Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    24-09-2024 17:44

General

  • Target

    2024-09-24_6da447e2d8b91aae7fc416d0fe34c598_wannacry.exe

  • Size

    3.6MB

  • MD5

    6da447e2d8b91aae7fc416d0fe34c598

  • SHA1

    bf95af17d8f25629613594f38a352d178a50eda5

  • SHA256

    d78f3c65fc376d675af5c47382a191efdbeacd577b343f7a458fd0e18f7c9831

  • SHA512

    4158fe5a35144acb3fc5dc9d9d1dc8410e0d9713b16692bf003b0ada02874d8e1353b99d62d3d9516f3ac97c6b102bf5a753f4352eeeb9699cbce5f45acb5129

  • SSDEEP

    49152:2nAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9LEau:yDqPoBhz1aRxcSUDk36SAEdhvxWa9y

Malware Config

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

  • Contacts a large (3305) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Executes dropped EXE 1 IoCs
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-09-24_6da447e2d8b91aae7fc416d0fe34c598_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-09-24_6da447e2d8b91aae7fc416d0fe34c598_wannacry.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    PID:1908
    • C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      2⤵
      • Executes dropped EXE
      PID:2828
  • C:\Users\Admin\AppData\Local\Temp\2024-09-24_6da447e2d8b91aae7fc416d0fe34c598_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp\2024-09-24_6da447e2d8b91aae7fc416d0fe34c598_wannacry.exe -m security
    1⤵
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    PID:2744

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\tasksche.exe

    Filesize

    3.4MB

    MD5

    bf4e83c05dbf8f486bc7599771f795c9

    SHA1

    2d434d5098689667d247195320784772e819dbb1

    SHA256

    10dcfd19fe45fb8517f35ee066642b8b71bca2074a1154725fe8d9609e9cdf82

    SHA512

    02f4816f78502790b3d8690a45ac8193d7e5a298f8246e320cc79e9418b3f9859985cddbd662b814b14266d9c0504495f9a7ead203404bc29e61e3bfef3ddce2