wannacry | 1acd786d488a38de659a830f3a7a84c0bcb64b5604e5427e66fe3973317ca87f

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04-05-2024 04:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1186caf32567bfaf1182f0a995c3e4bd_JaffaCakes118.exe
Size

3.6MB
MD5

1186caf32567bfaf1182f0a995c3e4bd
SHA1

ea7125a51e9f300a5a7f41a32648d6dad864528c
SHA256

1acd786d488a38de659a830f3a7a84c0bcb64b5604e5427e66fe3973317ca87f
SHA512

91a338b91af3dd4d5c336083fcfcb3538d7ae8d6372dfff8b56a07e5a748cc0f021be63f133ba17c793da64ab75d886a3f2d5df2472135eff2072b34aaff1456
SSDEEP

98304:Z8qPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2:Z8qPe1Cxcxk3ZAEUadzR8yc4

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3246) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Executes dropped EXE 1 IoCs

Processes:

tasksche.exe

pid process

2552 tasksche.exe
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

pid	process
2552	tasksche.exe

Drops file in System32 directory 1 IoCs

Processes:

1186caf32567bfaf1182f0a995c3e4bd_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	1186caf32567bfaf1182f0a995c3e4bd_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

Processes:

1186caf32567bfaf1182f0a995c3e4bd_JaffaCakes118.exe

description ioc process

File created C:\WINDOWS\tasksche.exe 1186caf32567bfaf1182f0a995c3e4bd_JaffaCakes118.exe

description	ioc	process
File created	C:\WINDOWS\tasksche.exe	1186caf32567bfaf1182f0a995c3e4bd_JaffaCakes118.exe

Modifies data under HKEY_USERS 1 IoCs

Processes:

1186caf32567bfaf1182f0a995c3e4bd_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	1186caf32567bfaf1182f0a995c3e4bd_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\1186caf32567bfaf1182f0a995c3e4bd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1186caf32567bfaf1182f0a995c3e4bd_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
PID:2112

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
2⤵
- Executes dropped EXE
PID:2552

C:\Users\Admin\AppData\Local\Temp\1186caf32567bfaf1182f0a995c3e4bd_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\1186caf32567bfaf1182f0a995c3e4bd_JaffaCakes118.exe -m security
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe
Filesize
3.4MB

MD5
5e95052f73e0eda20e7a74fd0040cbf0

SHA1
6a7eb1e1d9db7a84f30c92b43b9c704c8d05b5d5

SHA256
bc9f3cd2345eea35d7d9bcc170919259366aeb7971b97d9decf77b039c25f149

SHA512
69a640c8ef4c5c2e8078a3791a3eb89a811c64df1231878fc79aa743b4fee1fab8acd4fe7d8761fede71018a2b309d3d0d99bac8b7f46217c10c14053bf8e21b

Download Submit