wannacry | 67ca71511a81d806852809a11fbe082b4e091229b7b31d0e171ee7ae19eae557

Resubmissions

20-04-2024 15:52

240420-ta57haca93 10

20-04-2024 00:18

240420-alnl2sbc59 10

Analysis

max time kernel
93s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 15:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-19_e153361536153b43948d39ba8ea1b720_wannacry.exe
Size

240KB
MD5

e153361536153b43948d39ba8ea1b720
SHA1

c36387456b2734e893258a9404ed722f3df781ac
SHA256

67ca71511a81d806852809a11fbe082b4e091229b7b31d0e171ee7ae19eae557
SHA512

f4cf1e546a3fd01c52d8ae602f6d4184849f183fa7863a63579929b9b372296a2358e1ba9ca0262b5fc9886325ecafdff661b70539b4ad15030b7c561b57e19f
SSDEEP

3072:Rmrhd5U1eigWcR+uiUg6p4FLlG4tlL8z+mmCeHFZjoHEo3H:REd5+IZiZhLlG4AimmCV

Score

10^/10

wannacry ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

2024-04-19_e153361536153b43948d39ba8ea1b720_wannacry.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	2024-04-19_e153361536153b43948d39ba8ea1b720_wannacry.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3520 2576 WerFault.exe 2024-04-19_e153361536153b43948d39ba8ea1b720_wannacry.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

2024-04-19_e153361536153b43948d39ba8ea1b720_wannacry.exe

pid process

2576 2024-04-19_e153361536153b43948d39ba8ea1b720_wannacry.exe
2576 2024-04-19_e153361536153b43948d39ba8ea1b720_wannacry.exe

pid	pid_target	process	target process
3520	2576	WerFault.exe	2024-04-19_e153361536153b43948d39ba8ea1b720_wannacry.exe

pid	process
2576	2024-04-19_e153361536153b43948d39ba8ea1b720_wannacry.exe
2576	2024-04-19_e153361536153b43948d39ba8ea1b720_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2024-04-19_e153361536153b43948d39ba8ea1b720_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-19_e153361536153b43948d39ba8ea1b720_wannacry.exe"
1⤵
- Sets desktop wallpaper using registry
- Suspicious use of SetWindowsHookEx
PID:2576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2576 -s 940
2⤵
- Program crash
PID:3520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2576 -ip 2576
1⤵
PID:1180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:4984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact