wannacry | 99ffa3f3e2912ab2127858cb203a9bd7e97efcb7038fdffd8996647e9b3920b1

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21-08-2024 07:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-08-21_85d92d485be05e909941bb490b46aabc_wannacry.exe
Size

5.0MB
MD5

85d92d485be05e909941bb490b46aabc
SHA1

63a7f1389db34145caf912cf2ef73873c5a66f58
SHA256

99ffa3f3e2912ab2127858cb203a9bd7e97efcb7038fdffd8996647e9b3920b1
SHA512

352a2fe781bbeebe8c8fa5f3922f82687bb6e84a5f7b46e7bf21214bd05bb55f9ee38ae071f960de7224f61c224510dd66ffb1160ed6ac31c8b40d80b534d898
SSDEEP

6144:GE9l9ynqIYVTH5DgSg8ajldktM0XXrP2QhMV9qbBLIwYQuy8DLq1eNVDvMr:GebLgPlu+QhMbaIMu7L5NVE

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3192) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 1 IoCs

pid	Process
2516	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	2024-08-21_85d92d485be05e909941bb490b46aabc_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-08-21_85d92d485be05e909941bb490b46aabc_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-08-21_85d92d485be05e909941bb490b46aabc_wannacry.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	2024-08-21_85d92d485be05e909941bb490b46aabc_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	2024-08-21_85d92d485be05e909941bb490b46aabc_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	2024-08-21_85d92d485be05e909941bb490b46aabc_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	2024-08-21_85d92d485be05e909941bb490b46aabc_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	2024-08-21_85d92d485be05e909941bb490b46aabc_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2024-08-21_85d92d485be05e909941bb490b46aabc_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2024-08-21_85d92d485be05e909941bb490b46aabc_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3944
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:2516

C:\Users\Admin\AppData\Local\Temp\2024-08-21_85d92d485be05e909941bb490b46aabc_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2024-08-21_85d92d485be05e909941bb490b46aabc_wannacry.exe -m security
1⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4048,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:8
1⤵
PID:5084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
e57f0ef1f0b4f849f78ca7f53f94e188

SHA1
b3812fa0ceb0c7f7bddd0da8312af6d7dcad49f3

SHA256
c794b70af08b30ed5b3f8d5001f45dc0346a13112a0c7090f82015449fa855f5

SHA512
d54d818a4ed2e40e911ea9eff52cdc0dc959b9f23ce391851a79b3ce85373d2f59c208648d714f9554a27e937594381b8e2bf2d0f9e1df650a6d2e6f95f359d8

Download Submit