wannacry | 57eb5c8ac4a9c692fbe3155736689e4ad709828e225601ba8fb403ac83b01463

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
15-06-2024 09:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-15_e8f6dca410652d80ab61755f421d235a_wannacry.exe
Size

3.6MB
MD5

e8f6dca410652d80ab61755f421d235a
SHA1

d4e0b219f6e6c899fa0ad14c8ceb6b7dd327d244
SHA256

57eb5c8ac4a9c692fbe3155736689e4ad709828e225601ba8fb403ac83b01463
SHA512

bee782af025617334673962d720aaf8adf8c059f5799d9f48107da42d87958023ab5a862adaeaf4d54218bea3b052719de4ab32b284dcd23800631b0a0bff755
SSDEEP

98304:Z8qPoBhz1aRxcSUDk36SAWdhvxWa9P553R8yAVp2HI:Z8qPe1Cxcxk3ZAWUad/R8yc4HI

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3182) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Executes dropped EXE 1 IoCs

Processes:

tasksche.exe

pid process

2980 tasksche.exe
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

pid	process
2980	tasksche.exe

Drops file in System32 directory 1 IoCs

Processes:

2024-06-15_e8f6dca410652d80ab61755f421d235a_wannacry.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	2024-06-15_e8f6dca410652d80ab61755f421d235a_wannacry.exe

Drops file in Windows directory 1 IoCs

Processes:

2024-06-15_e8f6dca410652d80ab61755f421d235a_wannacry.exe

description ioc process

File created C:\WINDOWS\tasksche.exe 2024-06-15_e8f6dca410652d80ab61755f421d235a_wannacry.exe

description	ioc	process
File created	C:\WINDOWS\tasksche.exe	2024-06-15_e8f6dca410652d80ab61755f421d235a_wannacry.exe

Modifies data under HKEY_USERS 1 IoCs

Processes:

2024-06-15_e8f6dca410652d80ab61755f421d235a_wannacry.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	2024-06-15_e8f6dca410652d80ab61755f421d235a_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2024-06-15_e8f6dca410652d80ab61755f421d235a_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-15_e8f6dca410652d80ab61755f421d235a_wannacry.exe"
1⤵
- Drops file in Windows directory
PID:2924

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
2⤵
- Executes dropped EXE
PID:2980

C:\Users\Admin\AppData\Local\Temp\2024-06-15_e8f6dca410652d80ab61755f421d235a_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2024-06-15_e8f6dca410652d80ab61755f421d235a_wannacry.exe -m security
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
3f3db6cfc547bf0dce418e6b3a0e7321

SHA1
e918f43816d5b5c23c053c80f176177a8c7bd2e3

SHA256
404f798c1baab97d5e61e1164d97b73852bcfd463f0f3e7b102adb43bd4b23de

SHA512
7612c090164e4d48f41f62d655e54a9dd28f499fca7f39a9f5e8cb3ad6e3682f016795c977eacf44285200ef820f87dd348d2350e2cff63c2e3afc10274d496f

Download Submit