wannacry | b1d4ab3b68eaab8baefa433ae725490b82a6b295a69e13a5985c3b15bd8e304c

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
06-07-2024 13:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-07-06_d589446d31d43c35466f7e3eec3d6139_wannacry.exe
Size

5.0MB
MD5

d589446d31d43c35466f7e3eec3d6139
SHA1

b8790367518561360649cd98723807e1ae52ab97
SHA256

b1d4ab3b68eaab8baefa433ae725490b82a6b295a69e13a5985c3b15bd8e304c
SHA512

f7616d76588e05ee9beb1bc3f4395ce6885252ed89181b6ab9720ef90904ec8f439c86e08d1d3871931f771d329919041c6831eae1777b7e45d1050676e3f134
SSDEEP

49152:VnjQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SA:Z8qPoBhz1aRxcSUDk36SA

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3181) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 1 IoCs

pid	Process
2532	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	2024-07-06_d589446d31d43c35466f7e3eec3d6139_wannacry.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	2024-07-06_d589446d31d43c35466f7e3eec3d6139_wannacry.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	2024-07-06_d589446d31d43c35466f7e3eec3d6139_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2024-07-06_d589446d31d43c35466f7e3eec3d6139_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2024-07-06_d589446d31d43c35466f7e3eec3d6139_wannacry.exe"
1⤵
- Drops file in Windows directory
PID:2064
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:2532

C:\Users\Admin\AppData\Local\Temp\2024-07-06_d589446d31d43c35466f7e3eec3d6139_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2024-07-06_d589446d31d43c35466f7e3eec3d6139_wannacry.exe -m security
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
2a68debf793b7d42464f5ddf9d70cd72

SHA1
dad1b9dbab1bf1f31fcbb881f254323ae9cc4a77

SHA256
74f41b499284c05865d77c3acc911a89c70d56541308b4df12092ae10a834c1c

SHA512
4b6e6ee87cd419bd5577be980191fab5d3c688946acdde2c4f7409bda34380341beb4f2dfe5c5def677af535533f566292ee18b82a7634082027f95c23299ba8

Download Submit