wannacry | 832cfba23a0a2ceb6f346e40315d9fb3441e8133f8e7aaf86a0832d5124f040c

Analysis

max time kernel
151s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-04-2024 05:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-16_e49062d9aaa28789ec95f0bc46d8c2e3_wannacry.exe
Size

3.6MB
MD5

e49062d9aaa28789ec95f0bc46d8c2e3
SHA1

b434def0c9628400c297904aa539f3276cbf73d8
SHA256

832cfba23a0a2ceb6f346e40315d9fb3441e8133f8e7aaf86a0832d5124f040c
SHA512

2315346f3bb5fdbe67ed5016da11f6bd6b086608de9427c132c059374ee10fb616d55668e183fedbd7fd3cb6ab117934a2350f2048b7f75fef14d287dc7ec69b
SSDEEP

98304:X8qPoBhzhaRxcSUDk36SAEdhvxWa9P593R8yAVp2:X8qPehCxcxk3ZAEUadzR8yc4

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3248) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Executes dropped EXE 1 IoCs

Processes:

tasksche.exe

pid process

2656 tasksche.exe
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

pid	process
2656	tasksche.exe

Drops file in System32 directory 1 IoCs

Processes:

2024-04-16_e49062d9aaa28789ec95f0bc46d8c2e3_wannacry.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	2024-04-16_e49062d9aaa28789ec95f0bc46d8c2e3_wannacry.exe

Drops file in Windows directory 1 IoCs

Processes:

2024-04-16_e49062d9aaa28789ec95f0bc46d8c2e3_wannacry.exe

description ioc process

File created C:\WINDOWS\tasksche.exe 2024-04-16_e49062d9aaa28789ec95f0bc46d8c2e3_wannacry.exe

description	ioc	process
File created	C:\WINDOWS\tasksche.exe	2024-04-16_e49062d9aaa28789ec95f0bc46d8c2e3_wannacry.exe

Modifies data under HKEY_USERS 1 IoCs

Processes:

2024-04-16_e49062d9aaa28789ec95f0bc46d8c2e3_wannacry.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	2024-04-16_e49062d9aaa28789ec95f0bc46d8c2e3_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2024-04-16_e49062d9aaa28789ec95f0bc46d8c2e3_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-16_e49062d9aaa28789ec95f0bc46d8c2e3_wannacry.exe"
1⤵
- Drops file in Windows directory
PID:1824

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
2⤵
- Executes dropped EXE
PID:2656

C:\Users\Admin\AppData\Local\Temp\2024-04-16_e49062d9aaa28789ec95f0bc46d8c2e3_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2024-04-16_e49062d9aaa28789ec95f0bc46d8c2e3_wannacry.exe -m security
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe
Filesize
3.4MB

MD5
e024b4995e9013037b0c752bfb6363d4

SHA1
9e02acd49e264997c9c76ff2879b0ac9d2eaaa90

SHA256
b561aa6487a02fe5b10ae624762bf93020b6fd312efd94e4edd882f85914c83f

SHA512
9a1ce5d47f0a3f20502cd36789fb933a97f6c1487901506c939f70cd1ba18b9f505b31a929f5f59499678827fd2da0ca01fa76f501efad72b7bd3b4b3cf5c36d

Download Submit