Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-09-2022 21:34

General

  • Target

    32d3a008f80dfb7337351c1fbbb902be.exe

  • Size

    4MB

  • MD5

    32d3a008f80dfb7337351c1fbbb902be

  • SHA1

    b0d48f57a412ec3e893ef8c5904977113a420faa

  • SHA256

    a7254d36a87b0e187920a083ba9c6b01bb0822b12907622c7ae695357782cbc9

  • SHA512

    e2194083107e3ed9da56c4d1416baac00bee593cf24b4628ec05a2c611cdd5e18eb8c895517e07e6bf5966dae42ca097ea4de2a11435575d5157e36c0b6edcf5

  • SSDEEP

    49152:tn/MSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnv:h/PoBhz1aRxcSUDk36SAEdhv

Malware Config

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

  • Contacts a large (3239) amount of remote hosts ⋅ 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Creates a large amount of network flows ⋅ 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Drops file in Windows directory ⋅ 1 IoCs
  • Modifies data under HKEY_USERS ⋅ 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\32d3a008f80dfb7337351c1fbbb902be.exe
    "C:\Users\Admin\AppData\Local\Temp\32d3a008f80dfb7337351c1fbbb902be.exe"
    Drops file in Windows directory
    PID:2900
  • C:\Users\Admin\AppData\Local\Temp\32d3a008f80dfb7337351c1fbbb902be.exe
    C:\Users\Admin\AppData\Local\Temp\32d3a008f80dfb7337351c1fbbb902be.exe -m security
    Modifies data under HKEY_USERS
    PID:4956

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

          Execution

            Exfiltration

              Impact

                Initial Access

                  Lateral Movement

                    Persistence

                      Privilege Escalation

                        Replay Monitor

                        00:00 00:00

                        Downloads

                        • memory/2900-132-0x0000000000400000-0x0000000000A6B000-memory.dmp
                        • memory/2900-133-0x0000000000400000-0x0000000000A6B000-memory.dmp
                        • memory/4956-134-0x0000000000400000-0x0000000000A6B000-memory.dmp
                        • memory/4956-135-0x0000000000400000-0x0000000000A6B000-memory.dmp