Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
27-09-2024 23:59
Static task
static1
Behavioral task
behavioral1
Sample
202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe
Resource
win10v2004-20240802-en
General
-
Target
202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe
-
Size
2.4MB
-
MD5
1ea35b7c0879ca2e1c2778b324fbc1a1
-
SHA1
7458d42595ef00bf79f76a66570fc142d5f6f679
-
SHA256
324f8800d299319e7190fa49e501af63456e8ec6c50484d4abaea9b4b742eca6
-
SHA512
71d0e667ff7d8af678330ba7d1178efe1b91e768c7ff9f847f45d38a636dee6d61519e7a2540e047934459799b292af2177f7a3b1b19654e8773e10ae708d0ea
-
SSDEEP
49152:hnpEKUacBVQej/1INRx+TSqTdX1HkQo6SAARdhnvXiHgYk6:FpyfBhz1aRxcSUDk36SAEdhvXiHgYk
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (1487) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in Drivers directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\npf.sys 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\drivers\npf.sys 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe -
resource yara_rule behavioral1/files/0x0007000000016d31-14.dat aspack_v212_v242 behavioral1/files/0x0008000000016d3a-15.dat aspack_v212_v242 behavioral1/files/0x0008000000016d29-16.dat aspack_v212_v242 -
Executes dropped EXE 2 IoCs
pid Process 2852 CTFMON.EXE 1972 tasksche.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Mystify.scr 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\eventcreate.exe 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\ideograf.uce 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\phon.ime 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\rekeywiz.exe 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\verifier.exe 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\wextract.exe 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\autoconv.exe 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\newdev.exe 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\winrm 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\SndVol.exe 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\dialer.exe 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\en 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\sc.exe 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\wiaacmgr.exe 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\winrm.cmd 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\dpnsvr.exe 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\OptionalFeatures.exe 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\ieUnatt.exe 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\simpdata.tlb 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\AdapterTroubleshooter.exe 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\dnscacheugc.exe 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\net.exe 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\qintlgnt.ime 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\SearchFilterHost.exe 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\certutil.exe 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\EhStorAuthn.exe 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\msacm32.drv 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\zh-CN 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\0410 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\config 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\poqexec.exe 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\RpcPing.exe 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\zh-HK 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\diskmgmt.msc 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\msfeedssync.exe 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\charmap.exe 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\ksxbar.ax 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\syskey.exe 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\w32tm.exe 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\ntkrnlpa.exe 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\perfhost.exe 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\sdiagnhost.exe 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\icsunattend.exe 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\MuiUnattend.exe 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\de 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\fltMC.exe 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\instnm.exe 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\at.exe 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\chkntfs.exe 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\noise.jpn 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\ssText3d.scr 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\typeperf.exe 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\extrac32.exe 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\label.exe 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\hu-HU 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\auditpol.exe 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\grpconv.exe 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\unlodctr.exe 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\RestartManager.mof 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesProtection.exe 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\Msdtc 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\pscript.sep 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Windows\SysWOW64\ticrf.rat 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe -
