Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19-09-2024 15:12
Static task
static1
Behavioral task
behavioral1
Sample
20240919a2acb21a7c5a824738585561ed53eaacwannacry.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
20240919a2acb21a7c5a824738585561ed53eaacwannacry.exe
Resource
win10v2004-20240802-en
General
-
Target
20240919a2acb21a7c5a824738585561ed53eaacwannacry.exe
-
Size
3.6MB
-
MD5
a2acb21a7c5a824738585561ed53eaac
-
SHA1
29c30a76608ffae78fdd7b671323b34688cba76f
-
SHA256
d09e549ef00d6ecdef42b1c076a3c9d311af741a21845db5a0760935962fa006
-
SHA512
9ac0fd7f32bfc7172bb099eb5d8e9244fb25336d9cd2318a5ccfec851e5968bb1097f34c6af8cc3c46ac32dcd07ef51b7e492ee5d57d12dd1c78d4d7278d0cfe
-
SSDEEP
49152:2nAQqMSPbcBVQej/13n4bo3NCdRvWyXeXs:yDqPoBhz10o3oWyuc
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (3148) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 1 IoCs
pid Process 2484 tasksche.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\WINDOWS\tasksche.exe 20240919a2acb21a7c5a824738585561ed53eaacwannacry.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20240919a2acb21a7c5a824738585561ed53eaacwannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20240919a2acb21a7c5a824738585561ed53eaacwannacry.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 20240919a2acb21a7c5a824738585561ed53eaacwannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 20240919a2acb21a7c5a824738585561ed53eaacwannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 20240919a2acb21a7c5a824738585561ed53eaacwannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 20240919a2acb21a7c5a824738585561ed53eaacwannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 20240919a2acb21a7c5a824738585561ed53eaacwannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\20240919a2acb21a7c5a824738585561ed53eaacwannacry.exe"C:\Users\Admin\AppData\Local\Temp\20240919a2acb21a7c5a824738585561ed53eaacwannacry.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1848 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i2⤵
- Executes dropped EXE
PID:2484
-
-
C:\Users\Admin\AppData\Local\Temp\20240919a2acb21a7c5a824738585561ed53eaacwannacry.exeC:\Users\Admin\AppData\Local\Temp\20240919a2acb21a7c5a824738585561ed53eaacwannacry.exe -m security1⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1076
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.4MB
MD5919e99bc955ff6f8060c73bdf7522f7e
SHA178f1f043dfdc92282c78e6ce4fe0df58d215f130
SHA256d22b697a018a3fec9daff3f5f7d59266c226749d6fab316d80688bebe10cb229
SHA51287880e62875a772bbdd0f8a0776218c2e29f2fa8939841aa7464cee89009b8db0d621b42fe5785060a349d07678efa4d0046b72e78ffc1ddc8ab496b16471011