wannacry | d720fb98b515445334579ec50f8203c87cd51baba5ae9464a4a521761d7832d8

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08-09-2024 11:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d44442d17cb02850fe1e6f5e91e8153e_JaffaCakes118.exe
Size

3.6MB
MD5

d44442d17cb02850fe1e6f5e91e8153e
SHA1

5a3a39ff760f029f62bdbdfa7d339dc101793c80
SHA256

d720fb98b515445334579ec50f8203c87cd51baba5ae9464a4a521761d7832d8
SHA512

af8134e843f5bbc6f021974a6fd5d79fe2ba07eec153d0563d3782b32218856fe37d7f02918e8e40019bd49d4df2ec4687e0a5c3c74d7a9a1b4facd379c5a5c3
SSDEEP

98304:XDqPoBhz1aRxcSUDk36SAEdhvxWa9P593Rx2HI:XDqPe1Cxcxk3ZAEUadzRwHI

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3206) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 1 IoCs

pid	Process
1536	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	d44442d17cb02850fe1e6f5e91e8153e_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d44442d17cb02850fe1e6f5e91e8153e_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d44442d17cb02850fe1e6f5e91e8153e_JaffaCakes118.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	d44442d17cb02850fe1e6f5e91e8153e_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	d44442d17cb02850fe1e6f5e91e8153e_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	d44442d17cb02850fe1e6f5e91e8153e_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	d44442d17cb02850fe1e6f5e91e8153e_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	d44442d17cb02850fe1e6f5e91e8153e_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\d44442d17cb02850fe1e6f5e91e8153e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d44442d17cb02850fe1e6f5e91e8153e_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1436
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:1536

C:\Users\Admin\AppData\Local\Temp\d44442d17cb02850fe1e6f5e91e8153e_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\d44442d17cb02850fe1e6f5e91e8153e_JaffaCakes118.exe -m security
1⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:4660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
61a3b5c05a734594417a6891f158c7da

SHA1
10c8d6ce4535adfb7cd2291b63716ddf8b7bbb26

SHA256
76cbb9e74abfaca7c627d900f41c7c8c1af7f70790568fd701b09d34ab153ba9

SHA512
1e24bb735fc558b8f8a79144700df3de956a1e69fb6cd1f7c7a31d9bb23c11fdefff12cf2da4252e13012346b61c20231241d2b6df241cbcbc82b31bb6d0962e

Download Submit