Analysis

  • max time kernel
    151s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/10/2022, 07:44

General

  • Target

    685ae905840253d12480bce0132feeba07fc4f45227ed80836e61a33d38db9b4.exe

  • Size

    2.2MB

  • MD5

    d4260e9e49c78833c7a365f09835d283

  • SHA1

    7c5043cb6f074c50375292e04b0ef11ea1aabaee

  • SHA256

    685ae905840253d12480bce0132feeba07fc4f45227ed80836e61a33d38db9b4

  • SHA512

    2e0f9e9dbbaa00afaa2d7b439c4c2ae2136e2ed7375dddab8acea0e49a38f7a9e3458c34db79e14ce9ea4fe1a452728e0c25e5502c48b3a55c833504cd572f73

  • SSDEEP

    49152:QnaQqMSPbcBVQej/mNRx+TSqTdX1HkQo6SAARdhnvn:QlqPoBhz0RxcSUDk36SAEdhvn

Malware Config

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

  • Contacts a large (3222) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Drops file in Windows directory 1 IoCs
  • Modifies data under HKEY_USERS 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\685ae905840253d12480bce0132feeba07fc4f45227ed80836e61a33d38db9b4.exe
    "C:\Users\Admin\AppData\Local\Temp\685ae905840253d12480bce0132feeba07fc4f45227ed80836e61a33d38db9b4.exe"
    1⤵
    • Drops file in Windows directory
    PID:4184
  • C:\Users\Admin\AppData\Local\Temp\685ae905840253d12480bce0132feeba07fc4f45227ed80836e61a33d38db9b4.exe
    C:\Users\Admin\AppData\Local\Temp\685ae905840253d12480bce0132feeba07fc4f45227ed80836e61a33d38db9b4.exe -m security
    1⤵
    • Modifies data under HKEY_USERS
    PID:4880

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads