wannacry | 54c2217a8c6c215e200511c9282616c0aecbd1fef6d86cdb9b9c748a29c068ad

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27-09-2024 17:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-09-27_72b6bafdd609c3b34aa269b31c3599c5_wannacry.exe
Size

3.6MB
MD5

72b6bafdd609c3b34aa269b31c3599c5
SHA1

093c0fa8cbfe390d95af45734c36a9c1997756d9
SHA256

54c2217a8c6c215e200511c9282616c0aecbd1fef6d86cdb9b9c748a29c068ad
SHA512

e9a001cc60c3aad9b5a82820c2f32dd54ce55f3daa261410a1fcdc19ce7a961f1482b2e7c099cb6ff10de5877e614f5d4e3622cdb00d261d92c968a06e45847f
SSDEEP

24576:2bLgddQhfdmMSirYbcMNgef001LJMfcH9:2nAQqMSPbcBV0xJM0H9

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3277) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 1 IoCs

pid	Process
2876	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	2024-09-27_72b6bafdd609c3b34aa269b31c3599c5_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-27_72b6bafdd609c3b34aa269b31c3599c5_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-27_72b6bafdd609c3b34aa269b31c3599c5_wannacry.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	2024-09-27_72b6bafdd609c3b34aa269b31c3599c5_wannacry.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	2024-09-27_72b6bafdd609c3b34aa269b31c3599c5_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	2024-09-27_72b6bafdd609c3b34aa269b31c3599c5_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	2024-09-27_72b6bafdd609c3b34aa269b31c3599c5_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	2024-09-27_72b6bafdd609c3b34aa269b31c3599c5_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2024-09-27_72b6bafdd609c3b34aa269b31c3599c5_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-27_72b6bafdd609c3b34aa269b31c3599c5_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4700
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:2876

C:\Users\Admin\AppData\Local\Temp\2024-09-27_72b6bafdd609c3b34aa269b31c3599c5_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2024-09-27_72b6bafdd609c3b34aa269b31c3599c5_wannacry.exe -m security
1⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:4488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
c26601d3afe5ac3e639a579666e2f877

SHA1
96c6063af8b33eca1bb5465257a3717633c490d6

SHA256
7bb3968a5be1256ee2b252af8c8d22bf5c546c8650e91669596498b631dbb2ef

SHA512
2e26c8cfb5e73e2c5b55e795b597022422dc9469084dc39ae24a60046bff66c70b0958861f534d3b3756051bfe435a6d11c7764d84430b34038a857b02d35a32

Download Submit