Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11-10-2024 15:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe
Resource
win7-20240903-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
16 signatures
150 seconds
General
-
Target
2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe
-
Size
2.4MB
-
MD5
1d7c6e871159b6b01072cebe683b955a
-
SHA1
dcf5f38e71aec895fc1c9f97548daf7201fc7275
-
SHA256
d13f287506b003c20bc36ef96e67b335869b11d88ead5d7e6ec14e2b0366912d
-
SHA512
47678355c11c7552dccebafafac5cda705169bde83d0bbc165dffdb73c22423686848e700cd8236f2b5e5baf5973f9e17eb4eafe30b7f24e277ca40a649dcb3b
-
SSDEEP
49152:7npEKUacBVQej/1INRx+TSqTdX1HkQo6SAARdhnvXiHgYk6:LpyfBhz1aRxcSUDk36SAEdhvXiHgYk
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (2298) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in Drivers directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\npf.sys 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\SysWOW64\drivers\npf.sys 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe -
resource yara_rule behavioral1/files/0x0008000000016c51-24.dat aspack_v212_v242 behavioral1/files/0x0007000000016c4a-27.dat aspack_v212_v242 behavioral1/files/0x0007000000016cc8-25.dat aspack_v212_v242 -
Executes dropped EXE 3 IoCs
pid Process 1256 sysmgr.exe 2532 CTFMON.EXE 3048 tasksche.exe -
Modifies WinLogon 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4" sysmgr.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\winrm 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\SysWOW64\ideograf.uce 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\SysWOW64\l3codecp.acm 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\SysWOW64\recover.exe 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesComputerName.exe 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\SysWOW64\syskey.exe 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\SysWOW64\0C0A 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\SysWOW64\mstsc.exe 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\SysWOW64\NOISE.DAT 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\SysWOW64\SearchProtocolHost.exe 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\SysWOW64\compmgmt.msc 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\SysWOW64\dfrgui.exe 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\SysWOW64\RMActivate_isv.exe 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\SysWOW64\xwizard.dtd 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\SysWOW64\cttunesvr.exe 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\SysWOW64\icardagt.exe 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\SysWOW64\makecab.exe 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\SysWOW64\Ribbons.scr 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\SysWOW64\explorer.exe 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\SysWOW64\psr.exe 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\SysWOW64\svchost.exe 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\SysWOW64\dpnsvr.exe 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\SysWOW64\lt-LT 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\SysWOW64\SetIEInstalledDate.exe 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\SysWOW64\sk-SK 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\SysWOW64\rasphone.exe 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\SysWOW64\regedit.exe 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\SysWOW64\RMActivate_ssp.exe 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\SysWOW64\sxstrace.exe 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\SysWOW64\diantz.exe 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\SysWOW64\extrac32.exe 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\SysWOW64\Magnify.exe 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\SysWOW64\msfeedssync.exe 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\SysWOW64\DWWIN.EXE 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\SysWOW64\FxsTmp 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\SysWOW64\taskmgr.exe 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\SysWOW64\ComputerDefaults.exe 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\SysWOW64\msdt.exe 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\SysWOW64\NAPSTAT.EXE 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\SysWOW64\newdev.exe 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\SysWOW64\ieapfltr.dat 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\SysWOW64\setupugc.exe 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\O591KISD.txt 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\SysWOW64\kstvtune.ax 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\SysWOW64\odbcconf.rsp 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\SysWOW64\waitfor.exe 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\SysWOW64\fi-FI 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\SysWOW64\imaadp32.acm 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\SysWOW64\license.rtf 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\SysWOW64\PATHPING.EXE 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\SysWOW64\iscsicpl.exe 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\SysWOW64\logagent.exe 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\SysWOW64\cintlgnt.ime 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\SysWOW64\it-IT 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\SysWOW64\MSCOMCTL.OCX 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\SysWOW64\bthudtask.exe 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\SysWOW64\pcaui.exe 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\SysWOW64\SearchIndexer.exe 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\SysWOW64\SyncHost.exe 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\SysWOW64\attrib.exe 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\SysWOW64\nb-NO 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\SysWOW64\tree.com 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\SysWOW64\da-DK 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\SysWOW64\uk-UA 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe -
Drops file in Program Files directory 10 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Windows NT\Accessories\de-DE 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Program Files (x86)\Windows NT\Accessories\it-IT 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Program Files (x86)\Windows NT\Accessories\ja-JP 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Program Files\7-Zip\7z.exe sysmgr.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe sysmgr.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe sysmgr.exe File opened for modification C:\PROGRAM FILES\Windows Journal\de-DE\JNTFiltr.dll.mui 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Program Files (x86)\Windows NT\Accessories\fr-FR 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zG.exe sysmgr.exe -
Drops file in Windows directory 17 IoCs
description ioc Process File created C:\Windows\pthreadvc.dll 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File created C:\Windows\wpcap.dll 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File opened for modification C:\Windows\CTFMON.EXE 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File created C:\Windows\CTFMON.EXE 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File created C:\Windows\packet.dll 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File created C:\Windows\wpcap.dll 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File created C:\Windows\__tmp_rar_sfx_access_check_259463811 tasksche.exe File opened for modification C:\Windows\conf.dat sysmgr.exe File created C:\Windows\sysmgr.exe 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File created C:\Windows\sysmgr.exe 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File created C:\Windows\svc.dat 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File created C:\Windows\packet.dll 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File created C:\Windows\CTFMON.EXE 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File created C:\Windows\conf.dat sysmgr.exe File created C:\Windows\pthreadvc.dll 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File created C:\WINDOWS\tasksche.exe 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe File created C:\Windows\eee.exe tasksche.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasksche.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CTFMON.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sysmgr.exe -
Modifies data under HKEY_USERS 24 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{143AD548-AFBD-4C83-BC42-BCD3490A7857}\WpadDecisionTime = 205ac106f21bdb01 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-8f-27-b6-99-32\WpadDecisionTime = 205ac106f21bdb01 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{143AD548-AFBD-4C83-BC42-BCD3490A7857} 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{143AD548-AFBD-4C83-BC42-BCD3490A7857}\WpadDecision = "0" 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{143AD548-AFBD-4C83-BC42-BCD3490A7857}\WpadNetworkName = "Network 3" 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-8f-27-b6-99-32\WpadDecision = "0" 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{143AD548-AFBD-4C83-BC42-BCD3490A7857}\WpadDecisionReason = "1" 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{143AD548-AFBD-4C83-BC42-BCD3490A7857}\9a-8f-27-b6-99-32 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-8f-27-b6-99-32\WpadDecisionReason = "1" 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00bd000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-8f-27-b6-99-32 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2420 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe 2420 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe 2532 CTFMON.EXE 2532 CTFMON.EXE 2532 CTFMON.EXE 2532 CTFMON.EXE 2532 CTFMON.EXE 2532 CTFMON.EXE 2532 CTFMON.EXE 2532 CTFMON.EXE 2532 CTFMON.EXE 2532 CTFMON.EXE 2532 CTFMON.EXE 2532 CTFMON.EXE 2532 CTFMON.EXE 2532 CTFMON.EXE 2532 CTFMON.EXE 2532 CTFMON.EXE 2532 CTFMON.EXE 2532 CTFMON.EXE 2532 CTFMON.EXE 2532 CTFMON.EXE 2532 CTFMON.EXE 2532 CTFMON.EXE 2532 CTFMON.EXE 2532 CTFMON.EXE 2532 CTFMON.EXE 2532 CTFMON.EXE 2532 CTFMON.EXE 2532 CTFMON.EXE 2532 CTFMON.EXE 2532 CTFMON.EXE 2532 CTFMON.EXE 2532 CTFMON.EXE 2532 CTFMON.EXE 2532 CTFMON.EXE 2532 CTFMON.EXE 2532 CTFMON.EXE 2532 CTFMON.EXE 2532 CTFMON.EXE 2532 CTFMON.EXE 2532 CTFMON.EXE 2532 CTFMON.EXE 2532 CTFMON.EXE 2532 CTFMON.EXE 2532 CTFMON.EXE 2532 CTFMON.EXE 2532 CTFMON.EXE 2532 CTFMON.EXE 2532 CTFMON.EXE 2532 CTFMON.EXE 2532 CTFMON.EXE 2532 CTFMON.EXE 2532 CTFMON.EXE 2532 CTFMON.EXE 2532 CTFMON.EXE 2532 CTFMON.EXE 2532 CTFMON.EXE 2532 CTFMON.EXE 2532 CTFMON.EXE 2532 CTFMON.EXE 2532 CTFMON.EXE 2532 CTFMON.EXE 2532 CTFMON.