Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    20-09-2022 16:49

General

  • Target

    f20fb96c126b04600cd54d3093846fef.exe

  • Size

    3.6MB

  • MD5

    f20fb96c126b04600cd54d3093846fef

  • SHA1

    04fade88f8b78f4f8f89c7d1620e5d37e18abebf

  • SHA256

    480f826cdf5a1e7761910ad42b7b2b9b101a47dad550f01f7a030fae83ed8136

  • SHA512

    4d50cc29e517f51dcb34dc0672277afd72f856e5e4cf46f3054ebb97191666ebe319fdf5278b7758a9c1765cac5ed834cb80023333b5fd6e8c7ef562f93df9a7

  • SSDEEP

    24576:VbLgdeQhfdmMSirYbcMNgef0QeQjG/D8kIqRYoAdNLKz6626:VnjQqMSPbcBVQej/1INR

Malware Config

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

  • Contacts a large (1274) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Modifies data under HKEY_USERS 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f20fb96c126b04600cd54d3093846fef.exe
    "C:\Users\Admin\AppData\Local\Temp\f20fb96c126b04600cd54d3093846fef.exe"
    1⤵
    • Drops file in Windows directory
    PID:1364
    • C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      2⤵
      • Executes dropped EXE
      PID:1624
  • C:\Users\Admin\AppData\Local\Temp\f20fb96c126b04600cd54d3093846fef.exe
    C:\Users\Admin\AppData\Local\Temp\f20fb96c126b04600cd54d3093846fef.exe -m security
    1⤵
    • Drops file in System32 directory
    • Modifies data under HKEY_USERS
    PID:1948

Network

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Network Service Scanning

1
T1046

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\tasksche.exe
    Filesize

    3.4MB

    MD5

    891bd1368ffc39813fdd228b3c83a29e

    SHA1

    eb64e3dcf4d2ccdfed66cc72b6d27d636446460c

    SHA256

    929ac4b6b2b9743a24fab850e29eaa8284e83ae554511c2719d7d87d16d2566a

    SHA512

    1e2ac39587445f802f416e4fb9f7d49a721f13ad5bef58c79ef1171911aa230daa5b2e1ac674ff17027ea6841e90c58704717eae70288e900ee10a0e439d4505

  • memory/1364-54-0x0000000075091000-0x0000000075093000-memory.dmp
    Filesize

    8KB