Analysis

  • max time kernel
    167s
  • max time network
    186s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    04-10-2022 19:26

General

  • Target

    834389b39d5f26ab08bd160f9a102ec0.exe

  • Size

    3MB

  • MD5

    834389b39d5f26ab08bd160f9a102ec0

  • SHA1

    421afaca0623357c4ac0786ad3ad91df7428273e

  • SHA256

    5f8e1de744bccf4d649d5013fc8c5f2de42e8ca5eb99a541896e4f45844066eb

  • SHA512

    244fd59feca3048eac677b2c93f745bee3192d1a97efed079e7cedd716c62ae914aef405ff4e439ecab55a4f8729db7710e724898f5f9de32d3361a949450b5d

  • SSDEEP

    12288:GvbLgPlu+QhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+D4OWFiUBk38p:2bLgddQhfdmMSirYbcMNgef0JR0UriUb

Malware Config

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

  • Contacts a large (1015) amount of remote hosts ⋅ 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Executes dropped EXE ⋅ 1 IoCs
  • Drops file in System32 directory ⋅ 1 IoCs
  • Drops file in Windows directory ⋅ 1 IoCs
  • Modifies data under HKEY_USERS ⋅ 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\834389b39d5f26ab08bd160f9a102ec0.exe
    "C:\Users\Admin\AppData\Local\Temp\834389b39d5f26ab08bd160f9a102ec0.exe"
    Drops file in Windows directory
    PID:1728
    • C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      Executes dropped EXE
      PID:1688
  • C:\Users\Admin\AppData\Local\Temp\834389b39d5f26ab08bd160f9a102ec0.exe
    C:\Users\Admin\AppData\Local\Temp\834389b39d5f26ab08bd160f9a102ec0.exe -m security
    Drops file in System32 directory
    Modifies data under HKEY_USERS
    PID:784

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

          Execution

            Exfiltration

              Impact

                Initial Access

                  Lateral Movement

                    Persistence

                      Privilege Escalation

                        Replay Monitor

                        00:00 00:00

                        Downloads

                        • C:\Windows\tasksche.exe
                          MD5

                          7adc7088044265dfa37a450adf237102

                          SHA1

                          3952ee4debef7d327f7cc1cdbdb60c0fc6dcf327

                          SHA256

                          88935dcd80704c43847491d530f89312342597dcfa0b8620e6d53de790594f96

                          SHA512

                          1761e0fcbb15432a14a49aa127c65b1f23edef7371555b10e190eb941b036f4b8692a2044cbb6fe5cc7b88b48ac6cac46e32f30cab70177da301f7403d3647ec

                        • memory/1728-54-0x0000000076091000-0x0000000076093000-memory.dmp