Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 13:35
Static task
static1
Behavioral task
behavioral1
Sample
91647c8fdf3bc3b25797cb367d578dd3044f76993ba8457d89876f55b5cc841a.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
91647c8fdf3bc3b25797cb367d578dd3044f76993ba8457d89876f55b5cc841a.exe
Resource
win10v2004-20241007-en
General
-
Target
91647c8fdf3bc3b25797cb367d578dd3044f76993ba8457d89876f55b5cc841a.exe
-
Size
5.0MB
-
MD5
4bc70640a4fe437921ec5e143e7de636
-
SHA1
069c081ae40813a2168db3853eac5aba22d54066
-
SHA256
91647c8fdf3bc3b25797cb367d578dd3044f76993ba8457d89876f55b5cc841a
-
SHA512
2fee817321bef778f2dd7214c386b9e66c2f151e86485e14fd522d8f00eeb5abe7111b49e84587d9184ab0d1a45d81a30071522eff77f8fe94f535986044994c
-
SSDEEP
49152:2nAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAAV:yDqPoBhz1aRxcSUDk36SAA
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Wannacry family
-
Contacts a large (3188) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 1 IoCs
pid Process 1504 tasksche.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\WINDOWS\tasksche.exe 91647c8fdf3bc3b25797cb367d578dd3044f76993ba8457d89876f55b5cc841a.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91647c8fdf3bc3b25797cb367d578dd3044f76993ba8457d89876f55b5cc841a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91647c8fdf3bc3b25797cb367d578dd3044f76993ba8457d89876f55b5cc841a.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 91647c8fdf3bc3b25797cb367d578dd3044f76993ba8457d89876f55b5cc841a.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 91647c8fdf3bc3b25797cb367d578dd3044f76993ba8457d89876f55b5cc841a.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 91647c8fdf3bc3b25797cb367d578dd3044f76993ba8457d89876f55b5cc841a.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 91647c8fdf3bc3b25797cb367d578dd3044f76993ba8457d89876f55b5cc841a.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 91647c8fdf3bc3b25797cb367d578dd3044f76993ba8457d89876f55b5cc841a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\91647c8fdf3bc3b25797cb367d578dd3044f76993ba8457d89876f55b5cc841a.exe"C:\Users\Admin\AppData\Local\Temp\91647c8fdf3bc3b25797cb367d578dd3044f76993ba8457d89876f55b5cc841a.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5112 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i2⤵
- Executes dropped EXE
PID:1504
-
-
C:\Users\Admin\AppData\Local\Temp\91647c8fdf3bc3b25797cb367d578dd3044f76993ba8457d89876f55b5cc841a.exeC:\Users\Admin\AppData\Local\Temp\91647c8fdf3bc3b25797cb367d578dd3044f76993ba8457d89876f55b5cc841a.exe -m security1⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:3592
Network
-
Remote address:8.8.8.8:53Request232.168.11.51.in-addr.arpaIN PTRResponse
-
DNSwww.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com91647c8fdf3bc3b25797cb367d578dd3044f76993ba8457d89876f55b5cc841a.exeRemote address:8.8.8.8:53Requestwww.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comIN AResponsewww.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comIN A104.16.167.228www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comIN A104.16.166.228
-
GEThttp://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/91647c8fdf3bc3b25797cb367d578dd3044f76993ba8457d89876f55b5cc841a.exeRemote address:104.16.167.228:80RequestGET / HTTP/1.1
Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 607
Connection: close
Server: cloudflare
CF-RAY: 8f607e9828fcbeb0-LHR
-
