wannacry | 2e7803bbe43b5be307330495c11c205ed003fd64ef6efbab825a82120c84fea4

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06-09-2024 05:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cebd6188fb9b5842e2869f331db397d2_JaffaCakes118.exe
Size

3.6MB
MD5

cebd6188fb9b5842e2869f331db397d2
SHA1

a61ac4e24ac4a9e6e730c9f18c8a9866517ade51
SHA256

2e7803bbe43b5be307330495c11c205ed003fd64ef6efbab825a82120c84fea4
SHA512

2fe650af4a4debd19939176c980c6b797192e70da6c5ed8b4e1960fe71db79c2a796743a0df64cb6eb78b30e5eccabf3ec8b9e8605c8dfa1629413d8de303ea4
SSDEEP

49152:2nAQqMSPbcBVQej/1INRx+TSqTt9PAMEcaEau3R8yAH1plAHI:yDqPoBhz1aRxcSUt9P593R8yAVp2HI

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3271) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 1 IoCs

pid	Process
2184	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	cebd6188fb9b5842e2869f331db397d2_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cebd6188fb9b5842e2869f331db397d2_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cebd6188fb9b5842e2869f331db397d2_JaffaCakes118.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	cebd6188fb9b5842e2869f331db397d2_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	cebd6188fb9b5842e2869f331db397d2_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	cebd6188fb9b5842e2869f331db397d2_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	cebd6188fb9b5842e2869f331db397d2_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	cebd6188fb9b5842e2869f331db397d2_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\cebd6188fb9b5842e2869f331db397d2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\cebd6188fb9b5842e2869f331db397d2_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1376
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:2184

C:\Users\Admin\AppData\Local\Temp\cebd6188fb9b5842e2869f331db397d2_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\cebd6188fb9b5842e2869f331db397d2_JaffaCakes118.exe -m security
1⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
5fab4d72d07c6675ee45652403ea5442

SHA1
0e0223edefbd8c9414cca69937117d0bf5981a0f

SHA256
9c404861ca5932fcd14dbd50a9971a11dbdadf67c6d03ca66c5e159daa6616ef

SHA512
d6c37eec55ada27f70cebc26d0c1af27240564bb8a540cd1beabe8f7f24420bdcd32d62843bbfa3a28f44fe4873c65d48923fcf0b1f0b17f28a8c5e32ab4b1d2

Download Submit