Analysis

  • max time kernel
    163s
  • max time network
    171s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/10/2022, 03:58

General

  • Target

    aee6ea06bd64f629b2f5726c4060ee6ebe4137f6561fa8ceb4f16f08e326e4cd.exe

  • Size

    5.0MB

  • MD5

    18f04f3fdcfc7974cf9d2549e515fee9

  • SHA1

    6ac10312858ff0fa47beef762552ff55810d52d6

  • SHA256

    aee6ea06bd64f629b2f5726c4060ee6ebe4137f6561fa8ceb4f16f08e326e4cd

  • SHA512

    40ec8694273d785217e27ff1ae57441cf7df94540d1927ed7e14fabd23196ff51a0b2e002b4c99466b688b1b6054965fcad756009b8b8c218a0a39d90b88292c

  • SSDEEP

    49152:XnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9PAMEc:XDqPoBhz1aRxcSUDk36SAEdhvxWa9P5

Malware Config

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

  • Contacts a large (2707) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Executes dropped EXE 1 IoCs
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Drops file in Windows directory 1 IoCs
  • Modifies data under HKEY_USERS 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\aee6ea06bd64f629b2f5726c4060ee6ebe4137f6561fa8ceb4f16f08e326e4cd.exe
    "C:\Users\Admin\AppData\Local\Temp\aee6ea06bd64f629b2f5726c4060ee6ebe4137f6561fa8ceb4f16f08e326e4cd.exe"
    1⤵
    • Drops file in Windows directory
    PID:1512
    • C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      2⤵
      • Executes dropped EXE
      PID:2992
  • C:\Users\Admin\AppData\Local\Temp\aee6ea06bd64f629b2f5726c4060ee6ebe4137f6561fa8ceb4f16f08e326e4cd.exe
    C:\Users\Admin\AppData\Local\Temp\aee6ea06bd64f629b2f5726c4060ee6ebe4137f6561fa8ceb4f16f08e326e4cd.exe -m security
    1⤵
    • Modifies data under HKEY_USERS
    PID:956

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\tasksche.exe

          Filesize

          3.4MB

          MD5

          f256e46a05c53e0605a0512d76a4d121

          SHA1

          51d7288eb9a4f7d15a0e87a95d1586756d7ed738

          SHA256

          51d2b7d2e231300ee9bf6a2756fe8dadad287a36edca1f413a8cc1dfaff821f2

          SHA512

          56f4b9755cc0865161368e92af921c462e7dfd12dfd770e60f19699392e488358e440998b1096359521ba9404c984fe8ce8aec41ac28b729791b78ff3b731049