wannacry | 776171b3a638943e89b4043d6ecdb22a52b5d955e46aa6d4cb7e4abc8afc483f

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
31-07-2024 12:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-07-31_43b606b5bd15a108e0946bb3f5476fec_wannacry.exe
Size

3.6MB
MD5

43b606b5bd15a108e0946bb3f5476fec
SHA1

672175e5cfe9ded51b13d79470cc383e1276b3c6
SHA256

776171b3a638943e89b4043d6ecdb22a52b5d955e46aa6d4cb7e4abc8afc483f
SHA512

9aa479d0fa5cf61c4c39b87faeeecdaf9bbee6dd1873f9f40acf79416aaa3347688cbc910ea8660fa4642837586498ce990d8fcd5497f58275cd0e8834f4f878
SSDEEP

98304:Z8qPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2:Z8qPe1Cxcxk3ZAEUadzR8yc4

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3177) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Executes dropped EXE 1 IoCs

Processes:

tasksche.exe

pid process

2280 tasksche.exe
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Drops file in Windows directory 1 IoCs

Processes:

2024-07-31_43b606b5bd15a108e0946bb3f5476fec_wannacry.exe

description ioc process

File created C:\WINDOWS\tasksche.exe 2024-07-31_43b606b5bd15a108e0946bb3f5476fec_wannacry.exe

pid	process
2280	tasksche.exe

description	ioc	process
File created	C:\WINDOWS\tasksche.exe	2024-07-31_43b606b5bd15a108e0946bb3f5476fec_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

2024-07-31_43b606b5bd15a108e0946bb3f5476fec_wannacry.exe2024-07-31_43b606b5bd15a108e0946bb3f5476fec_wannacry.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-07-31_43b606b5bd15a108e0946bb3f5476fec_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-07-31_43b606b5bd15a108e0946bb3f5476fec_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2024-07-31_43b606b5bd15a108e0946bb3f5476fec_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2024-07-31_43b606b5bd15a108e0946bb3f5476fec_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1268

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
2⤵
- Executes dropped EXE
PID:2280

C:\Users\Admin\AppData\Local\Temp\2024-07-31_43b606b5bd15a108e0946bb3f5476fec_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2024-07-31_43b606b5bd15a108e0946bb3f5476fec_wannacry.exe -m security
1⤵
- System Location Discovery: System Language Discovery
PID:1168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
a126e3a0c16b79679bed3393a5be6e1a

SHA1
de66afc347ea927570ef04608974adc41e5abb26

SHA256
0a74ada27b3338dba2921ca14a11c5ebe6b48c9b15a38a8049454e4a12309638

SHA512
5800713853729261ff1fce97a476b2094e42621db3bb0a0ddb31053a38ab891e9dc11b3268e99a0fd802548c3e1395c6583bac713244b096f7b1611f71060a36

Download Submit