wannacry | d7fe33d358736e3534c736636cf63d9f382af704b54f8effb4e5f2675d642031

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
23-07-2024 09:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-07-23_b76d16413b5ae2e1e2fdbf61c3a21035_wannacry.exe
Size

3.6MB
MD5

b76d16413b5ae2e1e2fdbf61c3a21035
SHA1

437a943d4879fcad9dac0bf703aa956c8560db68
SHA256

d7fe33d358736e3534c736636cf63d9f382af704b54f8effb4e5f2675d642031
SHA512

c48e3e69d182596b85f1de89597209261d93cffe7d5997932ec362b8b67a1eb4ebeca8ecbef58d5c62a2e5f4689a570f79f1c73a21c50aeb0c1b493b9e741e23
SSDEEP

98304:w8qPoBhESUDk36SAEdhvxWa9P593R8yAVp2HI:w8qPzxk3ZAEUadzR8yc4HI

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3263) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Executes dropped EXE 1 IoCs

Processes:

tasksche.exe

pid process

1780 tasksche.exe
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

pid	process
1780	tasksche.exe

Drops file in System32 directory 1 IoCs

Processes:

2024-07-23_b76d16413b5ae2e1e2fdbf61c3a21035_wannacry.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	2024-07-23_b76d16413b5ae2e1e2fdbf61c3a21035_wannacry.exe

Drops file in Windows directory 1 IoCs

Processes:

2024-07-23_b76d16413b5ae2e1e2fdbf61c3a21035_wannacry.exe

description ioc process

File created C:\WINDOWS\tasksche.exe 2024-07-23_b76d16413b5ae2e1e2fdbf61c3a21035_wannacry.exe

description	ioc	process
File created	C:\WINDOWS\tasksche.exe	2024-07-23_b76d16413b5ae2e1e2fdbf61c3a21035_wannacry.exe

Modifies data under HKEY_USERS 1 IoCs

Processes:

2024-07-23_b76d16413b5ae2e1e2fdbf61c3a21035_wannacry.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	2024-07-23_b76d16413b5ae2e1e2fdbf61c3a21035_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2024-07-23_b76d16413b5ae2e1e2fdbf61c3a21035_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2024-07-23_b76d16413b5ae2e1e2fdbf61c3a21035_wannacry.exe"
1⤵
- Drops file in Windows directory
PID:2860

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
2⤵
- Executes dropped EXE
PID:1780

C:\Users\Admin\AppData\Local\Temp\2024-07-23_b76d16413b5ae2e1e2fdbf61c3a21035_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2024-07-23_b76d16413b5ae2e1e2fdbf61c3a21035_wannacry.exe -m security
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
f9996e637f1b4c98d490e69251b7ab7a

SHA1
09bc67a70d6ecc8dfa5bccfc080e76cf6944ff56

SHA256
58019ec1deb67c433870d9e1da8ce7865ee9091091d1e98c3ebb43ce18d21dc4

SHA512
047c9e00b53dcf4f7ac028a50b43969c80edf751594bb35edd2d27e0280b1a916edfc315a414099d3f6c895422a83ba7b53b9d62707945b0e4c32e06560da5dc

Download Submit