Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-09-2024 17:44

General

  • Target

    202409160c7bb73160f9cded187c945480cc8a65wannacry.exe

  • Size

    5.0MB

  • MD5

    0c7bb73160f9cded187c945480cc8a65

  • SHA1

    50d6ec1637e670ff6fcea1b0f89b2249c80059f2

  • SHA256

    c9eabad4f9132602f056038db24a6511e306b4de92b1ab5695d08cc53aec688a

  • SHA512

    a9611dd3e1a14aaa25f8d9dfcf05551217203ed5fb1bfb096e0a967e3b248799d3f731c8d21c73066abe7e20a375b1446c3132bdb4bb1a0b6e59d7989a0d2a5e

  • SSDEEP

    6144:eE9l9ynRIYVTH5DgSgNajldktM0XXrfIagQhM:e1bLgmluftgQhM

Malware Config

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

  • Contacts a large (3355) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\202409160c7bb73160f9cded187c945480cc8a65wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\202409160c7bb73160f9cded187c945480cc8a65wannacry.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    PID:880
  • C:\Users\Admin\AppData\Local\Temp\202409160c7bb73160f9cded187c945480cc8a65wannacry.exe
    C:\Users\Admin\AppData\Local\Temp\202409160c7bb73160f9cded187c945480cc8a65wannacry.exe -m security
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    PID:3556

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads