Resubmissions

23/02/2024, 12:19

240223-phk43sfe9t 10

22/02/2024, 05:22

240222-f2z8nscg76 10

Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/02/2024, 05:22

General

  • Target

    2024-02-22_afec7757405903d50fdca2c74329362d_wannacry.exe

  • Size

    3.6MB

  • MD5

    afec7757405903d50fdca2c74329362d

  • SHA1

    8eccb68d3dd0bbd51652546734fcc10a64dc27fa

  • SHA256

    4b97a898a1b6beee9a4f693c0aa41881d1dc4cc7d00750dc7e468915a2096145

  • SHA512

    97f79a3264c3d4076ace6eb4ce9bfbcd3eb1ce94b35aaae37131a6b4bcca8fd2989c67713733f189ee515dddb985eabdb62e0853d8cbe02475c9075f4d8ad7f8

  • SSDEEP

    98304:pDqPoBhz1aRxcSUDkdEdhvxWa9P593R8yAVp2HI:pDqPe1CxcxkdEUadzR8yc4HI

Malware Config

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

  • Contacts a large (3194) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Executes dropped EXE 1 IoCs
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Drops file in Windows directory 1 IoCs
  • Modifies data under HKEY_USERS 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-22_afec7757405903d50fdca2c74329362d_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-22_afec7757405903d50fdca2c74329362d_wannacry.exe"
    1⤵
    • Drops file in Windows directory
    PID:1788
    • C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      2⤵
      • Executes dropped EXE
      PID:2012
  • C:\Users\Admin\AppData\Local\Temp\2024-02-22_afec7757405903d50fdca2c74329362d_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp\2024-02-22_afec7757405903d50fdca2c74329362d_wannacry.exe -m security
    1⤵
    • Modifies data under HKEY_USERS
    PID:4576

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\tasksche.exe

          Filesize

          1.8MB

          MD5

          3de93448cd779caee68e53c0a35cf686

          SHA1

          28379f784728c490b9064fd0f7c06abaab25d73c

          SHA256

          286a71066c89a702ba58a77971639f644a2062d851777f5d47ea94cc04e1a087

          SHA512

          d43f5d5a8f59a08bd46d73723849f09cb561ac7d320ea81bdc62ce75216993d5b1c572ea76775e7da44acc408201ee0792c8e59259b3a8a37aa598e942ed2e12

        • memory/1788-0-0x0000000000400000-0x0000000000A70000-memory.dmp

          Filesize

          6.4MB

        • memory/1788-5-0x0000000000400000-0x0000000000A70000-memory.dmp

          Filesize

          6.4MB

        • memory/4576-1-0x0000000000400000-0x0000000000A70000-memory.dmp

          Filesize

          6.4MB

        • memory/4576-6-0x0000000000400000-0x0000000000A70000-memory.dmp

          Filesize

          6.4MB