Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
27-09-2024 17:19
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-27_9901a660e1a3cdc16d92ba26a3973f91_wannacry.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-27_9901a660e1a3cdc16d92ba26a3973f91_wannacry.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-27_9901a660e1a3cdc16d92ba26a3973f91_wannacry.exe
-
Size
3.6MB
-
MD5
9901a660e1a3cdc16d92ba26a3973f91
-
SHA1
2e5fca353edd6839dcd3effbbc0327450471f82c
-
SHA256
56797ba57bc37fe2bb8f7330577198555f0bf56d77413bf42e94a8b5d0814cc6
-
SHA512
059172a78bef910787f44c02179b52a9b841fdeb101ad80ddd5d53cb962ee90f375d6e0e84437cb7c4f41777221a951ecad4af79ecb565e34b04a379fd965c2d
-
SSDEEP
49152:XnjQXej/1INRx+TSqTdX1HkQo6SAAZ0vZ6GIk:X8Oz1aRxcSUDk36SAc0B6GIk
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (3297) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 1 IoCs
pid Process 3732 tasksche.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\WINDOWS\tasksche.exe 2024-09-27_9901a660e1a3cdc16d92ba26a3973f91_wannacry.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2988 3732 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasksche.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-09-27_9901a660e1a3cdc16d92ba26a3973f91_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-09-27_9901a660e1a3cdc16d92ba26a3973f91_wannacry.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1796 wrote to memory of 3732 1796 2024-09-27_9901a660e1a3cdc16d92ba26a3973f91_wannacry.exe 83 PID 1796 wrote to memory of 3732 1796 2024-09-27_9901a660e1a3cdc16d92ba26a3973f91_wannacry.exe 83 PID 1796 wrote to memory of 3732 1796 2024-09-27_9901a660e1a3cdc16d92ba26a3973f91_wannacry.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-27_9901a660e1a3cdc16d92ba26a3973f91_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-27_9901a660e1a3cdc16d92ba26a3973f91_wannacry.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3732 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3732 -s 2203⤵
- Program crash
PID:2988
-
-
-
C:\Users\Admin\AppData\Local\Temp\2024-09-27_9901a660e1a3cdc16d92ba26a3973f91_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2024-09-27_9901a660e1a3cdc16d92ba26a3973f91_wannacry.exe -m security1⤵
- System Location Discovery: System Language Discovery
PID:4376
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3732 -ip 37321⤵PID:3564
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.4MB
MD55fdc7e8eea19b1b6789e0a935b94e00b
SHA11199939c48a39be28a1bc7b429c2e991a8e65c29
SHA256d8019f16916e6006fef231ac9d64805bebf21b068daa301968a4b21afd2cb741
SHA512afd588323d0af4ba6a414d51882de70af128fa5ecf65e5131e58013d4954a0761bde915d421cf2a0cb66f9d49beedf958adc7d94103220f07e0959c8fca14fce