wannacry | 205ec59de8599560229ec6feebac64db25e20b2bd770733544d02e4ed26d300e

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17-08-2024 11:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-08-17_9dfcf3c57ddcad888021db80d8030499_wannacry.exe
Size

3.6MB
MD5

9dfcf3c57ddcad888021db80d8030499
SHA1

68f56830996e6f1ead3bd83e2c176e880a8194a2
SHA256

205ec59de8599560229ec6feebac64db25e20b2bd770733544d02e4ed26d300e
SHA512

88d74a584a05a6ce9f1f4ed89561c9dcc6cc11d1e51b8adf3be81cf4d166cf3b76cd23b8062f004eccd8dc15f1bacd659105354f1d3126a871c35fe1600e96ea
SSDEEP

98304:XDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R/I:XDqPe1Cxcxk3ZAEUadzR/I

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3298) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 1 IoCs

pid	Process
3204	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	2024-08-17_9dfcf3c57ddcad888021db80d8030499_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-08-17_9dfcf3c57ddcad888021db80d8030499_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-08-17_9dfcf3c57ddcad888021db80d8030499_wannacry.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	2024-08-17_9dfcf3c57ddcad888021db80d8030499_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	2024-08-17_9dfcf3c57ddcad888021db80d8030499_wannacry.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	2024-08-17_9dfcf3c57ddcad888021db80d8030499_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	2024-08-17_9dfcf3c57ddcad888021db80d8030499_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	2024-08-17_9dfcf3c57ddcad888021db80d8030499_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2024-08-17_9dfcf3c57ddcad888021db80d8030499_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2024-08-17_9dfcf3c57ddcad888021db80d8030499_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3484
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:3204

C:\Users\Admin\AppData\Local\Temp\2024-08-17_9dfcf3c57ddcad888021db80d8030499_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2024-08-17_9dfcf3c57ddcad888021db80d8030499_wannacry.exe -m security
1⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
1df28886635586846938c16bfeb9c955

SHA1
11cb0a2700491d796861dbac48b5ed4fe78ca2c2

SHA256
ddf791d58d4ed15f572738e518665997cd88378d1edbde7e0ab4b88cea31fc86

SHA512
46df7efa30894542420b0afb51c7843fd4273f98a37fecefd94d66e864e1775561fb146f336e5320b5de0488789eadd72a165da433ae5ecab60619dee2e51c9c

Download Submit