wannacry | 2038bee1863127ccc30985f470d92bf58a768b899b9ebf0de52591cc08216cb7

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26-09-2024 21:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-09-26_5b316bd42778fe9613a312f0b71172a1_wannacry.exe
Size

3.6MB
MD5

5b316bd42778fe9613a312f0b71172a1
SHA1

8256cb0775972149adb46ccdfca83f63fda0a129
SHA256

2038bee1863127ccc30985f470d92bf58a768b899b9ebf0de52591cc08216cb7
SHA512

5e50f8a9794845fc04a2ccee1716b058e1e2a0e5e07cf50d560180511fc2cec9ca73ae3a6e7ad7e1b46117c5af3b9e8f2117ab15153bd88d66c7add250c094de
SSDEEP

49152:2nAQqMSPbcBVQej/1INRx+TSqTdOxJM0H9PAMEcaEau3R+i:yDqPoBhz1aRxcSUwxWa9P593R+

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3308) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 1 IoCs

pid	Process
2640	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	2024-09-26_5b316bd42778fe9613a312f0b71172a1_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-26_5b316bd42778fe9613a312f0b71172a1_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-26_5b316bd42778fe9613a312f0b71172a1_wannacry.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	2024-09-26_5b316bd42778fe9613a312f0b71172a1_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	2024-09-26_5b316bd42778fe9613a312f0b71172a1_wannacry.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	2024-09-26_5b316bd42778fe9613a312f0b71172a1_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	2024-09-26_5b316bd42778fe9613a312f0b71172a1_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	2024-09-26_5b316bd42778fe9613a312f0b71172a1_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2024-09-26_5b316bd42778fe9613a312f0b71172a1_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-26_5b316bd42778fe9613a312f0b71172a1_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1660
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:2640

C:\Users\Admin\AppData\Local\Temp\2024-09-26_5b316bd42778fe9613a312f0b71172a1_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2024-09-26_5b316bd42778fe9613a312f0b71172a1_wannacry.exe -m security
1⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:4940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
9581a1065bc6422bb7d856c34841716b

SHA1
c5cb582bbc84168a655444a08c43fdf6d617cd87

SHA256
43a578d8cf23874a7e46bf8370d4ad52f99267f21393659fb92fe51721d0f939

SHA512
e1f6402177395806e1625b8be0269f8e380b9fac7677f83b2efed987045ac9cbda2fd45be7ce1ccc850b1ebb7f278031b70a60e109278b542198624accad90b8

Download Submit