory/4908-61-0x0000028506480000-0x0000028506490000-memory.dmp

Filesize
64KB

Download
memory/4908-70-0x0000028506480000-0x0000028506490000-memory.dmp

Filesize
64KB

Download
memory/4908-71-0x0000028506480000-0x0000028506490000-memory.dmp

Filesize
64KB

Download
memory/4908-72-0x0000028506480000-0x0000028506490000-memory.dmp

Filesize
64KB

Download
memory/4908-73-0x0000028506480000-0x0000028506490000-memory.dmp

Filesize
64KB

Download
memory/4908-56-0x0000028506480000-0x0000028506490000-memory.dmp

Filesize
64KB

Download
memory/4908-55-0x0000028506480000-0x0000028506490000-memory.dmp

Filesize
64KB

Download
memory/4908-54-0x0000028506480000-0x0000028506490000-memory.dmp

Filesize
64KB

Download