Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
01/07/2024, 14:09
240701-rf4vhsyhrk 1001/07/2024, 14:08
240701-rfj54syhpp 1001/07/2024, 11:10
240701-m9zensyapa 10Analysis
-
max time kernel
27s -
max time network
34s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
01/07/2024, 14:08
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-01_75b350c8f7e67883d1ba9d71198cef1b_wannacry.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-07-01_75b350c8f7e67883d1ba9d71198cef1b_wannacry.exe
-
Size
5.0MB
-
MD5
75b350c8f7e67883d1ba9d71198cef1b
-
SHA1
833a369367059b5ae28542fea0eee425140b70ff
-
SHA256
4aec93b2e437151c2d618a9dddb37957a27529b6b3577bccd41ee057beac8d67
-
SHA512
cc08357d1bb621ec3bcb1f7d0055dd52c477f70327377f0aec9767281318a0c6c37294d15f7d59ab3cbe39fd589d9a11f8ae8f3983c78d5a72f2af634a1fa660
-
SSDEEP
49152:2nAQqMSPTx+TSqTdX1HkQo6SAARdhnvxJM0H9PAMEcaEau3R8yAH:yDqPTxcSUDk36SAEdhvxWa9P593R8yA
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Executes dropped EXE 1 IoCs
pid Process 3112 tasksche.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\WINDOWS\tasksche.exe 2024-07-01_75b350c8f7e67883d1ba9d71198cef1b_wannacry.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 2024-07-01_75b350c8f7e67883d1ba9d71198cef1b_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 2024-07-01_75b350c8f7e67883d1ba9d71198cef1b_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 2024-07-01_75b350c8f7e67883d1ba9d71198cef1b_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 2024-07-01_75b350c8f7e67883d1ba9d71198cef1b_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 2024-07-01_75b350c8f7e67883d1ba9d71198cef1b_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-01_75b350c8f7e67883d1ba9d71198cef1b_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-01_75b350c8f7e67883d1ba9d71198cef1b_wannacry.exe"1⤵
- Drops file in Windows directory
PID:2304 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i2⤵
- Executes dropped EXE
PID:3112
-
-
C:\Users\Admin\AppData\Local\Temp\2024-07-01_75b350c8f7e67883d1ba9d71198cef1b_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2024-07-01_75b350c8f7e67883d1ba9d71198cef1b_wannacry.exe -m security1⤵
- Modifies data under HKEY_USERS
PID:4808
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.4MB
MD57f1cd7f071ee1e55b6d10990c31bdc14
SHA1c8848b84a15bf538ca7ecefcf362ddb4e11b4a43
SHA25683f9c04a45f3be7cd72e98089ca121bdedaa49f7c45f84df915fdcea970a0245
SHA512f76f7244cf78f0623ac3284694854d99cad5c9e86a2efc591c053f50e0f0c48aaff59abe873cf665d04d4fbdb8b252eeebee8ae79e95ce44f2e5bac4e27b61f9