Resubmissions

23/02/2024, 12:19

240223-phk43sfe9t 10

22/02/2024, 05:22

240222-f2z8nscg76 10

Analysis

  • max time kernel
    151s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    22/02/2024, 05:22

General

  • Target

    2024-02-22_afec7757405903d50fdca2c74329362d_wannacry.exe

  • Size

    3.6MB

  • MD5

    afec7757405903d50fdca2c74329362d

  • SHA1

    8eccb68d3dd0bbd51652546734fcc10a64dc27fa

  • SHA256

    4b97a898a1b6beee9a4f693c0aa41881d1dc4cc7d00750dc7e468915a2096145

  • SHA512

    97f79a3264c3d4076ace6eb4ce9bfbcd3eb1ce94b35aaae37131a6b4bcca8fd2989c67713733f189ee515dddb985eabdb62e0853d8cbe02475c9075f4d8ad7f8

  • SSDEEP

    98304:pDqPoBhz1aRxcSUDkdEdhvxWa9P593R8yAVp2HI:pDqPe1CxcxkdEUadzR8yc4HI

Malware Config

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

  • Contacts a large (3068) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Executes dropped EXE 1 IoCs
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Modifies data under HKEY_USERS 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-22_afec7757405903d50fdca2c74329362d_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-22_afec7757405903d50fdca2c74329362d_wannacry.exe"
    1⤵
    • Drops file in Windows directory
    PID:1812
    • C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      2⤵
      • Executes dropped EXE
      PID:1392
  • C:\Users\Admin\AppData\Local\Temp\2024-02-22_afec7757405903d50fdca2c74329362d_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp\2024-02-22_afec7757405903d50fdca2c74329362d_wannacry.exe -m security
    1⤵
    • Drops file in System32 directory
    • Modifies data under HKEY_USERS
    PID:2400

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\tasksche.exe

          Filesize

          3.4MB

          MD5

          6d646ebbd26465af01a7b3e04f42e641

          SHA1

          0e457a67519b657e8d56e156dbc1276849ea2cdc

          SHA256

          ab512481cb3b26d36a41888b7bbba55dccbb42ab364c72b768cda1545be3f408

          SHA512

          d1a0b4a2984377eb685092fa8c4b4a1f8f399a37933550a714843a39c4977dbe25a45edc944b0b989688a5a2eceea038179fa655eb3c10d5f96a274fad83a861

        • memory/1812-0-0x0000000000400000-0x0000000000A70000-memory.dmp

          Filesize

          6.4MB

        • memory/1812-6-0x0000000000400000-0x0000000000A70000-memory.dmp

          Filesize

          6.4MB

        • memory/2400-1-0x0000000000400000-0x0000000000A70000-memory.dmp

          Filesize

          6.4MB

        • memory/2400-7-0x0000000000400000-0x0000000000A70000-memory.dmp

          Filesize

          6.4MB