wannacry | 6668ff2ee61d8d20938d8f9aefa2dfd3f441e4609a9e4a74328ef941ea90dbc7

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20-09-2024 12:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-09-20_1e05da24ee21b67a07bbcae3b185a229_wannacry.exe
Size

5.0MB
MD5

1e05da24ee21b67a07bbcae3b185a229
SHA1

fe2b70ec86c10a74200d97eade5f282ae139a5f1
SHA256

6668ff2ee61d8d20938d8f9aefa2dfd3f441e4609a9e4a74328ef941ea90dbc7
SHA512

e9433a456be4d4b95fb54f397a27bb5ff5b3767c2e7f136c306152e934bed7193a2c7e9d90286d96956919a4b1a92dd62885ef146090970010589f56531a230d
SSDEEP

98304:ZDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2:ZDqPe1Cxcxk3ZAEUadzR8yc4

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3265) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 1 IoCs

pid	Process
4564	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	2024-09-20_1e05da24ee21b67a07bbcae3b185a229_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-20_1e05da24ee21b67a07bbcae3b185a229_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-20_1e05da24ee21b67a07bbcae3b185a229_wannacry.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	2024-09-20_1e05da24ee21b67a07bbcae3b185a229_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	2024-09-20_1e05da24ee21b67a07bbcae3b185a229_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	2024-09-20_1e05da24ee21b67a07bbcae3b185a229_wannacry.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	2024-09-20_1e05da24ee21b67a07bbcae3b185a229_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	2024-09-20_1e05da24ee21b67a07bbcae3b185a229_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2024-09-20_1e05da24ee21b67a07bbcae3b185a229_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-20_1e05da24ee21b67a07bbcae3b185a229_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5092
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:4564

C:\Users\Admin\AppData\Local\Temp\2024-09-20_1e05da24ee21b67a07bbcae3b185a229_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2024-09-20_1e05da24ee21b67a07bbcae3b185a229_wannacry.exe -m security
1⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
e80a41a1473ec8c941fee7a1d5ffc079

SHA1
1488a0ae18033b30e9eb279e5bc22791d24b76e0

SHA256
c5e53ab0c9543bd7ec8e2f4fbf76cff620ac79f488fb991a21f9a29cf22885a3

SHA512
5e246e5d1f8fcdcc69beb27c2f2b7ceddb9816000f9ac2c9450684164c9c5caf4793ecc5bb251f0786fc6a91b1a9f0b25cbcb2bac42366eea4f2054a02ae2e3e

Download Submit