Behavioral Report

Analysis

max time kernel
151s
max time network
154s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
08-09-2022 19:40

Sharing

Copy URL

Twitter E-mail

Report Files Registry Network Processes Mutex Misc

General

Target

87f80f62e4d7e3cdfa712fc109bc79a4.exe
Size

3MB
MD5

87f80f62e4d7e3cdfa712fc109bc79a4
SHA1

03abae660bf37cfbffae6d0e34c896fe3d5557d6
SHA256

08986944b87cbbb7245a342f846dfb03534e749ed9ffd453babd4f9f7682f066
SHA512

1da0fe361dcc17177d680e6922dcd26939a4c3df30ccb75310ed7be94e9c8172728949f5e489eeef583065e3fe7724317a71c527b436576b0527a0bd9e6566a6
SSDEEP

6144:GE9l9yNqIYVTH5DgSg8ajldktM0XXrs2Qh:GwbLgPluxQh

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (1284) amount of remote hosts ⋅ 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

TTPs:

Network Service Scanning
Executes dropped EXE ⋅ 1 IoCs

Processes:

tasksche.exe

pid process

1516 tasksche.exe

pid	process
1516	tasksche.exe

Drops file in System32 directory ⋅ 1 IoCs

Processes:

87f80f62e4d7e3cdfa712fc109bc79a4.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	87f80f62e4d7e3cdfa712fc109bc79a4.exe

Drops file in Windows directory ⋅ 1 IoCs

Processes:

87f80f62e4d7e3cdfa712fc109bc79a4.exe

description ioc process

File created C:\WINDOWS\tasksche.exe 87f80f62e4d7e3cdfa712fc109bc79a4.exe

description	ioc	process
File created	C:\WINDOWS\tasksche.exe	87f80f62e4d7e3cdfa712fc109bc79a4.exe

Modifies data under HKEY_USERS ⋅ 1 IoCs

Processes:

87f80f62e4d7e3cdfa712fc109bc79a4.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	87f80f62e4d7e3cdfa712fc109bc79a4.exe

Suspicious use of WriteProcessMemory ⋅ 4 IoCs

Processes:

87f80f62e4d7e3cdfa712fc109bc79a4.exe

description	pid	process	target process
PID 1416 wrote to memory of 1516	1416	87f80f62e4d7e3cdfa712fc109bc79a4.exe	tasksche.exe
PID 1416 wrote to memory of 1516	1416	87f80f62e4d7e3cdfa712fc109bc79a4.exe	tasksche.exe
PID 1416 wrote to memory of 1516	1416	87f80f62e4d7e3cdfa712fc109bc79a4.exe	tasksche.exe
PID 1416 wrote to memory of 1516	1416	87f80f62e4d7e3cdfa712fc109bc79a4.exe	tasksche.exe

C:\Users\Admin\AppData\Local\Temp\87f80f62e4d7e3cdfa712fc109bc79a4.exe

"C:\Users\Admin\AppData\Local\Temp\87f80f62e4d7e3cdfa712fc109bc79a4.exe"

Drops file in Windows directory
Suspicious use of WriteProcessMemory

PID:1416

C:\WINDOWS\tasksche.exe

C:\WINDOWS\tasksche.exe /i

Executes dropped EXE

PID:1516

C:\Users\Admin\AppData\Local\Temp\87f80f62e4d7e3cdfa712fc109bc79a4.exe

C:\Users\Admin\AppData\Local\Temp\87f80f62e4d7e3cdfa712fc109bc79a4.exe -m security

Drops file in System32 directory
Modifies data under HKEY_USERS

PID:1456

Network

MITRE ATT&CK Matrix

Collection

Command and Control

Credential Access

Defense Evasion

Discovery

Network Service Scanning

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Privilege Escalation

Replay Monitor

00:00 00:00

Downloads

C:\Windows\tasksche.exe
MD5
f78f0687753655dfa05483afeed87e95

SHA1
4a9821ef8b85c2c61168e9a143a4ea43dda15e1c

SHA256
ff24805aaa26c840eae9996c8ac7bcb7050b55a9f61436be71e9cf8e21634a00

SHA512
23516197d198fb04c5ad01867f6eaaf447002ba3a2a21db850fae4cca242f7da4e64cfa295b05008c5aef8863b5c5aa558bd324c6e26bb2a9836b23bdb87348a

Download Submit
memory/1416-54-0x0000000075A91000-0x0000000075A93000-memory.dmp

Download
memory/1516-56-0x0000000000000000-mapping.dmp

Download