Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    27/09/2024, 17:34

General

  • Target

    2024-09-27_dcfa2d9692a946088fd4020314f51e9d_wannacry.exe

  • Size

    2.2MB

  • MD5

    dcfa2d9692a946088fd4020314f51e9d

  • SHA1

    2f35b64a0290ce637d8d69e805cfafeb033eca60

  • SHA256

    1dda7db0c3bc58f1a2bc67b31cb95ad891efe4eef5c6847269cbaea1142280b4

  • SHA512

    707920b2148f3857605bfc66457c9fb912fd6282ebb1c640f069e0944a3e720ee4606097bae7dce8a10b3d6d383c452d077a3ce6151fc535ac62d7318253a78f

  • SSDEEP

    49152:QnOQej31sNRx+TSqTdX1HkQo6SAARdhnvn:QKT1+RxcSUDk36SAEdhvn

Malware Config

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

  • Contacts a large (3022) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Executes dropped EXE 1 IoCs
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Drops file in System32 directory 5 IoCs
  • Drops file in Windows directory 1 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 24 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-09-27_dcfa2d9692a946088fd4020314f51e9d_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-09-27_dcfa2d9692a946088fd4020314f51e9d_wannacry.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1892
    • C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1628
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 36
        3⤵
        • Program crash
        PID:2668
  • C:\Users\Admin\AppData\Local\Temp\2024-09-27_dcfa2d9692a946088fd4020314f51e9d_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp\2024-09-27_dcfa2d9692a946088fd4020314f51e9d_wannacry.exe -m security
    1⤵
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    PID:2772

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\tasksche.exe

    Filesize

    2.0MB

    MD5

    54fed24cfd24c7e3703c770d23f9a4da

    SHA1

    8c405ed899110e52c579085f869dab804f8d1e2d

    SHA256

    197ba84cb91f98f6ff5927f839948f963b869ab8cf4c66a0961c95ef114f0fe6

    SHA512

    d6b1132bee7a30d8f7e72efd1a856e1a614718354d92da1902226ee1133c49b1e8f68e5f71c60436eb77f565a6d83f27a21f07c198474cd8acd3d7b13015e43d