wannacry | f1780065155ee70e8fa8bf4dab5bc7bb195f1a6a9e40baef8d9cebd890fef448

Analysis

max time kernel
32s
max time network
147s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 06:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-08_f6761ec2f7f11f3a0cb2dedeb3f7a271_wannacry.exe
Size

3.6MB
MD5

f6761ec2f7f11f3a0cb2dedeb3f7a271
SHA1

aaa938c98490218a3cf7004799fd099975824f5b
SHA256

f1780065155ee70e8fa8bf4dab5bc7bb195f1a6a9e40baef8d9cebd890fef448
SHA512

4cad39f6f593386716a15df3d514ffb0aa7cff370aef535510bdda0ee49824ffd84c66bbfb0f10a2532b7d76a4196d576b419522fb9c280a121d35efb1469e39
SSDEEP

98304:V8qPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2H:V8qPe1Cxcxk3ZAEUadzR8yc4H

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3249) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 1 IoCs

pid	Process
2184	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	2024-01-08_f6761ec2f7f11f3a0cb2dedeb3f7a271_wannacry.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	2024-01-08_f6761ec2f7f11f3a0cb2dedeb3f7a271_wannacry.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	2024-01-08_f6761ec2f7f11f3a0cb2dedeb3f7a271_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2024-01-08_f6761ec2f7f11f3a0cb2dedeb3f7a271_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-08_f6761ec2f7f11f3a0cb2dedeb3f7a271_wannacry.exe"
1⤵
- Drops file in Windows directory
PID:2548
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:2184

C:\Users\Admin\AppData\Local\Temp\2024-01-08_f6761ec2f7f11f3a0cb2dedeb3f7a271_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2024-01-08_f6761ec2f7f11f3a0cb2dedeb3f7a271_wannacry.exe -m security
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
553b2eb43fb4cf5216874b28c8694d80

SHA1
e1da6a5701e4b6556ab1243178a7273c6b62f462

SHA256
41027cc66e75278d609383e6fde1b91c47c8669b2c495b57d8fe6fa80e9e0079

SHA512
4122df2280aeef3a9a2e18edc0e9b67d38520fdfbf8957b79c7215a2b91549be6a6c2949d8a30cfb8f287cb163dc4fcf6528470f67576197407123eff345b52e

Download Submit
memory/2548-0-0x0000000000400000-0x0000000000A6B000-memory.dmp

Filesize
6.4MB

Download
memory/2548-6-0x0000000000400000-0x0000000000A6B000-memory.dmp

Filesize
6.4MB

Download
memory/2740-5-0x0000000000400000-0x0000000000A6B000-memory.dmp

Filesize
6.4MB

Download