wannacry | 07c44729e2c570b37db695323249474831f5861d45318bf49ccf5d2f5c8ea1cd | Triage

Analysis

max time kernel
19s
max time network
19s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-05-2024 14:25

Sharing

Report Analysis Logs

General

Target

wannacry-sample.exe
Size

3.6MB
MD5

d724d8cc6420f06e8a48752f0da11c66
SHA1

3b669778698972c402f7c149fc844d0ddb3a00e8
SHA256

07c44729e2c570b37db695323249474831f5861d45318bf49ccf5d2f5c8ea1cd
SHA512

d771d74894e72402bbd016787fb102053678424205644bceec17ee3e7598e3f4aeb59b0f3272b5dbe1d26289f659024520653f57fc1bfe18054ffae4f188aef9
SSDEEP

98304:Z8qPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2HI:Z8qPe1Cxcxk3ZAEUadzR8yc4HI

Score

10^/10

wannacry ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Executes dropped EXE 1 IoCs

Processes:

tasksche.exe

pid process

2576 tasksche.exe

Drops file in System32 directory 1 IoCs

Processes:

wannacry-sample.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	wannacry-sample.exe

Drops file in Windows directory 1 IoCs

Processes:

wannacry-sample.exe

description ioc process

File created C:\WINDOWS\tasksche.exe wannacry-sample.exe
Modifies data under HKEY_USERS 1 IoCs

Processes:

wannacry-sample.exe

description ioc process

Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings wannacry-sample.exe

C:\Users\Admin\AppData\Local\Temp\wannacry-sample.exe
"C:\Users\Admin\AppData\Local\Temp\wannacry-sample.exe"
1⤵
- Drops file in Windows directory
PID:1740
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:2576

C:\Users\Admin\AppData\Local\Temp\wannacry-sample.exe
C:\Users\Admin\AppData\Local\Temp\wannacry-sample.exe -m security
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2416

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
7f7ccaa16fb15eb1c7399d422f8363e8

SHA1
bd44d0ab543bf814d93b719c24e90d8dd7111234

SHA256
2584e1521065e45ec3c17767c065429038fc6291c091097ea8b22c8a502c41dd

SHA512
83e334b80de08903cfa9891a3fa349c1ece7e19f8e62b74a017512fa9a7989a0fd31929bf1fc13847bee04f2da3dacf6bc3f5ee58f0e4b9d495f4b9af12ed2b7

Download Submit