Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-09-2024 20:35
Static task
static1
Behavioral task
behavioral1
Sample
nozomi.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
nozomi.exe
Resource
win10v2004-20240802-en
General
-
Target
nozomi.exe
-
Size
3.6MB
-
MD5
7dc85e203f978618abeca0f1533fcfd9
-
SHA1
fb254f5df3d0ffe42b910afa33c3cc36f2fd00a4
-
SHA256
860f82416c505a7938a5e51e784bfe4e021b5f0f3487883d5e941c22d2844f7e
-
SHA512
61dc510ce975ca2f705fe7358a9a9bded55d31b5868c37fe2b024db0902fb040ed4d2bb3ee974db8de543e72b40927784ce852367ac7d4ff41c129d4879a8112
-
SSDEEP
49152:XnAQqMSPbcBV5RdhnvxJM0H9PAMEcaEau3R8yAH1plAHI:XDqPoBZdhvxWa9P593R8yAVp2HI
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (3073) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 1 IoCs
pid Process 2592 tasksche.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat nozomi.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\WINDOWS\tasksche.exe nozomi.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nozomi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nozomi.exe -
Modifies data under HKEY_USERS 24 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" nozomi.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{74F04B6F-3BBC-4608-983A-AA8B8CA2CC9E}\WpadDecisionTime = 2000f034f80ddb01 nozomi.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" nozomi.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ nozomi.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" nozomi.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00c8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 nozomi.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-a1-ea-f9-89-5c\WpadDecisionReason = "1" nozomi.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 nozomi.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" nozomi.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix nozomi.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad nozomi.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{74F04B6F-3BBC-4608-983A-AA8B8CA2CC9E} nozomi.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{74F04B6F-3BBC-4608-983A-AA8B8CA2CC9E}\WpadDecisionReason = "1" nozomi.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{74F04B6F-3BBC-4608-983A-AA8B8CA2CC9E}\WpadNetworkName = "Network 3" nozomi.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-a1-ea-f9-89-5c nozomi.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{74F04B6F-3BBC-4608-983A-AA8B8CA2CC9E}\ea-a1-ea-f9-89-5c nozomi.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-a1-ea-f9-89-5c\WpadDecisionTime = 2000f034f80ddb01 nozomi.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings nozomi.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections nozomi.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 nozomi.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings nozomi.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" nozomi.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{74F04B6F-3BBC-4608-983A-AA8B8CA2CC9E}\WpadDecision = "0" nozomi.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-a1-ea-f9-89-5c\WpadDecision = "0" nozomi.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\nozomi.exe"C:\Users\Admin\AppData\Local\Temp\nozomi.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2664 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i2⤵
- Executes dropped EXE
PID:2592
-
-
C:\Users\Admin\AppData\Local\Temp\nozomi.exeC:\Users\Admin\AppData\Local\Temp\nozomi.exe -m security1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2576
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.4MB
MD5808e752e28f284c61170ac3fc6010217
SHA144afa45d66fa3809b1b82a5125da087f5b3594b2
SHA25658b08e0465013b3d08ac777efa90ecc8802f3f581265eab5d7e6e287cbddae3c
SHA51220db7da1561bf221d7e7d53e75abe982956488eb40e3c876bb707027f2c0799fc5983bc3e8db28957da068e429e620686519135d411982554c3e28f3bfbed93a