wannacry | 1263a28df0dbe39a8395742a3c083f8608fc71af555320765bc9f6aab9cd40a0

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-09-2024 17:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20240930e55fcb956560b3d8a3bfdf40eae43bcewannacry.exe
Size

5.0MB
MD5

e55fcb956560b3d8a3bfdf40eae43bce
SHA1

d0ae54105973fa73706ced009fceb363c1abe8c2
SHA256

1263a28df0dbe39a8395742a3c083f8608fc71af555320765bc9f6aab9cd40a0
SHA512

5604441b8b57fe20c5df0d74fbf0f0dcb75a56d9ffc877d52a4f52189d56c8c6efd533e2b3b63e017c8da7a1752f27374cd912e385b85c46dd446b47c9d31120
SSDEEP

98304:Z8qPoBiz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2H:Z8qPp1Cxcxk3ZAEUadzR8yc4H

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3258) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 1 IoCs

pid	Process
2792	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	20240930e55fcb956560b3d8a3bfdf40eae43bcewannacry.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	20240930e55fcb956560b3d8a3bfdf40eae43bcewannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	20240930e55fcb956560b3d8a3bfdf40eae43bcewannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	20240930e55fcb956560b3d8a3bfdf40eae43bcewannacry.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	20240930e55fcb956560b3d8a3bfdf40eae43bcewannacry.exe

C:\Users\Admin\AppData\Local\Temp\20240930e55fcb956560b3d8a3bfdf40eae43bcewannacry.exe
"C:\Users\Admin\AppData\Local\Temp\20240930e55fcb956560b3d8a3bfdf40eae43bcewannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2640
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:2792

C:\Users\Admin\AppData\Local\Temp\20240930e55fcb956560b3d8a3bfdf40eae43bcewannacry.exe
C:\Users\Admin\AppData\Local\Temp\20240930e55fcb956560b3d8a3bfdf40eae43bcewannacry.exe -m security
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
fde685bad4953169db113ac9a23b3311

SHA1
731956d4e7279fe8e32ac680ac777be9d08c1c96

SHA256
1716a55ee73e2bc5b95e28037f70387bc3c11d6a3cb181d9b3161d07f656d1d1

SHA512
1e116e6797fd07708c44e50d6c3c7ec8a98ba2042fba3a12e84d2046012e25979b37b4f3c92d0a784a289b1e279e95b085b75f4476124ddf330e58b55b635c52

Download Submit