Analysis

  • max time kernel
    40s
  • max time network
    44s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    08-09-2022 19:55

General

  • Target

    71e07c835a6d82dc921d9e90c8b036a2.exe

  • Size

    6MB

  • MD5

    71e07c835a6d82dc921d9e90c8b036a2

  • SHA1

    3ac79478c87e9b59b6eedec22ca8c97546b04e58

  • SHA256

    450fae63b82d54150b7c939890cde5391d0512195e465463196335031a92b75e

  • SHA512

    e07ed4535989425924ddd10def2d90a75c4c47872eff655b6a51d3f4cf276b63e786935c887f9061c17929832e842d9647443c5f9870a74d6bfd0379a2042f79

  • SSDEEP

    12288:OpbLgPluhQhMbaIMu7L5N5b0Xo3LLFzTM8bQr28mw2o:8bLgdGQhfdmngBmc

Malware Config

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

  • Executes dropped EXE ⋅ 1 IoCs
  • Drops file in System32 directory ⋅ 1 IoCs
  • Drops file in Windows directory ⋅ 1 IoCs
  • Modifies data under HKEY_USERS ⋅ 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\71e07c835a6d82dc921d9e90c8b036a2.exe
    "C:\Users\Admin\AppData\Local\Temp\71e07c835a6d82dc921d9e90c8b036a2.exe"
    Drops file in Windows directory
    PID:1424
    • C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      Executes dropped EXE
      PID:952
  • C:\Users\Admin\AppData\Local\Temp\71e07c835a6d82dc921d9e90c8b036a2.exe
    C:\Users\Admin\AppData\Local\Temp\71e07c835a6d82dc921d9e90c8b036a2.exe -m security
    Drops file in System32 directory
    Modifies data under HKEY_USERS
    PID:940

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

          Discovery

            Execution

              Exfiltration

                Impact

                  Initial Access

                    Lateral Movement

                      Persistence

                        Privilege Escalation

                          Replay Monitor

                          00:00 00:00

                          Downloads

                          • C:\Windows\tasksche.exe
                            MD5

                            bdda04ebcc92840a64946fc222edc563

                            SHA1

                            6f7a92ddf4b6d82c4f8040af1f3d615e00d95a7e

                            SHA256

                            0bb221bf62d875cca625778324fe5bd6907640f6998d21f3106a0447aabc1e3c

                            SHA512

                            b8f2fbb8f9b78976b3a43ce63e005ddfc434cbb630ddaa83e0ab4e5979cd6c27b96c4bf2e4e5e23fc363a0e148fe8925d5ff32da390fb4c848febae6a7b07290

                          • memory/1424-54-0x0000000076151000-0x0000000076153000-memory.dmp