wannacry | 133adc02f231842c65138dd52a2f6374bad801432ca9040d20309bfe612646ea

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
04-04-2024 14:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-04_3a6889e0fd7c9a9bac4dd67b91b0e05a_wannacry.exe
Size

3.6MB
MD5

3a6889e0fd7c9a9bac4dd67b91b0e05a
SHA1

4d9650e4c07076b1ee2701d8daa8690c48f45548
SHA256

133adc02f231842c65138dd52a2f6374bad801432ca9040d20309bfe612646ea
SHA512

ae56da1608a3cff3f7acba03b64c5b2d45c3ef83ac29422fdc11ad7ac8d6be9c3d29381dd01b8a3c43514e333a1e6df51ecb99587ec7ce11cc32f9a9908231cf
SSDEEP

49152:XnjQAENbcBVQej/1INRx+TSqTdX1HkQo6SA6dhnvxJM0H9PA:X8A+oBhz1aRxcSUDk36SA6dhvxWa9P

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3287) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Executes dropped EXE 1 IoCs

Processes:

tasksche.exe

pid process

2884 tasksche.exe
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

pid	process
2884	tasksche.exe

Drops file in System32 directory 1 IoCs

Processes:

2024-04-04_3a6889e0fd7c9a9bac4dd67b91b0e05a_wannacry.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	2024-04-04_3a6889e0fd7c9a9bac4dd67b91b0e05a_wannacry.exe

Drops file in Windows directory 1 IoCs

Processes:

2024-04-04_3a6889e0fd7c9a9bac4dd67b91b0e05a_wannacry.exe

description ioc process

File created C:\WINDOWS\tasksche.exe 2024-04-04_3a6889e0fd7c9a9bac4dd67b91b0e05a_wannacry.exe

description	ioc	process
File created	C:\WINDOWS\tasksche.exe	2024-04-04_3a6889e0fd7c9a9bac4dd67b91b0e05a_wannacry.exe

Modifies data under HKEY_USERS 1 IoCs

Processes:

2024-04-04_3a6889e0fd7c9a9bac4dd67b91b0e05a_wannacry.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	2024-04-04_3a6889e0fd7c9a9bac4dd67b91b0e05a_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2024-04-04_3a6889e0fd7c9a9bac4dd67b91b0e05a_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-04_3a6889e0fd7c9a9bac4dd67b91b0e05a_wannacry.exe"
1⤵
- Drops file in Windows directory
PID:1276

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
2⤵
- Executes dropped EXE
PID:2884

C:\Users\Admin\AppData\Local\Temp\2024-04-04_3a6889e0fd7c9a9bac4dd67b91b0e05a_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2024-04-04_3a6889e0fd7c9a9bac4dd67b91b0e05a_wannacry.exe -m security
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
a21663311a3587898e56cf0ccaeaea51

SHA1
cfad33055e76d7fcdc3f15b0788d4554fbf83753

SHA256
6c18edabe4864c9c0da047c7fddc15c09f69b2a99b520c613b3e096d98f80c1e

SHA512
c18655c40f26e3cfae566a4cd4b6136fb3ea797d9749827a0f40938b460be60340beb74696734d115223cf994c2b8fca59b64dd6cc8fe3506750c3e22b0f088e

Download Submit