Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    20-09-2022 16:49

General

  • Target

    f20fb96c126b04600cd54d3093846fef.exe

  • Size

    3MB

  • MD5

    f20fb96c126b04600cd54d3093846fef

  • SHA1

    04fade88f8b78f4f8f89c7d1620e5d37e18abebf

  • SHA256

    480f826cdf5a1e7761910ad42b7b2b9b101a47dad550f01f7a030fae83ed8136

  • SHA512

    4d50cc29e517f51dcb34dc0672277afd72f856e5e4cf46f3054ebb97191666ebe319fdf5278b7758a9c1765cac5ed834cb80023333b5fd6e8c7ef562f93df9a7

  • SSDEEP

    24576:VbLgdeQhfdmMSirYbcMNgef0QeQjG/D8kIqRYoAdNLKz6626:VnjQqMSPbcBVQej/1INR

Malware Config

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

  • Contacts a large (1274) amount of remote hosts ⋅ 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Executes dropped EXE ⋅ 1 IoCs
  • Drops file in System32 directory ⋅ 1 IoCs
  • Drops file in Windows directory ⋅ 1 IoCs
  • Modifies data under HKEY_USERS ⋅ 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f20fb96c126b04600cd54d3093846fef.exe
    "C:\Users\Admin\AppData\Local\Temp\f20fb96c126b04600cd54d3093846fef.exe"
    Drops file in Windows directory
    PID:1364
    • C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      Executes dropped EXE
      PID:1624
  • C:\Users\Admin\AppData\Local\Temp\f20fb96c126b04600cd54d3093846fef.exe
    C:\Users\Admin\AppData\Local\Temp\f20fb96c126b04600cd54d3093846fef.exe -m security
    Drops file in System32 directory
    Modifies data under HKEY_USERS
    PID:1948

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

          Execution

            Exfiltration

              Impact

                Initial Access

                  Lateral Movement

                    Persistence

                      Privilege Escalation

                        Replay Monitor

                        00:00 00:00

                        Downloads

                        • C:\Windows\tasksche.exe
                          MD5

                          891bd1368ffc39813fdd228b3c83a29e

                          SHA1

                          eb64e3dcf4d2ccdfed66cc72b6d27d636446460c

                          SHA256

                          929ac4b6b2b9743a24fab850e29eaa8284e83ae554511c2719d7d87d16d2566a

                          SHA512

                          1e2ac39587445f802f416e4fb9f7d49a721f13ad5bef58c79ef1171911aa230daa5b2e1ac674ff17027ea6841e90c58704717eae70288e900ee10a0e439d4505

                        • memory/1364-54-0x0000000075091000-0x0000000075093000-memory.dmp