wannacry | 50212005590ddfa3e4f906e6dbb5f81147192e47ab8760a7e485f5d738776224

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09-07-2024 12:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-07-09_e906d3715340548207f42b7de91e22ba_wannacry.exe
Size

5.0MB
MD5

e906d3715340548207f42b7de91e22ba
SHA1

9c87a07672993297a46cc8a5fec3dd6bd1f63191
SHA256

50212005590ddfa3e4f906e6dbb5f81147192e47ab8760a7e485f5d738776224
SHA512

fa839e9d9a4e8c9c47b29687c27ce8258e0203bd7f0415c4bc104c280e7254ea4ce946124ea2ee5341dae93d1d4ead6abd1fc9cdf576f54eaa164b668a9f559c
SSDEEP

49152:VnjQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAA:Z8qPoBhz1aRxcSUDk36SA

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3274) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Executes dropped EXE 1 IoCs

Processes:

tasksche.exe

pid process

3048 tasksche.exe
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

pid	process
3048	tasksche.exe

Drops file in System32 directory 1 IoCs

Processes:

2024-07-09_e906d3715340548207f42b7de91e22ba_wannacry.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	2024-07-09_e906d3715340548207f42b7de91e22ba_wannacry.exe

Drops file in Windows directory 1 IoCs

Processes:

2024-07-09_e906d3715340548207f42b7de91e22ba_wannacry.exe

description ioc process

File created C:\WINDOWS\tasksche.exe 2024-07-09_e906d3715340548207f42b7de91e22ba_wannacry.exe

description	ioc	process
File created	C:\WINDOWS\tasksche.exe	2024-07-09_e906d3715340548207f42b7de91e22ba_wannacry.exe

Modifies data under HKEY_USERS 1 IoCs

Processes:

2024-07-09_e906d3715340548207f42b7de91e22ba_wannacry.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	2024-07-09_e906d3715340548207f42b7de91e22ba_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2024-07-09_e906d3715340548207f42b7de91e22ba_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2024-07-09_e906d3715340548207f42b7de91e22ba_wannacry.exe"
1⤵
- Drops file in Windows directory
PID:2220

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
2⤵
- Executes dropped EXE
PID:3048

C:\Users\Admin\AppData\Local\Temp\2024-07-09_e906d3715340548207f42b7de91e22ba_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2024-07-09_e906d3715340548207f42b7de91e22ba_wannacry.exe -m security
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
c96f06bb2aa1427ce970484c9093da11

SHA1
90830bd8b0e041ebe47588fe4c21dea8e58a2a0b

SHA256
5e14f5bb9358b8adc3cf40c3f46f93d43befa82ff707c83b7d72e07af15c7cc7

SHA512
90c5494e77b2ab38fc1bc3dae8cc4a8f387754602d35e083904c11dd74f1df26aa58f7dd9146e3037492d337f29ffc6ed23ac080543b1660be2fb9c6e07baa64

Download Submit