wannacry | afd42666cc1ed465133187ef024ef022a9ebba3ff34dfbb2d8c4b2244b3094f0

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
25-07-2024 07:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-07-25_362005ed5da96ee3de27024106979b3a_wannacry.exe
Size

5.0MB
MD5

362005ed5da96ee3de27024106979b3a
SHA1

14b8b4422587027a29d1b4c775aa5e1c0841b199
SHA256

afd42666cc1ed465133187ef024ef022a9ebba3ff34dfbb2d8c4b2244b3094f0
SHA512

019b75f193fe848c70423b4b174a3dce23207d80f512da09995ba7816c07caccda5b16a0066839e65952caefde84e9dec5cca3a804aa4e9c960b99d476e382d8
SSDEEP

49152:VnjQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9PAMEcaEa:Z8qPoBhz1aRxcSUDk36SAEdhvxWa9P5

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3253) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Executes dropped EXE 1 IoCs

Processes:

tasksche.exe

pid process

2200 tasksche.exe
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

pid	process
2200	tasksche.exe

Drops file in System32 directory 1 IoCs

Processes:

2024-07-25_362005ed5da96ee3de27024106979b3a_wannacry.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	2024-07-25_362005ed5da96ee3de27024106979b3a_wannacry.exe

Drops file in Windows directory 1 IoCs

Processes:

2024-07-25_362005ed5da96ee3de27024106979b3a_wannacry.exe

description ioc process

File created C:\WINDOWS\tasksche.exe 2024-07-25_362005ed5da96ee3de27024106979b3a_wannacry.exe

description	ioc	process
File created	C:\WINDOWS\tasksche.exe	2024-07-25_362005ed5da96ee3de27024106979b3a_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

2024-07-25_362005ed5da96ee3de27024106979b3a_wannacry.exe2024-07-25_362005ed5da96ee3de27024106979b3a_wannacry.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-07-25_362005ed5da96ee3de27024106979b3a_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-07-25_362005ed5da96ee3de27024106979b3a_wannacry.exe

Modifies data under HKEY_USERS 1 IoCs

Processes:

2024-07-25_362005ed5da96ee3de27024106979b3a_wannacry.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	2024-07-25_362005ed5da96ee3de27024106979b3a_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2024-07-25_362005ed5da96ee3de27024106979b3a_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2024-07-25_362005ed5da96ee3de27024106979b3a_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2520

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
2⤵
- Executes dropped EXE
PID:2200

C:\Users\Admin\AppData\Local\Temp\2024-07-25_362005ed5da96ee3de27024106979b3a_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2024-07-25_362005ed5da96ee3de27024106979b3a_wannacry.exe -m security
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
1610575aa3225df81fff9a5a9002dc71

SHA1
8133a6b49de588be6331d38c49fb9d39101c8fea

SHA256
2a5b908e75d8a54eb58f615b0f2a2baeff6a81ed54a00d1395c3c8a45b803a03

SHA512
e6955bbc52c2d0ffa38118dac54392d32c4fa9c7d1321dafad8b0c694d83358b03d09c82e9a1af686d992d40cb62e831f2d70c984440d111e26e49edd1425453

Download Submit