wannacry | 7be1bd091ccd2282e179da0cab7c16cb2649f18b85306e4f773d677cd84f728f

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03-08-2024 13:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-08-03_d8eb04917a209f4b18ff03c75eb91918_wannacry.exe
Size

5.0MB
MD5

d8eb04917a209f4b18ff03c75eb91918
SHA1

78e6902a3cc3fef1dfe2bfa5336edab785c1635f
SHA256

7be1bd091ccd2282e179da0cab7c16cb2649f18b85306e4f773d677cd84f728f
SHA512

aa45a01e89f156d3626c7f1eb39da9a6f3a9c69417eb11abf6b59a773e0b12e2a2d69bfe1ca3291d8450840defa19a80ca55b09f5ca22ed6e752a455b3f34704
SSDEEP

49152:2nAQqMSPbcBVrINRx+TSqTdX1HkQo6SAARdh:yDqPoBpaRxcSUDk36SAEdh

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3251) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 1 IoCs

pid	Process
864	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	2024-08-03_d8eb04917a209f4b18ff03c75eb91918_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-08-03_d8eb04917a209f4b18ff03c75eb91918_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-08-03_d8eb04917a209f4b18ff03c75eb91918_wannacry.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	2024-08-03_d8eb04917a209f4b18ff03c75eb91918_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	2024-08-03_d8eb04917a209f4b18ff03c75eb91918_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	2024-08-03_d8eb04917a209f4b18ff03c75eb91918_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	2024-08-03_d8eb04917a209f4b18ff03c75eb91918_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	2024-08-03_d8eb04917a209f4b18ff03c75eb91918_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2024-08-03_d8eb04917a209f4b18ff03c75eb91918_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2024-08-03_d8eb04917a209f4b18ff03c75eb91918_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3144
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:864

C:\Users\Admin\AppData\Local\Temp\2024-08-03_d8eb04917a209f4b18ff03c75eb91918_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2024-08-03_d8eb04917a209f4b18ff03c75eb91918_wannacry.exe -m security
1⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:3484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
2756d2d49311415d366d2f01f72cc217

SHA1
dcbdb10951106b236f74373f671bc643b0a1c8c5

SHA256
fb9fa5c40cf914fb2159e3ce6f51b6511a5ece630142e4acfd603537e800e762

SHA512
af85ca51394d7e45a257aa914cf4082e4255ae4369884386651392b8834b50e5357bb017c19d6664acd6ef42316a1faa5175e436795e25c254ddc636e968e620

Download Submit