Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
27/09/2024, 17:34
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-27_dcfa2d9692a946088fd4020314f51e9d_wannacry.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-09-27_dcfa2d9692a946088fd4020314f51e9d_wannacry.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-27_dcfa2d9692a946088fd4020314f51e9d_wannacry.exe
-
Size
2.2MB
-
MD5
dcfa2d9692a946088fd4020314f51e9d
-
SHA1
2f35b64a0290ce637d8d69e805cfafeb033eca60
-
SHA256
1dda7db0c3bc58f1a2bc67b31cb95ad891efe4eef5c6847269cbaea1142280b4
-
SHA512
707920b2148f3857605bfc66457c9fb912fd6282ebb1c640f069e0944a3e720ee4606097bae7dce8a10b3d6d383c452d077a3ce6151fc535ac62d7318253a78f
-
SSDEEP
49152:QnOQej31sNRx+TSqTdX1HkQo6SAARdhnvn:QKT1+RxcSUDk36SAEdhvn
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (3022) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 1 IoCs
pid Process 1628 tasksche.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in System32 directory 5 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\61UXRGTJ.txt 2024-09-27_dcfa2d9692a946088fd4020314f51e9d_wannacry.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\TQ350189.txt 2024-09-27_dcfa2d9692a946088fd4020314f51e9d_wannacry.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\TQ350189.txt 2024-09-27_dcfa2d9692a946088fd4020314f51e9d_wannacry.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat 2024-09-27_dcfa2d9692a946088fd4020314f51e9d_wannacry.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\61UXRGTJ.txt 2024-09-27_dcfa2d9692a946088fd4020314f51e9d_wannacry.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\WINDOWS\tasksche.exe 2024-09-27_dcfa2d9692a946088fd4020314f51e9d_wannacry.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2668 1628 WerFault.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-09-27_dcfa2d9692a946088fd4020314f51e9d_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-09-27_dcfa2d9692a946088fd4020314f51e9d_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasksche.exe -
Modifies data under HKEY_USERS 24 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 2024-09-27_dcfa2d9692a946088fd4020314f51e9d_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" 2024-09-27_dcfa2d9692a946088fd4020314f51e9d_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0217EB12-0529-4B58-9CCD-AB06BC903E7F} 2024-09-27_dcfa2d9692a946088fd4020314f51e9d_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0217EB12-0529-4B58-9CCD-AB06BC903E7F}\WpadDecision = "0" 2024-09-27_dcfa2d9692a946088fd4020314f51e9d_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\26-ce-0c-55-0c-fb\WpadDecisionReason = "1" 2024-09-27_dcfa2d9692a946088fd4020314f51e9d_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings 2024-09-27_dcfa2d9692a946088fd4020314f51e9d_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" 2024-09-27_dcfa2d9692a946088fd4020314f51e9d_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 2024-09-27_dcfa2d9692a946088fd4020314f51e9d_wannacry.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 2024-09-27_dcfa2d9692a946088fd4020314f51e9d_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad 2024-09-27_dcfa2d9692a946088fd4020314f51e9d_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0217EB12-0529-4B58-9CCD-AB06BC903E7F}\WpadDecisionReason = "1" 2024-09-27_dcfa2d9692a946088fd4020314f51e9d_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\26-ce-0c-55-0c-fb\WpadDecision = "0" 2024-09-27_dcfa2d9692a946088fd4020314f51e9d_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections 2024-09-27_dcfa2d9692a946088fd4020314f51e9d_wannacry.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 2024-09-27_dcfa2d9692a946088fd4020314f51e9d_wannacry.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0186000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 2024-09-27_dcfa2d9692a946088fd4020314f51e9d_wannacry.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0217EB12-0529-4B58-9CCD-AB06BC903E7F}\WpadDecisionTime = 30f81e770311db01 2024-09-27_dcfa2d9692a946088fd4020314f51e9d_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0217EB12-0529-4B58-9CCD-AB06BC903E7F}\26-ce-0c-55-0c-fb 2024-09-27_dcfa2d9692a946088fd4020314f51e9d_wannacry.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\26-ce-0c-55-0c-fb\WpadDecisionTime = 30f81e770311db01 2024-09-27_dcfa2d9692a946088fd4020314f51e9d_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings 2024-09-27_dcfa2d9692a946088fd4020314f51e9d_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" 2024-09-27_dcfa2d9692a946088fd4020314f51e9d_wannacry.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 2024-09-27_dcfa2d9692a946088fd4020314f51e9d_wannacry.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 2024-09-27_dcfa2d9692a946088fd4020314f51e9d_wannacry.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0217EB12-0529-4B58-9CCD-AB06BC903E7F}\WpadNetworkName = "Network 2" 2024-09-27_dcfa2d9692a946088fd4020314f51e9d_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\26-ce-0c-55-0c-fb 2024-09-27_dcfa2d9692a946088fd4020314f51e9d_wannacry.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1892 wrote to memory of 1628 1892 2024-09-27_dcfa2d9692a946088fd4020314f51e9d_wannacry.exe 31 PID 1892 wrote to memory of 1628 1892 2024-09-27_dcfa2d9692a946088fd4020314f51e9d_wannacry.exe 31 PID 1892 wrote to memory of 1628 1892 2024-09-27_dcfa2d9692a946088fd4020314f51e9d_wannacry.exe 31 PID 1892 wrote to memory of 1628 1892 2024-09-27_dcfa2d9692a946088fd4020314f51e9d_wannacry.exe 31 PID 1628 wrote to memory of 2668 1628 tasksche.exe 32 PID 1628 wrote to memory of 2668 1628 tasksche.exe 32 PID 1628 wrote to memory of 2668 1628 tasksche.exe 32 PID 1628 wrote to memory of 2668 1628 tasksche.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-27_dcfa2d9692a946088fd4020314f51e9d_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-27_dcfa2d9692a946088fd4020314f51e9d_wannacry.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 363⤵
- Program crash
PID:2668
-
-
-
C:\Users\Admin\AppData\Local\Temp\2024-09-27_dcfa2d9692a946088fd4020314f51e9d_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2024-09-27_dcfa2d9692a946088fd4020314f51e9d_wannacry.exe -m security1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2772
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
MD554fed24cfd24c7e3703c770d23f9a4da
SHA18c405ed899110e52c579085f869dab804f8d1e2d
SHA256197ba84cb91f98f6ff5927f839948f963b869ab8cf4c66a0961c95ef114f0fe6
SHA512d6b1132bee7a30d8f7e72efd1a856e1a614718354d92da1902226ee1133c49b1e8f68e5f71c60436eb77f565a6d83f27a21f07c198474cd8acd3d7b13015e43d