070fdfef4e3c9d4c72d04514817dd21ef406397f0119db96f9310a21c32aba2b

Analysis

max time kernel
2s
max time network
11s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2024, 15:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WANNACRY.exe
Size

308KB
MD5

24ea5c5f674b644433a6604e4f1f482c
SHA1

7dd3fd7c8ca31ed4e64c66b3535fc2c6344a48e0
SHA256

070fdfef4e3c9d4c72d04514817dd21ef406397f0119db96f9310a21c32aba2b
SHA512

7ea5f10e1e6844832ce4d37773047b00fa37a3174bde0af3f45504b8b48376cd62be544fabd7fc996aa71d87f141ed63a673bdddf5ed394c849668192ff7e586
SSDEEP

6144:BH+ukuXqDw1hSXP0xaNle8zsfhZIKFKN8KmX:T7G5Pe8zsFg8RX

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2816	msedge.exe
2816	msedge.exe
4480	msedge.exe
4480	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 8	2508	WANNACRY.exe	82
PID 2508 wrote to memory of 8	2508	WANNACRY.exe	82
PID 2508 wrote to memory of 3660	2508	WANNACRY.exe	83
PID 2508 wrote to memory of 3660	2508	WANNACRY.exe	83
PID 2508 wrote to memory of 3640	2508	WANNACRY.exe	84
PID 2508 wrote to memory of 3640	2508	WANNACRY.exe	84
PID 2508 wrote to memory of 4404	2508	WANNACRY.exe	86
PID 2508 wrote to memory of 4404	2508	WANNACRY.exe	86
PID 2508 wrote to memory of 4480	2508	WANNACRY.exe	91
PID 2508 wrote to memory of 4480	2508	WANNACRY.exe	91
PID 4480 wrote to memory of 3108	4480	msedge.exe	92
PID 4480 wrote to memory of 3108	4480	msedge.exe	92
PID 4480 wrote to memory of 4472	4480	msedge.exe	93
PID 4480 wrote to memory of 4472	4480	msedge.exe	93
PID 4480 wrote to memory of 4472	4480	msedge.exe	93
PID 4480 wrote to memory of 4472	4480	msedge.exe	93
PID 4480 wrote to memory of 4472	4480	msedge.exe	93
PID 4480 wrote to memory of 4472	4480	msedge.exe	93
PID 4480 wrote to memory of 4472	4480	msedge.exe	93
PID 4480 wrote to memory of 4472	4480	msedge.exe	93
PID 4480 wrote to memory of 4472	4480	msedge.exe	93
PID 4480 wrote to memory of 4472	4480	msedge.exe	93
PID 4480 wrote to memory of 4472	4480	msedge.exe	93
PID 4480 wrote to memory of 4472	4480	msedge.exe	93
PID 4480 wrote to memory of 4472	4480	msedge.exe	93
PID 4480 wrote to memory of 4472	4480	msedge.exe	93
PID 4480 wrote to memory of 4472	4480	msedge.exe	93
PID 4480 wrote to memory of 4472	4480	msedge.exe	93
PID 4480 wrote to memory of 4472	4480	msedge.exe	93
PID 4480 wrote to memory of 4472	4480	msedge.exe	93
PID 4480 wrote to memory of 4472	4480	msedge.exe	93
PID 4480 wrote to memory of 4472	4480	msedge.exe	93
PID 4480 wrote to memory of 4472	4480	msedge.exe	93
PID 4480 wrote to memory of 4472	4480	msedge.exe	93
PID 4480 wrote to memory of 4472	4480	msedge.exe	93
PID 4480 wrote to memory of 4472	4480	msedge.exe	93
PID 4480 wrote to memory of 4472	4480	msedge.exe	93
PID 4480 wrote to memory of 4472	4480	msedge.exe	93
PID 4480 wrote to memory of 4472	4480	msedge.exe	93
PID 4480 wrote to memory of 4472	4480	msedge.exe	93
PID 4480 wrote to memory of 4472	4480	msedge.exe	93
PID 4480 wrote to memory of 4472	4480	msedge.exe	93
PID 4480 wrote to memory of 4472	4480	msedge.exe	93
PID 4480 wrote to memory of 4472	4480	msedge.exe	93
PID 4480 wrote to memory of 4472	4480	msedge.exe	93
PID 4480 wrote to memory of 4472	4480	msedge.exe	93
PID 4480 wrote to memory of 4472	4480	msedge.exe	93
PID 4480 wrote to memory of 4472	4480	msedge.exe	93
PID 4480 wrote to memory of 4472	4480	msedge.exe	93
PID 4480 wrote to memory of 4472	4480	msedge.exe	93
PID 4480 wrote to memory of 4472	4480	msedge.exe	93
PID 4480 wrote to memory of 4472	4480	msedge.exe	93
PID 4480 wrote to memory of 2816	4480	msedge.exe	94
PID 4480 wrote to memory of 2816	4480	msedge.exe	94
PID 4480 wrote to memory of 1228	4480	msedge.exe	95
PID 4480 wrote to memory of 1228	4480	msedge.exe	95
PID 4480 wrote to memory of 1228	4480	msedge.exe	95
PID 4480 wrote to memory of 1228	4480	msedge.exe	95
PID 4480 wrote to memory of 1228	4480	msedge.exe	95
PID 4480 wrote to memory of 1228	4480	msedge.exe	95
PID 4480 wrote to memory of 1228	4480	msedge.exe	95
PID 4480 wrote to memory of 1228	4480	msedge.exe	95
PID 4480 wrote to memory of 1228	4480	msedge.exe	95
PID 4480 wrote to memory of 1228	4480	msedge.exe	95

C:\Users\Admin\AppData\Local\Temp\WANNACRY.exe
"C:\Users\Admin\AppData\Local\Temp\WANNACRY.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\66476.bat""
  2⤵
  PID:8
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\97597.bat""
  2⤵
  PID:3660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\97597.bat""
  2⤵
  PID:3640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\97597.bat""
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://canarytokens.com/tags/feedback/fhj368iuy5ajev2mm4gasfma9/payments.js
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffff39546f8,0x7ffff3954708,0x7ffff3954718
    3⤵
    PID:3108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,17788763445636501018,3134362475723837598,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
    3⤵
    PID:4472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,17788763445636501018,3134362475723837598,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,17788763445636501018,3134362475723837598,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8
    3⤵
    PID:1228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17788763445636501018,3134362475723837598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
    3⤵
    PID:2932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17788763445636501018,3134362475723837598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
    3⤵
    PID:2700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17788763445636501018,3134362475723837598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
    3⤵
    PID:3464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17788763445636501018,3134362475723837598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:1
    3⤵
    PID:4760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17788763445636501018,3134362475723837598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
    3⤵
    PID:1668
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,17788763445636501018,3134362475723837598,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5640 /prefetch:8
    3⤵
    PID:3764
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,17788763445636501018,3134362475723837598,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5640 /prefetch:8
    3⤵
    PID:884

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4496

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c39b3aa574c0c938c80eb263bb450311

SHA1
f4d11275b63f4f906be7a55ec6ca050c62c18c88

SHA256
66f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c

SHA512
eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dabfafd78687947a9de64dd5b776d25f

SHA1
16084c74980dbad713f9d332091985808b436dea

SHA256
c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201

SHA512
dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d1645c087ae8004f8c4eba61728e707f

SHA1
ced52efe324018e9f64160b44ff11ee5f884d4ae

SHA256
db41c29d80ca55e7ee4a53c6ef88eef0b53f38791c9ac74011796e3207543ed6

SHA512
480047f7563b95d1ff8786d523a314ac6b11750c10c2c5a1416557e5bf614abb650effcf5c16e4027e63b475fed2e45bbe88fcf12577b15a2804af3105bd3ec1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Temp\66476.bat

Filesize
17B

MD5
cc5c530dd8d163d64ac7d3743ced820c

SHA1
7d5d3c436735c1eb88bb0a9fd484c793bfaafeaa

SHA256
a9debeed60cb750bf75d9aef0306e45a4d9a202f593f97e705ebafd0d117faf9

SHA512
4de9bbd8603c87e71b699b9fcb9a8fe4f5b92b2ad4d20e41540f0a8f40f1f25886949ee325aec0edaafc7ec423aa6fb509d0b46c16f32b7313af0bb0307f2a0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\97597.bat

Filesize
17B

MD5
e9b17333ed29907ecb12e2f78b32a946

SHA1
4b110b72f40fa64a7bda1d55083c0cf6ea6d14d2

SHA256
39d08f609c1eb2bf15b6a058a9e6034eb90035a564e19f58d45a7331f11aaa1b

SHA512
ef80c2e7fca8f61668c889a5a4da194400ba6e97b6ac1f77e1b80bdc1363a2c8032c9400f089372ea1d56aefe636218227ddbc434a128bb27127158de753d5d6

Download Submit
memory/2508-0-0x0000000000C60000-0x0000000000CB2000-memory.dmp

Filesize
328KB

Download
memory/2508-1-0x00007FFFF8A53000-0x00007FFFF8A55000-memory.dmp

Filesize
8KB

Download
memory/2508-2-0x00007FFFF8A50000-0x00007FFFF9511000-memory.dmp

Filesize
10.8MB

Download