Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
27-09-2024 16:49
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-27_1a5860aaf8a416dceba4ab6a7ba15be5_wannacry.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-27_1a5860aaf8a416dceba4ab6a7ba15be5_wannacry.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-27_1a5860aaf8a416dceba4ab6a7ba15be5_wannacry.exe
-
Size
3.6MB
-
MD5
1a5860aaf8a416dceba4ab6a7ba15be5
-
SHA1
0c2ad837dee0eee3aa40b88b2edc2e3a2a9594d4
-
SHA256
8e3e4515e3d0bb5e09da96909f41db890e366b7a7e31343a9d4e809c45fe9adf
-
SHA512
88058c76ea67b338b00b62051b3c6a15c3f6f9a5f51b5195d6b835643b2848efaa859f90ad04c921eb2a090666e9641673147db5d8e879631d27bfdf19fed80f
-
SSDEEP
24576:2bLgddQhfdmMSirYbcMNgef0QeQjG/D8kAk+gdhA:2nAQqMSPbcBVQej/ogdh
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (3257) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 1 IoCs
pid Process 2908 tasksche.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\WINDOWS\tasksche.exe 2024-09-27_1a5860aaf8a416dceba4ab6a7ba15be5_wannacry.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-09-27_1a5860aaf8a416dceba4ab6a7ba15be5_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-09-27_1a5860aaf8a416dceba4ab6a7ba15be5_wannacry.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 2024-09-27_1a5860aaf8a416dceba4ab6a7ba15be5_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 2024-09-27_1a5860aaf8a416dceba4ab6a7ba15be5_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 2024-09-27_1a5860aaf8a416dceba4ab6a7ba15be5_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 2024-09-27_1a5860aaf8a416dceba4ab6a7ba15be5_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 2024-09-27_1a5860aaf8a416dceba4ab6a7ba15be5_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-27_1a5860aaf8a416dceba4ab6a7ba15be5_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-27_1a5860aaf8a416dceba4ab6a7ba15be5_wannacry.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1364 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i2⤵
- Executes dropped EXE
PID:2908
-
-
C:\Users\Admin\AppData\Local\Temp\2024-09-27_1a5860aaf8a416dceba4ab6a7ba15be5_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2024-09-27_1a5860aaf8a416dceba4ab6a7ba15be5_wannacry.exe -m security1⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:64
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.4MB
MD5deaa2f62a68d12a3e9842ae2b5641c03
SHA159e6a69888aac87a583b3f2c212df36aabc99907
SHA256c0cba8900a4ce6bdf7b070be9d1768c7729654b9d1971a6ca57dfd7e7530fd2e
SHA51217ce62dd1143db984f61395e5589c13f5a64854e52fd1f8de24b8fb4b1d4cdfba40f6db6c485f35b2ecba924a528de745a307b4a9867a5be7bebc97974e0b3a4