GEThttp://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/91647c8fdf3bc3b25797cb367d578dd3044f76993ba8457d89876f55b5cc841a.exeRemote address:104.16.167.228:80RequestGET / HTTP/1.1
Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 607
Connection: close
Server: cloudflare
CF-RAY: 8f607e990850ef31-LHR
-
Remote address:8.8.8.8:53Request172.210.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request228.167.16.104.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request22.160.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request154.239.44.20.in-addr.arpaIN PTRResponse
-
Request18.31.95.13.in-addr.arpaIN PTRResponse
-
Request56.163.245.4.in-addr.arpaIN PTRResponse
-
Request107.12.20.2.in-addr.arpaIN PTRResponse107.12.20.2.in-addr.arpaIN PTRa2-20-12-107deploystaticakamaitechnologiescom
-
Request161.26.22.5.in-addr.arpaIN PTRResponse
-
Request1.26.22.5.in-addr.arpaIN PTRResponse
-
Request175.132.125.92.in-addr.arpaIN PTRResponse175.132.125.92.in-addr.arpaIN PTRb-internet92125132175sntru
-
Request172.214.232.199.in-addr.arpaIN PTRResponse
-
Request123.23.222.102.in-addr.arpaIN PTRResponse
-
Request26.132.125.92.in-addr.arpaIN PTRResponse26.132.125.92.in-addr.arpaIN PTRb-internet9212513226sntru
-
Request14.227.111.52.in-addr.arpaIN PTRResponse
-
Request97.187.54.34.in-addr.arpaIN PTRResponse97.187.54.34.in-addr.arpaIN PTR971875434bcgoogleusercontentcom
-
Request1.187.54.34.in-addr.arpaIN PTRResponse1.187.54.34.in-addr.arpaIN PTR11875434bcgoogleusercontentcom
-
Request1.98.30.152.in-addr.arpaIN PTRResponse
-
Request155.98.30.152.in-addr.arpaIN PTRResponse
-
Request2.187.54.34.in-addr.arpaIN PTRResponse2.187.54.34.in-addr.arpaIN PTR21875434bcgoogleusercontentcom
-
Request7.187.54.34.in-addr.arpaIN PTRResponse7.187.54.34.in-addr.arpaIN PTR71875434bcgoogleusercontentcom
-
Request2.26.22.5.in-addr.arpaIN PTRResponse
-
Request8.187.54.34.in-addr.arpaIN PTRResponse8.187.54.34.in-addr.arpaIN PTR81875434bcgoogleusercontentcom
-
Request46.132.125.92.in-addr.arpaIN PTRResponse46.132.125.92.in-addr.arpaIN PTRb-internet9212513246sntru
-
Request12.187.54.34.in-addr.arpaIN PTRResponse12.187.54.34.in-addr.arpaIN PTR121875434bcgoogleusercontentcom
-
Request12.187.54.34.in-addr.arpaIN PTR
-
Request12.187.54.34.in-addr.arpaIN PTR
-
Request13.187.54.34.in-addr.arpaIN PTRResponse13.187.54.34.in-addr.arpaIN PTR131875434bcgoogleusercontentcom
-
Request15.187.54.34.in-addr.arpaIN PTRResponse15.187.54.34.in-addr.arpaIN PTR151875434bcgoogleusercontentcom
-
Request17.187.54.34.in-addr.arpaIN PTRResponse17.187.54.34.in-addr.arpaIN PTR171875434bcgoogleusercontentcom
-
Request18.187.54.34.in-addr.arpaIN PTRResponse18.187.54.34.in-addr.arpaIN PTR181875434bcgoogleusercontentcom
-
Request19.187.54.34.in-addr.arpaIN PTRResponse19.187.54.34.in-addr.arpaIN PTR191875434bcgoogleusercontentcom
-
Request69.132.125.92.in-addr.arpaIN PTRResponse69.132.125.92.in-addr.arpaIN PTRb-internet9212513269sntru
-
Request22.187.54.34.in-addr.arpaIN PTRResponse22.187.54.34.in-addr.arpaIN PTR221875434bcgoogleusercontentcom
-
Request22.187.54.34.in-addr.arpaIN PTRResponse22.187.54.34.in-addr.arpaIN PTR221875434bcgoogleusercontentcom
-
Request23.187.54.34.in-addr.arpaIN PTRResponse23.187.54.34.in-addr.arpaIN PTR231875434bcgoogleusercontentcom
-
Request23.187.54.34.in-addr.arpaIN PTRResponse23.187.54.34.in-addr.arpaIN PTR231875434bcgoogleusercontentcom
-
Request169.117.168.52.in-addr.arpaIN PTRResponse
-
104.16.167.228:80http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/http91647c8fdf3bc3b25797cb367d578dd3044f76993ba8457d89876f55b5cc841a.exe376 B 990 B 6 5
HTTP Request
GET http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/HTTP Response
200 -
104.16.167.228:80http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/http91647c8fdf3bc3b25797cb367d578dd3044f76993ba8457d89876f55b5cc841a.exe376 B 990 B 6 5
HTTP Request
GET http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/HTTP Response
200 -
52 B 1
-
52 B 1
-
52 B 1
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
104 B 2
-
-
-
104 B 2
-
104 B 2
-
104 B 2
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
52 B 1
-
-
52 B 1
-
52 B 1
-
104 B 2
-
104 B 2
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
104 B 2
-
-
-
-
-
52 B 1
-
-
104 B 2
-
52 B 1
-
52 B 1
-
104 B 2
-
52 B 1
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
52 B 1
-
-
-
-
104 B 2
-
-
-
104 B 2
-
-
-
104 B 2
-
-
52 B 1
-
104 B 2
-
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
52 B 1
-
-
-
-
104 B 2
-
-
52 B 1
-
52 B 1
-
104 B 2
-
104 B 2
-
52 B 1
-
104 B 2
-
104 B 2
-
104 B 2
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
104 B 2
-
-
-
104 B 2
-
104 B 2
-
-
-
52 B 1
-
104 B 2
-
52 B 1
-
104 B 2
-
-
52 B 1
-
52 B 1
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
104 B 2
-
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
52 B 1
-
52 B 1
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
52 B 1
-
-
52 B 1
-
104 B 2
-
52 B 1
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
52 B 1
-
104 B 2
-
-
104 B 2
-
52 B 1
-
104 B 2
-
104 B 2
-
104 B 2
-
52 B 1
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
104 B 2
-
52 B 1
-
-
-
-
-
104 B 2
-
52 B 1
-
104 B 2
-
104 B 2
-
52 B 1
-
104 B 2
-
52 B 1
-
104 B 2
-
52 B 1
-
52 B 1
-
-
52 B 1
-
104 B 2
-
104 B 2
-
52 B 1
-
104 B 2
-
104 B 2
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
52 B 1
-
104 B 2
-
-
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
52 B 1
-
104 B 2
-
104 B 2
-
104 B 2
-
52 B 1
-
104 B 2
-
104 B 2
-
52 B 1
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
104 B 2
-
-
52 B 1
-
52 B 1
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
52 B 1
-
52 B 1
-
52 B 1
-
104 B 2
-
52 B 1
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
52 B 1
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
104 B 2
-
104 B 2
-
52 B 1
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
52 B 1
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
104 B 2
-
52 B 1
-
104 B 2
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
104 B 2
-
52 B 1
-
104 B 2
-
52 B 1
-
104 B 2
-
52 B 1
-
52 B 1
-
52 B 1
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
52 B 1
-
72 B 158 B 1 1
DNS Request
232.168.11.51.in-addr.arpa
-
8.8.8.8:53www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comdns91647c8fdf3bc3b25797cb367d578dd3044f76993ba8457d89876f55b5cc841a.exe95 B 127 B 1 1
DNS Request
www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
DNS Response
104.16.167.228104.16.166.228
-
74 B 128 B 1 1
DNS Request
172.210.232.199.in-addr.arpa
-
73 B 135 B 1 1
DNS Request
228.167.16.104.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
22.160.190.20.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
154.239.44.20.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.4MB
MD5e36210a397bffab93372523e7a0b9ac3
SHA1a787b834ebea2f4463ba478a808c6514c78c87d2
SHA256584553664dc9dd0db9c064cdccd9b20165d97f1df4e676bc8f1a268afd2cb2a4
SHA5121eb8b92f38ca1abc0b364f007f77132c664d2cf3da6241586d9dd8b5c3f243bdb8bd10847630648f2a235b3db4c5439d2dabfbd39e2942b1371e7f17521a0f9e