Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
08-09-2022 19:44
Static task
static1
Behavioral task
behavioral1
Sample
dc8b8f9c21e7fd8cf6e2253fbc0a5cf1.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
dc8b8f9c21e7fd8cf6e2253fbc0a5cf1.exe
Resource
win10v2004-20220901-en
General
-
Target
dc8b8f9c21e7fd8cf6e2253fbc0a5cf1.exe
-
Size
3.6MB
-
MD5
dc8b8f9c21e7fd8cf6e2253fbc0a5cf1
-
SHA1
4b180b7f6271b9dc320bf65bfa6cf0b62f1ae2ce
-
SHA256
809d539257b48fd3b42a4d5a5a992f32938555415e806e49c6910abaa39e2151
-
SHA512
5d27e3c019dc8ea9e6de4ae78121c7d9cf3b9766aca1a2fb3488e10551c2a35af095ba8b52188606f01c691d8bb4c17d4a2de86f3cfc28558c7f08d82e673c31
-
SSDEEP
98304:Z8qPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2:Z8qPe1Cxcxk3ZAEUadzR8yc4
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (1320) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 1 IoCs
Processes:
tasksche.exepid process 324 tasksche.exe -
Drops file in System32 directory 1 IoCs
Processes:
dc8b8f9c21e7fd8cf6e2253fbc0a5cf1.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat dc8b8f9c21e7fd8cf6e2253fbc0a5cf1.exe -
Drops file in Windows directory 1 IoCs
Processes:
dc8b8f9c21e7fd8cf6e2253fbc0a5cf1.exedescription ioc process File created C:\WINDOWS\tasksche.exe dc8b8f9c21e7fd8cf6e2253fbc0a5cf1.exe -
Modifies data under HKEY_USERS 1 IoCs
Processes:
dc8b8f9c21e7fd8cf6e2253fbc0a5cf1.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings dc8b8f9c21e7fd8cf6e2253fbc0a5cf1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc8b8f9c21e7fd8cf6e2253fbc0a5cf1.exe"C:\Users\Admin\AppData\Local\Temp\dc8b8f9c21e7fd8cf6e2253fbc0a5cf1.exe"1⤵
- Drops file in Windows directory
-
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\dc8b8f9c21e7fd8cf6e2253fbc0a5cf1.exeC:\Users\Admin\AppData\Local\Temp\dc8b8f9c21e7fd8cf6e2253fbc0a5cf1.exe -m security1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\tasksche.exeFilesize
3.4MB
MD571314dcf5eac4d8a1d21754f1f310b94
SHA1e6a1db906604a7034853c818ee6d999eb5ad7eb4
SHA25614f7a0848d1c1c4ceec1d74914a08ba3393d407bad49fb3af0747c65d1f4a21d
SHA512a1accd4490dba5525b822993012a8fd581f9bc2789e3c420bfce6993ded6394135f6876f5ab1954041d344d0f1c603a48424e3311b81b9302fab0b9ae82270f3
-
memory/1460-54-0x0000000075FE1000-0x0000000075FE3000-memory.dmpFilesize
8KB