wannacry | 07c44729e2c570b37db695323249474831f5861d45318bf49ccf5d2f5c8ea1cd

Analysis

max time kernel
7s
max time network
9s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
20/05/2024, 14:19

Target
wannacry-sample.exe
Size 3.6MB
Sample240520-rm516ade32
SHA256 07c44729e2c570b37db695323249474831f5861d45318bf49ccf5d2f5c8ea1cd
MD5 d724d8cc6420f06e8a48752f0da11c66
SHA1 3b669778698972c402f7c149fc844d0ddb3a00e8
SHA512 d771d74894e72402bbd016787fb102053678424205644bceec17ee3e7598e3f4aeb59b0f3272b5dbe1d26289f659024520653f57fc1bfe18054ffae4f188aef9
SSDEEP 98304:Z8qPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2HI:Z8qPe1Cxcxk3ZAEUadzR8yc4HI
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Executes dropped EXE 1 IoCs

pid	Process
2292	tasksche.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	wannacry-sample.exe

C:\Users\Admin\AppData\Local\Temp\wannacry-sample.exe
"C:\Users\Admin\AppData\Local\Temp\wannacry-sample.exe"
1⤵
- Drops file in Windows directory
PID:368
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:2292

C:\Users\Admin\AppData\Local\Temp\wannacry-sample.exe
C:\Users\Admin\AppData\Local\Temp\wannacry-sample.exe -m security
1⤵
PID:1364

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 2584e1521065e45ec3c17767c065429038fc6291c091097ea8b22c8a502c41dd
MD5 7f7ccaa16fb15eb1c7399d422f8363e8
SHA1 bd44d0ab543bf814d93b719c24e90d8dd7111234
SHA512 83e334b80de08903cfa9891a3fa349c1ece7e19f8e62b74a017512fa9a7989a0fd31929bf1fc13847bee04f2da3dacf6bc3f5ee58f0e4b9d495f4b9af12ed2b7
SSDEEP 98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2Hj:QqPe1Cxcxk3ZAEUadzR8yc4Hj
MD5 SHA1 SHA512 SSDEEP

Submit Download