wannacry | b295fda31ece80efb896f493a4fa730aa82589b4512ef2abd920608bb5638569

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27-09-2024 16:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-09-27_32be4c49ca0db4d1ca3e7cfa52c83cee_wannacry.exe
Size

3.6MB
MD5

32be4c49ca0db4d1ca3e7cfa52c83cee
SHA1

7c08aa59170177af6465bf4910095be53509497c
SHA256

b295fda31ece80efb896f493a4fa730aa82589b4512ef2abd920608bb5638569
SHA512

cd1dfb59a5cb05d8a02a777e1fb7e606bfb1f27640495f971f32b5af9c73e726997af340defd96771e4535e62eb9796931a350a5eae7c8a66128d3ef79549725
SSDEEP

98304:yDqPoBhz1aRxcSUDk36SAEdhvxWa9P5mp2HI:yDqPe1Cxcxk3ZAEUad04HI

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3280) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 1 IoCs

pid	Process
2728	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	2024-09-27_32be4c49ca0db4d1ca3e7cfa52c83cee_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-27_32be4c49ca0db4d1ca3e7cfa52c83cee_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-27_32be4c49ca0db4d1ca3e7cfa52c83cee_wannacry.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	2024-09-27_32be4c49ca0db4d1ca3e7cfa52c83cee_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	2024-09-27_32be4c49ca0db4d1ca3e7cfa52c83cee_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	2024-09-27_32be4c49ca0db4d1ca3e7cfa52c83cee_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	2024-09-27_32be4c49ca0db4d1ca3e7cfa52c83cee_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	2024-09-27_32be4c49ca0db4d1ca3e7cfa52c83cee_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2024-09-27_32be4c49ca0db4d1ca3e7cfa52c83cee_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-27_32be4c49ca0db4d1ca3e7cfa52c83cee_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3876
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:2728

C:\Users\Admin\AppData\Local\Temp\2024-09-27_32be4c49ca0db4d1ca3e7cfa52c83cee_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2024-09-27_32be4c49ca0db4d1ca3e7cfa52c83cee_wannacry.exe -m security
1⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
7c92a38897a5584f496bf353677c4aa4

SHA1
cd99ac18043cdd952a8b29809717ed3dcb1db49c

SHA256
e19f1dbee5deac9121723f2bd55c532dcd540f8a096bf6c68d876ef3b6c00797

SHA512
d780396aad1b7d4b55b6c590e84431fe887f2a49b652b7feba3914b8c6e4760486927d63f24d610e38c5b885bd744d4dd6a1fefa7cb3163b4dbc6eea9f73ed5a

Download Submit