Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
12-03-2024 09:44
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-12_16e7cd49737471a1466978e588f2709a_wannacry.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-12_16e7cd49737471a1466978e588f2709a_wannacry.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-12_16e7cd49737471a1466978e588f2709a_wannacry.exe
-
Size
2.2MB
-
MD5
16e7cd49737471a1466978e588f2709a
-
SHA1
5189abb6629c0e713d6fdd2997332d94fdae2e22
-
SHA256
fadeb23d099e1450db3a46c6d31537cc37fef9d1f12d427806e3ff8a9fbcc4ff
-
SHA512
3f2a906649f516e11930211d01ef6419057e66afe92dd818b8c4985f942996e7bf9c1ee86633443a35c7b9ad8808d9929435b13aca895131009324ebcae1ede0
-
SSDEEP
49152:QnjQqMSPbcBVQej/1INRB+TSqTdX1HkQo6SAARdhnvn:Q8qPoBhz1aRBcSUDk36SAEdhvn
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (3348) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in Windows directory 1 IoCs
Processes:
2024-03-12_16e7cd49737471a1466978e588f2709a_wannacry.exedescription ioc process File created C:\WINDOWS\tasksche.exe 2024-03-12_16e7cd49737471a1466978e588f2709a_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-12_16e7cd49737471a1466978e588f2709a_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-12_16e7cd49737471a1466978e588f2709a_wannacry.exe"1⤵
- Drops file in Windows directory
PID:2764
-
C:\Users\Admin\AppData\Local\Temp\2024-03-12_16e7cd49737471a1466978e588f2709a_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2024-03-12_16e7cd49737471a1466978e588f2709a_wannacry.exe -m security1⤵PID:2056