wannacry | aa798e9735bf360a6bb8290a93f9b2fe14dcd1f120902cf80d7f182f5ec3fc32

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 10:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-07-01_b00b93e2b03c7018889cb22c5c3d59f3_wannacry.exe
Size

5.0MB
MD5

b00b93e2b03c7018889cb22c5c3d59f3
SHA1

17f5f556eff577d997801a6dce80ddc79b1dd388
SHA256

aa798e9735bf360a6bb8290a93f9b2fe14dcd1f120902cf80d7f182f5ec3fc32
SHA512

eee37bd1c8ef41b6dcd0d65b19d231b5e4449f970dc79cba84e0ad4d6201a96700c99323c61fba60ef6058f8f9bd3c117ea6e2eb5fb9d7b67c3373971d700e5d
SSDEEP

49152:VnjQqMS7UacBVQej/1INRx+TSqTdX1HkQo6SAARdhnv:Z8qIfBhz1aRxcSUDk36SAEdhv

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3226) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Executes dropped EXE 1 IoCs

Processes:

tasksche.exe

pid process

1220 tasksche.exe
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

pid	process
1220	tasksche.exe

Drops file in System32 directory 1 IoCs

Processes:

2024-07-01_b00b93e2b03c7018889cb22c5c3d59f3_wannacry.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	2024-07-01_b00b93e2b03c7018889cb22c5c3d59f3_wannacry.exe

Drops file in Windows directory 1 IoCs

Processes:

2024-07-01_b00b93e2b03c7018889cb22c5c3d59f3_wannacry.exe

description ioc process

File created C:\WINDOWS\tasksche.exe 2024-07-01_b00b93e2b03c7018889cb22c5c3d59f3_wannacry.exe

description	ioc	process
File created	C:\WINDOWS\tasksche.exe	2024-07-01_b00b93e2b03c7018889cb22c5c3d59f3_wannacry.exe

Modifies data under HKEY_USERS 1 IoCs

Processes:

2024-07-01_b00b93e2b03c7018889cb22c5c3d59f3_wannacry.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	2024-07-01_b00b93e2b03c7018889cb22c5c3d59f3_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2024-07-01_b00b93e2b03c7018889cb22c5c3d59f3_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2024-07-01_b00b93e2b03c7018889cb22c5c3d59f3_wannacry.exe"
1⤵
- Drops file in Windows directory
PID:2080

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
2⤵
- Executes dropped EXE
PID:1220

C:\Users\Admin\AppData\Local\Temp\2024-07-01_b00b93e2b03c7018889cb22c5c3d59f3_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2024-07-01_b00b93e2b03c7018889cb22c5c3d59f3_wannacry.exe -m security
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
be47c3fa4e32bb057f91499b603d478c

SHA1
501e7e82ec51975c6dcd08c55f60994f59638e42

SHA256
396fc79b7c1ed172ea4a9e7b3f5cb9f27d4184a4689060d132b270033e1495dc

SHA512
c2517780782703c4ef0f675ee41908384e7b57d0c871b99c76e2d3c9ad60c82d49eaee3e9bcf08f02eb342e5e3dab1c8b499752c8896c16c12e28b9a6d8ab4be

Download Submit