wannacry | 24459d72ce6e9759aeb17a7703fde9a5f93ab9c488032913647ab2be348f9708

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29-09-2024 19:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

24459d72ce6e9759aeb17a7703fde9a5f93ab9c488032913647ab2be348f9708.exe
Size

5.0MB
MD5

7eb5c49d2a0ed285b2fc260b48bd7204
SHA1

8e4ad6861f9ddbf63e39fbdbcae6d6b0c9ccaadd
SHA256

24459d72ce6e9759aeb17a7703fde9a5f93ab9c488032913647ab2be348f9708
SHA512

873f9a1bb1b8ddca8242e1f146f6d8de4548b743d2838718d651d5dfcf6263df67f0cdbd0c23b6134c2ae311eb94dc843dee7d4ce892571f3755849208d726e5
SSDEEP

98304:yDqPoBhz1aYk36SAEdhvxWa9P593R8yAVp2H:yDqPe1dk3ZAEUadzR8yc4H

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3298) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 1 IoCs

pid	Process
3248	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	24459d72ce6e9759aeb17a7703fde9a5f93ab9c488032913647ab2be348f9708.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	24459d72ce6e9759aeb17a7703fde9a5f93ab9c488032913647ab2be348f9708.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	24459d72ce6e9759aeb17a7703fde9a5f93ab9c488032913647ab2be348f9708.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	24459d72ce6e9759aeb17a7703fde9a5f93ab9c488032913647ab2be348f9708.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	24459d72ce6e9759aeb17a7703fde9a5f93ab9c488032913647ab2be348f9708.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	24459d72ce6e9759aeb17a7703fde9a5f93ab9c488032913647ab2be348f9708.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	24459d72ce6e9759aeb17a7703fde9a5f93ab9c488032913647ab2be348f9708.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	24459d72ce6e9759aeb17a7703fde9a5f93ab9c488032913647ab2be348f9708.exe

C:\Users\Admin\AppData\Local\Temp\24459d72ce6e9759aeb17a7703fde9a5f93ab9c488032913647ab2be348f9708.exe
"C:\Users\Admin\AppData\Local\Temp\24459d72ce6e9759aeb17a7703fde9a5f93ab9c488032913647ab2be348f9708.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3272
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:3248

C:\Users\Admin\AppData\Local\Temp\24459d72ce6e9759aeb17a7703fde9a5f93ab9c488032913647ab2be348f9708.exe
C:\Users\Admin\AppData\Local\Temp\24459d72ce6e9759aeb17a7703fde9a5f93ab9c488032913647ab2be348f9708.exe -m security
1⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
fb403cdb6e9f1b6b3b3a159b1bb3fdb2

SHA1
a540ce6a152d6a7e92753f977d0d0eafc54c3ef7

SHA256
13a102bcac7ac0c7cf4b9f7aaf1be8a61053e6cc751b7140f39899382a3e7a0f

SHA512
bd3d64f676e55aae6cadd9d0766b49f0ad441f9e6fd5d79b90dfe4ccfc57d568681fd19c25ac74495cef329a3909899893a9d2340b8d9d18971531da20640957

Download Submit