Resubmissions

15-09-2024 20:39

240915-zfpdtssblr 10

15-09-2024 20:38

240915-zepcfa1erh 10

15-09-2024 19:50

240915-ykmv5a1bjq 10

Analysis

  • max time kernel
    77s
  • max time network
    77s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    15-09-2024 20:38

General

  • Target

    2024-09-15_ec114588ac70fd5c1fca25731f494b4e_wannacry.exe

  • Size

    2.2MB

  • MD5

    ec114588ac70fd5c1fca25731f494b4e

  • SHA1

    040796d8ed354de04175ca01380c45e9c3acd642

  • SHA256

    1a3a791e79fd658b5e630200046217427ca80ab561cf2f92b599897ca2e0dff9

  • SHA512

    e04456bc3e5b303ca9782037bfa6b5da00596bb909a236d12663579048271efbfcb0a1770db3f3ef574cb2e028aae629b87576eebaa3c408f40b3f9013f78584

  • SSDEEP

    49152:QnxQqMSPbcBVQej/1INRx+TSqTdX1HkQo6:Q6qPoBhz1aRxcSUDk36

Malware Config

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

  • Executes dropped EXE 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 5 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 14 IoCs
  • Suspicious use of SendNotifyMessage 13 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-09-15_ec114588ac70fd5c1fca25731f494b4e_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-09-15_ec114588ac70fd5c1fca25731f494b4e_wannacry.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2252
    • C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      2⤵
      • Executes dropped EXE
      PID:2012
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 8
        3⤵
        • Program crash
        PID:3372
  • C:\Users\Admin\AppData\Local\Temp\2024-09-15_ec114588ac70fd5c1fca25731f494b4e_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp\2024-09-15_ec114588ac70fd5c1fca25731f494b4e_wannacry.exe -m security
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    PID:1128
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2012 -ip 2012
    1⤵
      PID:3836
    • C:\Program Files\VideoLAN\VLC\vlc.exe
      "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\SkipConnect.DVR-MS"
      1⤵
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:3572

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\tasksche.exe

      Filesize

      2.0MB

      MD5

      8a1112fbed4f3a09991afead122a2d7f

      SHA1

      16c013f4e5e855607d2a93e018d6d3efd89e195f

      SHA256

      dc9d6f2222c1d8e1b0f7d2305f1b1cd735da9f0cd5a1bf055b31733f30b8693b

      SHA512

      e0a6489305d58ab81f33bbe86d594e56c77eeae340c7a02fab251bd61c7a93b1a7c022a496dc035eadfd418e7d6668e1406de1716059952d8da302af4777fe64

    • memory/3572-13-0x00007FF6C97B0000-0x00007FF6C98A8000-memory.dmp

      Filesize

      992KB

    • memory/3572-14-0x00007FF9652F0000-0x00007FF965324000-memory.dmp

      Filesize

      208KB

    • memory/3572-22-0x00007FF965D40000-0x00007FF965D51000-memory.dmp

      Filesize

      68KB

    • memory/3572-23-0x00007FF9534F0000-0x00007FF9536FB000-memory.dmp

      Filesize

      2.0MB

    • memory/3572-21-0x00007FF965F50000-0x00007FF965F6D000-memory.dmp

      Filesize

      116KB

    • memory/3572-20-0x00007FF966000000-0x00007FF966011000-memory.dmp

      Filesize

      68KB

    • memory/3572-19-0x00007FF9675C0000-0x00007FF9675D7000-memory.dmp

      Filesize

      92KB

    • memory/3572-18-0x00007FF968D40000-0x00007FF968D51000-memory.dmp

      Filesize

      68KB

    • memory/3572-17-0x00007FF968F30000-0x00007FF968F47000-memory.dmp

      Filesize

      92KB

    • memory/3572-29-0x00007FF9650C0000-0x00007FF9650D1000-memory.dmp

      Filesize

      68KB

    • memory/3572-33-0x00007FF964FB0000-0x00007FF964FC8000-memory.dmp

      Filesize

      96KB

    • memory/3572-35-0x00007FF95B750000-0x00007FF95B7B7000-memory.dmp

      Filesize

      412KB

    • memory/3572-40-0x0000028547560000-0x000002854765F000-memory.dmp

      Filesize

      1020KB

    • memory/3572-39-0x00007FF952000000-0x00007FF952012000-memory.dmp

      Filesize

      72KB

    • memory/3572-38-0x00007FF95A370000-0x00007FF95A3C7000-memory.dmp

      Filesize

      348KB

    • memory/3572-37-0x00007FF95A4F0000-0x00007FF95A501000-memory.dmp

      Filesize

      68KB

    • memory/3572-36-0x00007FF95A3D0000-0x00007FF95A44C000-memory.dmp

      Filesize

      496KB

    • memory/3572-34-0x00007FF95D0F0000-0x00007FF95D120000-memory.dmp

      Filesize

      192KB

    • memory/3572-32-0x00007FF965060000-0x00007FF965071000-memory.dmp

      Filesize

      68KB

    • memory/3572-31-0x00007FF965080000-0x00007FF96509B000-memory.dmp

      Filesize

      108KB

    • memory/3572-30-0x00007FF9650A0000-0x00007FF9650B1000-memory.dmp

      Filesize

      68KB

    • memory/3572-28-0x00007FF965290000-0x00007FF9652A1000-memory.dmp

      Filesize

      68KB

    • memory/3572-27-0x00007FF965B60000-0x00007FF965B78000-memory.dmp

      Filesize

      96KB

    • memory/3572-26-0x00007FF9650E0000-0x00007FF965101000-memory.dmp

      Filesize

      132KB

    • memory/3572-16-0x00007FF96E070000-0x00007FF96E088000-memory.dmp

      Filesize

      96KB

    • memory/3572-24-0x00007FF965140000-0x00007FF965181000-memory.dmp

      Filesize

      260KB

    • memory/3572-15-0x00007FF9540F0000-0x00007FF9543A6000-memory.dmp

      Filesize

      2.7MB

    • memory/3572-25-0x00007FF952440000-0x00007FF9534F0000-memory.dmp

      Filesize

      16.7MB

    • memory/3572-48-0x00007FF6C97B0000-0x00007FF6C98A8000-memory.dmp

      Filesize

      992KB

    • memory/3572-50-0x00007FF9540F0000-0x00007FF9543A6000-memory.dmp

      Filesize

      2.7MB

    • memory/3572-49-0x00007FF9652F0000-0x00007FF965324000-memory.dmp

      Filesize

      208KB

    • memory/3572-51-0x00007FF952440000-0x00007FF9534F0000-memory.dmp

      Filesize

      16.7MB