Analysis

  • max time kernel
    187s
  • max time network
    192s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    11/10/2022, 03:57

General

  • Target

    9b4a17bb43644b40651948c85c766625fc850789690a94a582f72594c44766d3.exe

  • Size

    5.0MB

  • MD5

    2fca5b13e15f025de261853c65969e2e

  • SHA1

    ba989508bb7621478aa835eb6222ab5cebf5419f

  • SHA256

    9b4a17bb43644b40651948c85c766625fc850789690a94a582f72594c44766d3

  • SHA512

    62a0cf391a8b76deb64572c51dc894ae9fbb67c88a19aa55f8bdef973c86dcba4fa626659f6b3597b17169ea1ac5dc227490c0f8ae5a5005b4d3fcb7a750f019

  • SSDEEP

    6144:GE9l9yUqIYVTH5DgSg8ajldktM0XXrP2QhMV9qbB:GvbLgPlu+QhMb

Malware Config

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

  • Contacts a large (1283) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Modifies data under HKEY_USERS 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9b4a17bb43644b40651948c85c766625fc850789690a94a582f72594c44766d3.exe
    "C:\Users\Admin\AppData\Local\Temp\9b4a17bb43644b40651948c85c766625fc850789690a94a582f72594c44766d3.exe"
    1⤵
    • Drops file in Windows directory
    PID:1348
    • C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      2⤵
      • Executes dropped EXE
      PID:616
  • C:\Users\Admin\AppData\Local\Temp\9b4a17bb43644b40651948c85c766625fc850789690a94a582f72594c44766d3.exe
    C:\Users\Admin\AppData\Local\Temp\9b4a17bb43644b40651948c85c766625fc850789690a94a582f72594c44766d3.exe -m security
    1⤵
    • Drops file in System32 directory
    • Modifies data under HKEY_USERS
    PID:288

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\tasksche.exe

          Filesize

          3.4MB

          MD5

          74ef2414a12a4160bfc7632b01e073e5

          SHA1

          f9618fc409a0af309fe50dfa93d702a9357e42ef

          SHA256

          630d75fd88047e413c8cea30edbaf3a3b987a9cfebf298d4d0b01b1f11275fb5

          SHA512

          fc0f38abb326bec3b91de71a946540f9e8ff269d40f3379089af5e8f711d5320136c7f355e82a975a414f64e86e193e5acbaa0b31412cb46d8b5f7fd68b8249a

        • memory/1348-54-0x0000000075071000-0x0000000075073000-memory.dmp

          Filesize

          8KB