Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-09-2022 21:34

General

  • Target

    84099c2e3f641d8722d18d2b555948fe.exe

  • Size

    3MB

  • MD5

    84099c2e3f641d8722d18d2b555948fe

  • SHA1

    846aa657b643666ab2843183b8fb60b4468b0e52

  • SHA256

    6cecf1c41be6009136c66398fb446ae287b91f4ef3bdd2d8f88dd151cb97b515

  • SHA512

    02a3491705f27551b40a6b4ebf08f460198024fd0844aff9c06e8a43bb632f075946b896131419e8079274e2bdadc8dc3b3c9c9e8df80191f8cc7271f424abca

  • SSDEEP

    49152:2nAQqMSPbcBVFAMEcaEau3R8yAH1plAHI:yDqPoBP593R8yAVp2HI

Malware Config

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

  • Contacts a large (3222) amount of remote hosts ⋅ 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Executes dropped EXE ⋅ 1 IoCs
  • Creates a large amount of network flows ⋅ 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Drops file in Windows directory ⋅ 1 IoCs
  • Modifies data under HKEY_USERS ⋅ 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\84099c2e3f641d8722d18d2b555948fe.exe
    "C:\Users\Admin\AppData\Local\Temp\84099c2e3f641d8722d18d2b555948fe.exe"
    Drops file in Windows directory
    PID:4224
    • C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      Executes dropped EXE
      PID:4716
  • C:\Users\Admin\AppData\Local\Temp\84099c2e3f641d8722d18d2b555948fe.exe
    C:\Users\Admin\AppData\Local\Temp\84099c2e3f641d8722d18d2b555948fe.exe -m security
    Modifies data under HKEY_USERS
    PID:4368

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

          Execution

            Exfiltration

              Impact

                Initial Access

                  Lateral Movement

                    Persistence

                      Privilege Escalation

                        Replay Monitor

                        00:00 00:00

                        Downloads

                        • C:\Windows\tasksche.exe
                          MD5

                          52eb8688bbfb129b524ae82ae9fc17ed

                          SHA1

                          caf14da7c532d1f18abda03a07f2caacb829f9f1

                          SHA256

                          dc944d7b8ef7e5c6d62300bc33e3157ebd4343bbec7bb01f162583025ea585ae

                          SHA512

                          2e05f3f996a6f25e9af9fc7f978760c8c1129c10811d7fe866ad0dc6bf27c58780ea32c58772522b3d126ff557935d8a6efb48686656114d53926e28ac4e96f7