Analysis

  • max time kernel
    152s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-09-2022 16:49

General

  • Target

    f20fb96c126b04600cd54d3093846fef.exe

  • Size

    3.6MB

  • MD5

    f20fb96c126b04600cd54d3093846fef

  • SHA1

    04fade88f8b78f4f8f89c7d1620e5d37e18abebf

  • SHA256

    480f826cdf5a1e7761910ad42b7b2b9b101a47dad550f01f7a030fae83ed8136

  • SHA512

    4d50cc29e517f51dcb34dc0672277afd72f856e5e4cf46f3054ebb97191666ebe319fdf5278b7758a9c1765cac5ed834cb80023333b5fd6e8c7ef562f93df9a7

  • SSDEEP

    24576:VbLgdeQhfdmMSirYbcMNgef0QeQjG/D8kIqRYoAdNLKz6626:VnjQqMSPbcBVQej/1INR

Malware Config

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

  • Contacts a large (3198) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Executes dropped EXE 1 IoCs
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Drops file in Windows directory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f20fb96c126b04600cd54d3093846fef.exe
    "C:\Users\Admin\AppData\Local\Temp\f20fb96c126b04600cd54d3093846fef.exe"
    1⤵
    • Drops file in Windows directory
    PID:1944
    • C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      2⤵
      • Executes dropped EXE
      PID:1864
  • C:\Users\Admin\AppData\Local\Temp\f20fb96c126b04600cd54d3093846fef.exe
    C:\Users\Admin\AppData\Local\Temp\f20fb96c126b04600cd54d3093846fef.exe -m security
    1⤵
      PID:3988

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Discovery

    Network Service Scanning

    2
    T1046

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\tasksche.exe
      Filesize

      3.4MB

      MD5

      891bd1368ffc39813fdd228b3c83a29e

      SHA1

      eb64e3dcf4d2ccdfed66cc72b6d27d636446460c

      SHA256

      929ac4b6b2b9743a24fab850e29eaa8284e83ae554511c2719d7d87d16d2566a

      SHA512

      1e2ac39587445f802f416e4fb9f7d49a721f13ad5bef58c79ef1171911aa230daa5b2e1ac674ff17027ea6841e90c58704717eae70288e900ee10a0e439d4505