Drops file in Program Files directory 6 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Windows NT\Accessories\it-IT 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Program Files (x86)\Windows NT\Accessories\ja-JP 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop CTFMON.EXE File opened for modification C:\Program Files (x86)\Windows NT\Accessories\de-DE 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File opened for modification C:\Program Files (x86)\Windows NT\Accessories\fr-FR 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe -
Drops file in Windows directory 12 IoCs
description ioc Process File opened for modification C:\Windows\CTFMON.EXE 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File created C:\Windows\CTFMON.EXE 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File created C:\Windows\__tmp_rar_sfx_access_check_259483841 tasksche.exe File created C:\Windows\eee.exe tasksche.exe File created C:\Windows\packet.dll 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File created C:\Windows\CTFMON.EXE 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File created C:\Windows\pthreadvc.dll 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File created C:\Windows\packet.dll 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File created C:\Windows\wpcap.dll 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File created C:\WINDOWS\tasksche.exe 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File created C:\Windows\pthreadvc.dll 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe File created C:\Windows\wpcap.dll 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CTFMON.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasksche.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe -
Modifies data under HKEY_USERS 24 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B8C23822-B12B-4877-9A73-C32A137B4756} 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B8C23822-B12B-4877-9A73-C32A137B4756}\WpadNetworkName = "Network 3" 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-f1-ee-0f-79-77\WpadDecisionTime = a0b838743911db01 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-f1-ee-0f-79-77\WpadDecision = "0" 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B8C23822-B12B-4877-9A73-C32A137B4756}\WpadDecisionReason = "1" 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-f1-ee-0f-79-77 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0191000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-f1-ee-0f-79-77\WpadDecisionReason = "1" 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B8C23822-B12B-4877-9A73-C32A137B4756}\WpadDecision = "0" 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B8C23822-B12B-4877-9A73-C32A137B4756}\WpadDecisionTime = a0b838743911db01 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B8C23822-B12B-4877-9A73-C32A137B4756}\d6-f1-ee-0f-79-77 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2732 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe 2852 CTFMON.EXE 2852 CTFMON.EXE 2852 CTFMON.EXE 2852 CTFMON.EXE 2852 CTFMON.EXE 2852 CTFMON.EXE 2852 CTFMON.EXE 2852 CTFMON.EXE 2852 CTFMON.EXE 2852 CTFMON.EXE 2852 CTFMON.EXE 2852 CTFMON.EXE 2852 CTFMON.EXE 2852 CTFMON.EXE 2852 CTFMON.EXE 2852 CTFMON.EXE 2852 CTFMON.EXE 2852 CTFMON.EXE 2852 CTFMON.EXE 2852 CTFMON.EXE 2852 CTFMON.EXE 2852 CTFMON.EXE 2852 CTFMON.EXE 2852 CTFMON.EXE 2852 CTFMON.EXE 2852 CTFMON.EXE 2852 CTFMON.EXE 2852 CTFMON.EXE 2852 CTFMON.EXE 2852 CTFMON.EXE 2852 CTFMON.EXE 2852 CTFMON.EXE 2852 CTFMON.EXE 2852 CTFMON.EXE 2852 CTFMON.EXE 2852 CTFMON.EXE 2852 CTFMON.EXE 2852 CTFMON.EXE 2852 CTFMON.EXE 2852 CTFMON.EXE 2852 CTFMON.EXE 2852 CTFMON.EXE 2852 CTFMON.EXE 2852 CTFMON.EXE 2852 CTFMON.EXE 2852 CTFMON.EXE 2852 CTFMON.EXE 2852 CTFMON.EXE 2852 CTFMON.EXE 2852 CTFMON.EXE 2852 CTFMON.EXE 2852 CTFMON.EXE 2852 CTFMON.EXE 2852 CTFMON.EXE 2852 CTFMON.EXE 2852 CTFMON.EXE 2852 CTFMON.EXE 2852 CTFMON.EXE 2852 CTFMON.EXE 2852 CTFMON.EXE 2852 CTFMON.EXE 2852 CTFMON.EXE 2852 CTFMON.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2852 CTFMON.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2732 wrote to memory of 2852 2732 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe 30 PID 2732 wrote to memory of 2852 2732 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe 30 PID 2732 wrote to memory of 2852 2732 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe 30 PID 2732 wrote to memory of 2852 2732 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe 30 PID 2732 wrote to memory of 1972 2732 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe 34 PID 2732 wrote to memory of 1972 2732 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe 34 PID 2732 wrote to memory of 1972 2732 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe 34 PID 2732 wrote to memory of 1972 2732 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe 34 PID 2732 wrote to memory of 1972 2732 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe 34 PID 2732 wrote to memory of 1972 2732 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe 34 PID 2732 wrote to memory of 1972 2732 202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe"C:\Users\Admin\AppData\Local\Temp\202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe"1⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\CTFMON.EXEC:\Windows\CTFMON.EXE2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2852
-
-
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1972
-
-
C:\Users\Admin\AppData\Local\Temp\202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exeC:\Users\Admin\AppData\Local\Temp\202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe -m security1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2572
Network
-
DNSwww.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exeRemote address:8.8.8.8:53Requestwww.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comIN AResponsewww.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comIN A103.224.212.215
-
GEThttp://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exeRemote address:103.224.212.215:80RequestGET / HTTP/1.1
Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com
Cache-Control: no-cache
ResponseHTTP/1.1 302 Found
server: Apache
set-cookie: __tad=1727481647.6684264; expires=Tue, 26-Sep-2034 00:00:47 GMT; Max-Age=315360000
location: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20240928-1000-479c-83ef-0e3339c57587
content-length: 2
content-type: text/html; charset=UTF-8
connection: close
-
DNSww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exeRemote address:8.8.8.8:53Requestww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comIN AResponseww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comIN CNAME77026.bodis.com77026.bodis.comIN A199.59.243.227
-
GEThttp://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20240928-1000-479c-83ef-0e3339c57587202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exeRemote address:199.59.243.227:80RequestGET /?subid1=20240928-1000-479c-83ef-0e3339c57587 HTTP/1.1
Host: ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com
Cache-Control: no-cache
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
content-type: text/html; charset=utf-8
content-length: 1262
x-request-id: a76cd5e9-8be1-4c42-99ed-256f4de767cc
cache-control: no-store, max-age=0
accept-ch: sec-ch-prefers-color-scheme
critical-ch: sec-ch-prefers-color-scheme
vary: sec-ch-prefers-color-scheme
x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_wThwVZOej64XsWNky0bQN5NWoCp03GEIdna+Y5Jjwx/aRl7deB6obfsmuBCaGkK3nKv4Oum3vmvtbDnY5ELFGg==
set-cookie: parking_session=a76cd5e9-8be1-4c42-99ed-256f4de767cc; expires=Sat, 28 Sep 2024 00:15:48 GMT; path=/
-
103.224.212.215:80www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe152 B 3
-
103.224.212.215:80http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/http202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe430 B 533 B 7 4
HTTP Request
GET http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/HTTP Response
302 -
199.59.243.227:80http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20240928-1000-479c-83ef-0e3339c57587http202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe491 B 2.1kB 7 5
HTTP Request
GET http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20240928-1000-479c-83ef-0e3339c57587HTTP Response
200 -
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
104 B 80 B 2 2
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
104 B 80 B 2 2
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
104 B 80 B 2 2
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
104 B 80 B 2 2
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
104 B 80 B 2 2
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
104 B 80 B 2 2
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
104 B 104 B 2 2
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
8.8.8.8:53www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comdns202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe95 B 111 B 1 1
DNS Request
www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com
DNS Response
103.224.212.215
-
8.8.8.8:53ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comdns202409271ea35b7c0879ca2e1c2778b324fbc1a1wannacry.exe96 B 138 B 1 1
DNS Request
ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com
DNS Response
199.59.243.227
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD5d66729e25d23d7ec85ec4641c8c47564
SHA149d23203a04bf2da753958786df0eae5d0e44355
SHA256c07a76fdda3028c78f8413f77ac9f2dd0812b0dcbfa3f3fe6b8ab08fba096d85
SHA5121f76bc4c82d6c5139c9308e7edc0bf3390560f0aa498d63598c69d2932424c5576b227d68abfbd1cb4d58a165454299c898ef9683e139581596e83b18fa0c3d8
-
Filesize
29KB
MD55c14de7d04d00aac3f03b569f2ea4664
SHA1a26ae78a204791548be000824a1ad05524bdd2e8
SHA256fac5bcebde87a261b4fb5a110765e53c96f0ef27b24ca94762f2c2ddb4da4204
SHA5124bcbc4f0ab7b52f4303206fafd9d0bafea02bb25d8395a80eb6390b30ccc750379fb7fe9e0bf5a4a025cedb9e4702b7655963e360f2f983526dbc2e1efaa814f
-
Filesize
32KB
MD5f46c27d67c0ce202ebf4b771cb56ec00
SHA1f999454d0aaabccfda7a50c8cb0818e50a7a1d91
SHA256a68c877cd9c7562c66c722b4d0cd9fa366c65465d4c47ab63bf28bd5f1a69bcc
SHA5122b7c6f7e865f88625a05c85226a95319656648029ef1c1b92b3a6c2dea7a4f7cf7d157c09af32c8689c76c6247852cd5af72d4f0dbb4dbcc3fe3c24681d53dbf
-
Filesize
24KB
MD5ea20ca545a351384486cef574b7a5571
SHA1a1f01df09df62e933e4ff289361641b06ff31548
SHA2562bd8d9dd8739e17828f8a87b73d592d4fd17988bbb0ea4a4d4cbda57129e8e48
SHA51264b3dee275fb1830254fa2a95778b26864708c0b5e348cf5919ded013cda3872fe26304c846fa7968b24f60e2b6105c4813ff9e695bd6bb52897318cdecd382b
-
Filesize
2.0MB
MD5beb8a27fc024962e045c32aa58d07d0e
SHA1796d3613673f323135865c42272abef347add163
SHA256ea2ad4d3bb98673b88e18eea1bf06c371c206b64246a9193b2a64ba4fe4f4900
SHA512e84c03f6f4399b28e0d258b743831f36c621325d9b199cbbdd6982ed51280facfc5a953a2393788bbc54efb653f95c9f75ea29c93c147c9227aff3395f788179
-
Filesize
117KB
MD56d79c447d16b96e7a72b12e450b6fa8e
SHA1d2afa5eb9c9ba598f82a6025c1a07d31cb8a30bb
SHA256afe533c6990520d49a4963bb9ce6d563b02d7b299ff4a9c9e4bca31ca6920deb
SHA5126b96c6e79608256807f37a4b74b264074274642b4e4e09ef870d13246b7706582535c1e4f33f2a61281ab4c0ef59fc03c60a54faa6627aee92df52f356b8d966