Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
26/10/2022, 12:40
Static task
static1
Behavioral task
behavioral1
Sample
57b29058a1e87d599285cf0a07dd82e65a58dbdaae0f2cf77c6999e49bb4be4b.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
57b29058a1e87d599285cf0a07dd82e65a58dbdaae0f2cf77c6999e49bb4be4b.exe
Resource
win10v2004-20220901-en
General
-
Target
57b29058a1e87d599285cf0a07dd82e65a58dbdaae0f2cf77c6999e49bb4be4b.exe
-
Size
3.6MB
-
MD5
f863dc33ad476c34dfd139230acebbde
-
SHA1
126698d59579a0c020b8ec140a0009b0aeb8fc4c
-
SHA256
57b29058a1e87d599285cf0a07dd82e65a58dbdaae0f2cf77c6999e49bb4be4b
-
SHA512
f4bab399ada745adf26411984357226a874dcf0b3b611d237d132814ee2b325e1da7e553da9edef35f0251ae8251eeeedbb01b167471f98f938cb0337623c03c
-
SSDEEP
98304:Z8rPoBhz6aRxcSUDk36SAEdhvxWa9v5y3R8yAdR:Z8rPe6Cxcxk3ZAEUatuR8yA
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (3219) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Detects WannaCry Ransomware 1 IoCs
resource yara_rule behavioral2/files/0x0001000000022dfd-132.dat WannaCry_Ransomware -
Executes dropped EXE 1 IoCs
pid Process 3988 tasksche.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\WINDOWS\tasksche.exe 57b29058a1e87d599285cf0a07dd82e65a58dbdaae0f2cf77c6999e49bb4be4b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\57b29058a1e87d599285cf0a07dd82e65a58dbdaae0f2cf77c6999e49bb4be4b.exe"C:\Users\Admin\AppData\Local\Temp\57b29058a1e87d599285cf0a07dd82e65a58dbdaae0f2cf77c6999e49bb4be4b.exe"1⤵
- Drops file in Windows directory
PID:1580 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i2⤵
- Executes dropped EXE
PID:3988
-
-
C:\Users\Admin\AppData\Local\Temp\57b29058a1e87d599285cf0a07dd82e65a58dbdaae0f2cf77c6999e49bb4be4b.exeC:\Users\Admin\AppData\Local\Temp\57b29058a1e87d599285cf0a07dd82e65a58dbdaae0f2cf77c6999e49bb4be4b.exe -m security1⤵PID:3468
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.4MB
MD536894136c411d876af4b2b06056826c9
SHA12d949657e2bc0fa932f106a47eece4ea589e8a6b
SHA256a60453c65fdb211bf2a0c45b73977fbd6ed1bfd46de262e76e4d56a5027e0209
SHA512f614ee19874b17448da9fb677a9b2f8b73e5498d8d20a7a2769baa4354c1c99be5f75d1a55265d2b0a923c5c6a559f41eb02bd799c07fe9338af312f5dc48952