wannacry | b1f5fce1c46ae131d32fa917922057c6568e9b76732a6ca77f04d08a5144bd66

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29-09-2024 21:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20240929da13447d749aad01337366d517d2f601wannacry.exe
Size

5.0MB
MD5

da13447d749aad01337366d517d2f601
SHA1

d70a7d9059f3c7c00acea145fd0b2c9af50be15e
SHA256

b1f5fce1c46ae131d32fa917922057c6568e9b76732a6ca77f04d08a5144bd66
SHA512

09a33b74997b355fcd99ed8009cf48ccca88f2d164f7c199516c6207e84fe1013df35e7dc5260d1e32bf398c61aae3f3bd81f6391850feb11ae19b3f47dea263
SSDEEP

49152:XnAQyOmtJgfJN8Tou+TSqTdX1HkQo6SAARdhnvxJM0H9PAMEcaEau3:XDyz/ToucSUDk36SAEdhvxWa9P593

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3179) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 1 IoCs

pid	Process
4000	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	20240929da13447d749aad01337366d517d2f601wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	20240929da13447d749aad01337366d517d2f601wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	20240929da13447d749aad01337366d517d2f601wannacry.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	20240929da13447d749aad01337366d517d2f601wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	20240929da13447d749aad01337366d517d2f601wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	20240929da13447d749aad01337366d517d2f601wannacry.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	20240929da13447d749aad01337366d517d2f601wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	20240929da13447d749aad01337366d517d2f601wannacry.exe

C:\Users\Admin\AppData\Local\Temp\20240929da13447d749aad01337366d517d2f601wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\20240929da13447d749aad01337366d517d2f601wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3508
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:4000

C:\Users\Admin\AppData\Local\Temp\20240929da13447d749aad01337366d517d2f601wannacry.exe
C:\Users\Admin\AppData\Local\Temp\20240929da13447d749aad01337366d517d2f601wannacry.exe -m security
1⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:4252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
8de4f4fa3773ea30ce165058f000c458

SHA1
93286650d76524250838130877f11a0be7abb0ef

SHA256
a16c7bd92ecaf64ca986621ce06ad1c3aefa7b229a3118991434be20d1b9bad1

SHA512
07d1337861355f79c65e58eadc7cb8c1a0a4b116c6f211b1cb61019b56b9a9021f9ee12394bc56939967286553e85b5a1190b3b35becb33e251ce57eada61b7f

Download Submit