wannacry | 2fc4edf2cc07b618712c76fffb594fa852457f3f50e329931200c8a66e1a06b9

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/08/2024, 10:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-08-05_c13cdec2a2daf4d37fdaf2c0e135531f_wannacry.exe
Size 5.0MB
Sample240805-mqvblstemn
SHA256 2fc4edf2cc07b618712c76fffb594fa852457f3f50e329931200c8a66e1a06b9
MD5 c13cdec2a2daf4d37fdaf2c0e135531f
SHA1 2d199cc1d39e22de93ce3c296670011b4e73833c
SHA512 e5236dcad5e7528c46a5b3d3d182833b0219471192a8290a33abecc9a067a7692926c94a4e8a55616d95ac74eeac6cce1f5b4c33ba96beadb060b33b6af5a9ce
SSDEEP 24576:VbLgdeQhfdmMSirYbcMNgef0QeQjG/D8kIq:VnjQqMSPbcBVQej/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3290) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 1 IoCs

pid	Process
1696	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	2024-08-05_c13cdec2a2daf4d37fdaf2c0e135531f_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-08-05_c13cdec2a2daf4d37fdaf2c0e135531f_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-08-05_c13cdec2a2daf4d37fdaf2c0e135531f_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2024-08-05_c13cdec2a2daf4d37fdaf2c0e135531f_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2024-08-05_c13cdec2a2daf4d37fdaf2c0e135531f_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2936
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:1696

C:\Users\Admin\AppData\Local\Temp\2024-08-05_c13cdec2a2daf4d37fdaf2c0e135531f_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2024-08-05_c13cdec2a2daf4d37fdaf2c0e135531f_wannacry.exe -m security
1⤵
- System Location Discovery: System Language Discovery
PID:740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 6c7b2e40bdfe962d1677e918154155d42e813524e4cdaf0efbe54ce9918e3104
MD5 c6759b1a99ac022d7d017eb7f6282eb1
SHA1 d310f9341a43163f6fda7498e49442fc8a531869
SHA512 bb4088994626074f8316b2e54f0b6daf0991f1e250d0aa3338ca46afab6382d31d15a8aa3215d9140ed80b9a9dcf107fe20179e302a76d244aeb90146ef20566
SSDEEP 12288:nQhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+DHeQYSUjEXFGeXE3TUgt:nQhfdmMSirYbcMNgef0QeQjG/D8kIq
MD5 SHA1 SHA512 SSDEEP

Submit Download