Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
05-12-2024 17:36
General
-
Target
07c44729e2c570b37db695323249474831f5861d45318bf49ccf5d2f5c8ea1cd.exe
-
Size
3.6MB
-
MD5
d724d8cc6420f06e8a48752f0da11c66
-
SHA1
3b669778698972c402f7c149fc844d0ddb3a00e8
-
SHA256
07c44729e2c570b37db695323249474831f5861d45318bf49ccf5d2f5c8ea1cd
-
SHA512
d771d74894e72402bbd016787fb102053678424205644bceec17ee3e7598e3f4aeb59b0f3272b5dbe1d26289f659024520653f57fc1bfe18054ffae4f188aef9
-
SSDEEP
98304:Z8qPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2HI:Z8qPe1Cxcxk3ZAEUadzR8yc4HI
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Wannacry family
-
Contacts a large (3336) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 1 IoCs
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in System32 directory 1 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Office loads VBA resources, possible macro or embedded object present
-
Modifies data under HKEY_USERS 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\07c44729e2c570b37db695323249474831f5861d45318bf49ccf5d2f5c8ea1cd.exe"C:\Users\Admin\AppData\Local\Temp\07c44729e2c570b37db695323249474831f5861d45318bf49ccf5d2f5c8ea1cd.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\07c44729e2c570b37db695323249474831f5861d45318bf49ccf5d2f5c8ea1cd.exeC:\Users\Admin\AppData\Local\Temp\07c44729e2c570b37db695323249474831f5861d45318bf49ccf5d2f5c8ea1cd.exe -m security1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskmgr.exetaskmgr.exe /31⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4f01⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\Desktop\FormatGroup.docx"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\ReceiveCompress.mpe"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD5ed4decc6a699b9e2b7220c6d46aa718e
SHA1104b32030a4d9a2df0b7708de78de68c9a40b589
SHA2565b58a96ecfdaafee94e93f6fb2f849aca994e2a85858006276f5430f8b6a524c
SHA512f14607089d8701390003901209cb469fc235ab608ede154afacd06bafe2fd3c28b19477421503d53086670ddd4f749847bfa9122d2c752e63e9f2ca9377f4743
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
81B
MD5918ae36ba75f71a24c4de0be495e75c9
SHA194991a9e13ab566f324c5d7c0cb5a630617dd5ce
SHA256af600035f2a77a57b9b02a82eb07e28023bdc8960a18b9d100fb84720c3aa352
SHA512a7062f0efb7778a179db8ed8b3e5dc80ce115f620fd1c0746d5b9606cd3bffd5a3740acca04ce2aea98c74c19a9d17d9ab208b26fc72c1813db6daa505a3623c
-
Filesize
80B
MD52df4381fd3e5196192ec95181466aab0
SHA1be0a8ecd297f0341df0890773528e49fb005700e
SHA2561dd230e589c409d62a1c7c3dce9fe893a01cbf5e43b2f4ae96d02f93092b685a
SHA512a74a2290be45c91e0ef21ea53c3ffd4a507f4d80dbf124cc9a138c7ee0c44470e8e011df70d52dac39cd93dd0cb62d9fd1f3a48c33989cb2c069bdef36a8e645
-
Filesize
18B
MD500fd88a7dc83168ab24d18185ac710be
SHA10eba84d437a17065be6045852b6658eb9977ef4b
SHA256e305f9a288b3b9baba45e94f2cd69703f84612b3487f3d2d6b07995b405e4772
SHA512d8217056e39e3aa51d4eaf6e2f87db19fa814ba38fb3d2978e526e748cedb28a929ae24c7f44a3d062a3f8b1e2e438ee74eb494c22857c6ba3556edb49abd8ef
-
Filesize
3.4MB
MD57f7ccaa16fb15eb1c7399d422f8363e8
SHA1bd44d0ab543bf814d93b719c24e90d8dd7111234
SHA2562584e1521065e45ec3c17767c065429038fc6291c091097ea8b22c8a502c41dd
SHA51283e334b80de08903cfa9891a3fa349c1ece7e19f8e62b74a017512fa9a7989a0fd31929bf1fc13847bee04f2da3dacf6bc3f5ee58f0e4b9d495f4b9af12ed2b7
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
144KB
-
Filesize
88KB
-
Filesize
96KB
-
Filesize
92KB
-
Filesize
68KB
-
Filesize
2.7MB
-
Filesize
68KB
-
Filesize
116KB
-
Filesize
92KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
96KB
-
Filesize
68KB
-
Filesize
132KB
-
Filesize
2.0MB
-
Filesize
68KB
-
Filesize
108KB
-
Filesize
96KB
-
Filesize
68KB
-
Filesize
192KB
-
Filesize
260KB
-
Filesize
96KB
-
Filesize
992KB
-
Filesize
788KB
-
Filesize
264KB
-
Filesize
208KB
-
Filesize
68KB
-
Filesize
188KB
-
Filesize
392KB
-
Filesize
64KB
-
Filesize
92KB
-
Filesize
68KB
-
Filesize
132KB
-
Filesize
72KB
-
Filesize
68KB
-
Filesize
140KB
-
Filesize
16.7MB
-
Filesize
160KB
-
Filesize
348KB
-
Filesize
436KB
-
Filesize
68KB
-
Filesize
496KB
-
Filesize
412KB
-
Filesize
1.5MB
-
Filesize
208KB
-
Filesize
992KB
-
Filesize
2.7MB
-
Filesize
16.7MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
4KB