wannacry | 3bc72e1ad267bd52e559278b012aa7781ea3a2a2a66a5c912aac502d71adf697

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
24/07/2024, 02:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-07-24_f5b7fe7dd2124be6a88b43c0253233f4_wannacry.exe
Size 3.6MB
Sample240724-dc9ppsthpk
SHA256 3bc72e1ad267bd52e559278b012aa7781ea3a2a2a66a5c912aac502d71adf697
MD5 f5b7fe7dd2124be6a88b43c0253233f4
SHA1 694355766b5f063341c6e3b81c95771842432607
SHA512 05f5beea5d2761fb658be5ab0850265111f65f44e4ba7eed59094865027ac0a5780af62ed96bc835cc8f546330276a7fa661de0618c9f698c0efe2e868a29a4e
SSDEEP 98304:XDqPoBhz1aRxcSUDk36SAEdrWa9P593R8yAVp2HI:XDqPe1Cxcxk3ZAEgadzR8yc4HI
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3096) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 1 IoCs

pid	Process
2472	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	2024-07-24_f5b7fe7dd2124be6a88b43c0253233f4_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-07-24_f5b7fe7dd2124be6a88b43c0253233f4_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-07-24_f5b7fe7dd2124be6a88b43c0253233f4_wannacry.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	2024-07-24_f5b7fe7dd2124be6a88b43c0253233f4_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	2024-07-24_f5b7fe7dd2124be6a88b43c0253233f4_wannacry.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	2024-07-24_f5b7fe7dd2124be6a88b43c0253233f4_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	2024-07-24_f5b7fe7dd2124be6a88b43c0253233f4_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	2024-07-24_f5b7fe7dd2124be6a88b43c0253233f4_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2024-07-24_f5b7fe7dd2124be6a88b43c0253233f4_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2024-07-24_f5b7fe7dd2124be6a88b43c0253233f4_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2732
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:2472

C:\Users\Admin\AppData\Local\Temp\2024-07-24_f5b7fe7dd2124be6a88b43c0253233f4_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2024-07-24_f5b7fe7dd2124be6a88b43c0253233f4_wannacry.exe -m security
1⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:4988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 b3c6d93ed9f5b9a721d632b3da96e1af5566bd27bc0695d7c567685995e64ca5
MD5 8063e24d7e419abf8ccf52c9bf52d6c8
SHA1 065480f5a96cc3fc22735b6ed03b7f04d013a26e
SHA512 52202e27cacfc75e4a60937b770968b10cc9d1e8df65c9bd19f447751e683320c1928ff224a7f489e8402f50e85a15be701e6777b92237b7620700a878ea2faa
SSDEEP 98304:QqPoBhz1aRxcSUDk36SAEdrWa9P593R8yAVp2Hj:QqPe1Cxcxk3ZAEgadzR8yc4Hj
MD5 SHA1 SHA512 SSDEEP

Submit Download