wannacry | 37f16a5792b0b250652fb3e4a924c77981ed15d9bb82192b65879fb66f6387ba

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28-04-2024 04:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0457a14cafd4871483b2bc0f2991d675_JaffaCakes118.exe
Size

3.6MB
MD5

0457a14cafd4871483b2bc0f2991d675
SHA1

7c22fbd4dbf24f6f2e78ed8fbb23c65af6524206
SHA256

37f16a5792b0b250652fb3e4a924c77981ed15d9bb82192b65879fb66f6387ba
SHA512

41bb44c372012b71d1a84b938b9f43a45f14362f5ba1e41134adea9ef329e09f8d9181794afd17576f90f90840d1cd92f0e8482a46043f10d58c75bfa2a2b670
SSDEEP

49152:VnjQqMSPbcBVQej/1INRx+TSqTdX1H0H9PAMEcaEau3R8yAH1plAHI:Z8qPoBhz1aRxcSUDa9P593R8yAVp2HI

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3273) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Executes dropped EXE 1 IoCs

Processes:

tasksche.exe

pid process

3452 tasksche.exe
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Drops file in Windows directory 1 IoCs

Processes:

0457a14cafd4871483b2bc0f2991d675_JaffaCakes118.exe

description ioc process

File created C:\WINDOWS\tasksche.exe 0457a14cafd4871483b2bc0f2991d675_JaffaCakes118.exe

pid	process
3452	tasksche.exe

description	ioc	process
File created	C:\WINDOWS\tasksche.exe	0457a14cafd4871483b2bc0f2991d675_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\0457a14cafd4871483b2bc0f2991d675_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0457a14cafd4871483b2bc0f2991d675_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
PID:928

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
2⤵
- Executes dropped EXE
PID:3452

C:\Users\Admin\AppData\Local\Temp\0457a14cafd4871483b2bc0f2991d675_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\0457a14cafd4871483b2bc0f2991d675_JaffaCakes118.exe -m security
1⤵
PID:2396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe
Filesize
3.4MB

MD5
8e3e09a182882e0303926f270e3a146d

SHA1
052ab9d9e9cb0078dab5fca6d4028baa7ae1527d

SHA256
20167e904f9d37ac8a9a0aa54780408427df1f5c01e9b252bf81d94ee7a6a5e2

SHA512
32ad8e1946e6a70755a3b14e8572cb430272eddb4b6e919adb555fb1bce9ffe3496a9a4340e1f80c01a1dc6e7f0e59d683539b61e2648029c7fe20dde1781d27

Download Submit