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3048 tasksche.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2532 CTFMON.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2420 wrote to memory of 1256 2420 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe 30 PID 2420 wrote to memory of 1256 2420 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe 30 PID 2420 wrote to memory of 1256 2420 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe 30 PID 2420 wrote to memory of 1256 2420 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe 30 PID 2420 wrote to memory of 2532 2420 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe 32 PID 2420 wrote to memory of 2532 2420 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe 32 PID 2420 wrote to memory of 2532 2420 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe 32 PID 2420 wrote to memory of 2532 2420 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe 32 PID 2420 wrote to memory of 3048 2420 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe 35 PID 2420 wrote to memory of 3048 2420 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe 35 PID 2420 wrote to memory of 3048 2420 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe 35 PID 2420 wrote to memory of 3048 2420 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe 35 PID 2420 wrote to memory of 3048 2420 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe 35 PID 2420 wrote to memory of 3048 2420 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe 35 PID 2420 wrote to memory of 3048 2420 2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe"1⤵
- Drops file in Drivers directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\sysmgr.exe"C:\Windows\sysmgr.exe"2⤵
- Executes dropped EXE
- Modifies WinLogon
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1256
-
-
C:\Windows\CTFMON.EXEC:\Windows\CTFMON.EXE2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2532
-
-
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:3048
-
-
C:\Users\Admin\AppData\Local\Temp\2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2024-10-11_1d7c6e871159b6b01072cebe683b955a_nymaim_wannacry.exe -m security1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:780
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
MD5beb8a27fc024962e045c32aa58d07d0e
SHA1796d3613673f323135865c42272abef347add163
SHA256ea2ad4d3bb98673b88e18eea1bf06c371c206b64246a9193b2a64ba4fe4f4900
SHA512e84c03f6f4399b28e0d258b743831f36c621325d9b199cbbdd6982ed51280facfc5a953a2393788bbc54efb653f95c9f75ea29c93c147c9227aff3395f788179
-
Filesize
255KB
MD53678d9b19a6ab9bfb6709792eb9fe1d5
SHA18b1a0e3d3bb1d5b2f9f1e279a95f390f183d0a04
SHA2569c30766887841cbfeb9759d71e90dcfabeaa349cb225f69f2d92caf97b1d22f0
SHA512c912e298023e679e220a8c6d250099e553b171cba56fbaf7d172455462f00ba80c0424b851b33b3c719c03fc60dd7cd06433480e5625746f943fe6367ab9e96c
-
Filesize
29KB
MD55c14de7d04d00aac3f03b569f2ea4664
SHA1a26ae78a204791548be000824a1ad05524bdd2e8
SHA256fac5bcebde87a261b4fb5a110765e53c96f0ef27b24ca94762f2c2ddb4da4204
SHA5124bcbc4f0ab7b52f4303206fafd9d0bafea02bb25d8395a80eb6390b30ccc750379fb7fe9e0bf5a4a025cedb9e4702b7655963e360f2f983526dbc2e1efaa814f
-
Filesize
39B
MD58bb0b4f69609d6a0c8dc89dca56b3f01
SHA1ea3e1e01db3aeae1d0632bfbda969393fde69c25
SHA25667aafceb6d0437ec07570cf33eeb6de7ebafc2090066c30d072dc7f9421fe783
SHA5127425f57d55bf64067fc4a1a6daac9d9b3a321be9fef1c1e60ee650d08d24cff577f760eb23b205d0e03ba3dbc75fdd5ba05e13c66c5a9b07cfe9ec3dec6ad50d
-
Filesize
32KB
MD5f46c27d67c0ce202ebf4b771cb56ec00
SHA1f999454d0aaabccfda7a50c8cb0818e50a7a1d91
SHA256a68c877cd9c7562c66c722b4d0cd9fa366c65465d4c47ab63bf28bd5f1a69bcc
SHA5122b7c6f7e865f88625a05c85226a95319656648029ef1c1b92b3a6c2dea7a4f7cf7d157c09af32c8689c76c6247852cd5af72d4f0dbb4dbcc3fe3c24681d53dbf
-
Filesize
24KB
MD5ea20ca545a351384486cef574b7a5571
SHA1a1f01df09df62e933e4ff289361641b06ff31548
SHA2562bd8d9dd8739e17828f8a87b73d592d4fd17988bbb0ea4a4d4cbda57129e8e48
SHA51264b3dee275fb1830254fa2a95778b26864708c0b5e348cf5919ded013cda3872fe26304c846fa7968b24f60e2b6105c4813ff9e695bd6bb52897318cdecd382b
-
Filesize
2KB
MD5c4806e2c2890cbb0759f6a0e2b367f96
SHA16de471e6820762221232d0c416f40180dd38af5e
SHA256d37a27e81063424f8874d2d8d02b535aa35b23d784bbffef03b55696fd218241
SHA512bdd8f6c7cb3cc96c39437924407a2b05f579582a5a51ab1fb5e026a4c2c2ae1df0243f277fd0c8ffb06c48c01b420eeea1e5c0438350e827464ced86c9725a30
-
Filesize
36KB
MD52373dfbdba70b54164d4fe163f7f59f1
SHA1fbc51778f9e4868ddce4763d0bef4cb48090e3f6
SHA256e506e529d2d1d80ba433d4dec9fcbf07506112c8d0a130bed322f03346640456
SHA51232e48c596def05ddd1c987ae54cb069f750e0e4a993aa9f5c1d69e11c49ca90f6d324dfb4fa7c29c7d642eb2d939b2efe9332e0f4f4cbc5a0b2893adbf8598ec
-
Filesize
117KB
MD56d79c447d16b96e7a72b12e450b6fa8e
SHA1d2afa5eb9c9ba598f82a6025c1a07d31cb8a30bb
SHA256afe533c6990520d49a4963bb9ce6d563b02d7b299ff4a9c9e4bca31ca6920deb
SHA5126b96c6e79608256807f37a4b74b264074274642b4e4e09ef870d13246b7706582535c1e4f33f2a61281ab4c0ef59fc03c60a54faa6627aee92df52f356b8d966