Analysis

  • max time kernel
    151s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-08-2022 19:38

General

  • Target

    be1fc4c26ca89d936674870bf9ec9a6c.exe

  • Size

    5.0MB

  • MD5

    be1fc4c26ca89d936674870bf9ec9a6c

  • SHA1

    3c44b6e6c1645f6b3a98b03517d4a9de954a93a1

  • SHA256

    efcb6680db440ce21491a683e42d3bef7931279324608b7e490d361fbcb1084c

  • SHA512

    3468251776f3c9186ffb3dc6ef68916a0341fbf78a291b2148fb0b5ff7a39d117d254ad84f3b680c70614655f63564b0b7db1b553d1df3d123b066eaddd99ae9

  • SSDEEP

    98304:yDqPoBhFk36SAEdhvxWa9P593R8yAVp2H:yDqP2k3ZAEUadzR8yc4H

Malware Config

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

  • Contacts a large (3216) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Executes dropped EXE 1 IoCs
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Drops file in Windows directory 1 IoCs
  • Modifies data under HKEY_USERS 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\be1fc4c26ca89d936674870bf9ec9a6c.exe
    "C:\Users\Admin\AppData\Local\Temp\be1fc4c26ca89d936674870bf9ec9a6c.exe"
    1⤵
    • Drops file in Windows directory
    PID:396
    • C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      2⤵
      • Executes dropped EXE
      PID:1200
  • C:\Users\Admin\AppData\Local\Temp\be1fc4c26ca89d936674870bf9ec9a6c.exe
    C:\Users\Admin\AppData\Local\Temp\be1fc4c26ca89d936674870bf9ec9a6c.exe -m security
    1⤵
    • Modifies data under HKEY_USERS
    PID:2968

Network

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Network Service Scanning

2
T1046

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\tasksche.exe
    Filesize

    3.4MB

    MD5

    210e8edbebe8b3b18a7f421d1b350b7d

    SHA1

    ae80a48f1267bc8930f182d1c6301000a854ff9c

    SHA256

    21920bbb6adbb440de1116521aa3809ec52f136176ec79da86b9de5b3109db12

    SHA512

    f45de94a5465e2dfca9c1cce3a2ac57b7d47d5193fc81a67533838532e510ab6e8ffd99ee5da9eb1c033579c99c6ef310f7e326538ee954a4e33df8251fa9556