Overview

overview

10

Static

static

57bd65d2a4...5f.exe

windows7-x64

10

57bd65d2a4...5f.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-08-2022 19:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    57bd65d2a4c17e283dc1a092ab14e45f.exe

  • Size

    3.6MB

  • MD5

    57bd65d2a4c17e283dc1a092ab14e45f

  • SHA1

    c7695477913cccdc5d7d8ef5aa93292f23b6ccf6

  • SHA256

    05904987972aaaf5f46729cde17b72cb89d3c202d15f607d63a17c44253173df

  • SHA512

    6f00ff761fc5f583a2bb61ae1933a91ca890488de179376963d67cdff4523ac6cf6830a0b6630e67daf267814b3de5d76713e88099a5e69157de364c735ef324

  • SSDEEP

    49152:VnjQqMSPbcBVQejXINRx+TSqTdX1HkQo6SAARdhnv:Z8qPoBhraRxcSUDk36SAEdhv

Score
10/10
wannacrydiscoveryransomwareworm

Malware Config

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry
  • Contacts a large (3289) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Executes dropped EXE 1 IoCs
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Drops file in Windows directory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\57bd65d2a4c17e283dc1a092ab14e45f.exe
    "C:\Users\Admin\AppData\Local\Temp\57bd65d2a4c17e283dc1a092ab14e45f.exe"
    1⤵
    • Drops file in Windows directory
    PID:4592
    • C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      2⤵
      • Executes dropped EXE
      PID:4968
  • C:\Users\Admin\AppData\Local\Temp\57bd65d2a4c17e283dc1a092ab14e45f.exe
    C:\Users\Admin\AppData\Local\Temp\57bd65d2a4c17e283dc1a092ab14e45f.exe -m security
    1⤵
      PID:3996

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Discovery

    Network Service Scanning

    2
    T1046

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\tasksche.exe
      Filesize

      3.4MB

      MD5

      212631a2af40231cd7586971930713c1

      SHA1

      e12e303396bbfd2807c06f098aca6b8096fc2085

      SHA256

      44f295fd741f4e4e0a4b90a6d0c1af27c97ef8b7a34a93351cac5d3838c3f266

      SHA512

      620bdfe6c28546f7785639dab98fbcd550f72e056af651e06a2f99e6577fce62f553f8be3da45e1cc133d9e59c81c470e4d777a2ffacb4857e16341c97027e15

      Download Submit