wannacry | cdf6e2a4f4d7739247bcf7cb531c7a1e279e2df1611cf6cbd07fddc2b59cffb6

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22-09-2024 22:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024092238ea24dbf49506bdc052ead9cee9234ewannacry.exe
Size

3.6MB
MD5

38ea24dbf49506bdc052ead9cee9234e
SHA1

7fbfea41f3ae296125e54938d25a6da60acd1d87
SHA256

cdf6e2a4f4d7739247bcf7cb531c7a1e279e2df1611cf6cbd07fddc2b59cffb6
SHA512

06a95c97ed0727854328cb4da49beb64d839a40d261422deb3ede6f9cbc3cc25dde0b8f4d2023080d8300fc705d8ebef78b256cc02eb3efc1b5689f7f86da976
SSDEEP

98304:yDqPoBi1aRxcSUDk36SAEdhvxWa9P593R8yAVp2r:yDqPJ1Cxcxk3ZAEUadzR8yc4r

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3338) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 1 IoCs

pid	Process
2212	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	2024092238ea24dbf49506bdc052ead9cee9234ewannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024092238ea24dbf49506bdc052ead9cee9234ewannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024092238ea24dbf49506bdc052ead9cee9234ewannacry.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	2024092238ea24dbf49506bdc052ead9cee9234ewannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	2024092238ea24dbf49506bdc052ead9cee9234ewannacry.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	2024092238ea24dbf49506bdc052ead9cee9234ewannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	2024092238ea24dbf49506bdc052ead9cee9234ewannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	2024092238ea24dbf49506bdc052ead9cee9234ewannacry.exe

C:\Users\Admin\AppData\Local\Temp\2024092238ea24dbf49506bdc052ead9cee9234ewannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2024092238ea24dbf49506bdc052ead9cee9234ewannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4564
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:2212

C:\Users\Admin\AppData\Local\Temp\2024092238ea24dbf49506bdc052ead9cee9234ewannacry.exe
C:\Users\Admin\AppData\Local\Temp\2024092238ea24dbf49506bdc052ead9cee9234ewannacry.exe -m security
1⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:3760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
d2d540dd2255353f2b0203b578be8dae

SHA1
8d7d9a011ea978930c4122831e8d627b9a1ca73a

SHA256
943fc1e507f0b6233ed4fd4405be8b9e792758a0c5baa8ddad1ba927f7d17bae

SHA512
06b4cad74a63af54ccda7da28aee4c9981c73324b3b0a94b3c1b4dc9a634851d2f9dc5f25821166f699924377ad333a18e0e639bc97209badd5af278148512c5

Download Submit