Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
02-10-2024 09:34
General
-
Target
2024-10-02_57948559589d32ebea479bd67229e460_wannacry.exe
-
Size
5.0MB
-
MD5
57948559589d32ebea479bd67229e460
-
SHA1
3880785a75013758acc55be2c4e82934a1ae7a58
-
SHA256
0ea794649437081a7e11a51df5bc4967f81aca4f7e052709aaad14baf8a2b1c4
-
SHA512
5040c4546cb43c9c35baeca4ddb080733d9d9ce39c191aa1aa9d38072ba111dde2135aa6a17a8c8da24e2d276922aedd6d64374ec5635cfc342c13bbe67ac971
-
SSDEEP
49152:QnuQqMSPbcBVQej/VINRx+TSqTdd1HkQo6SAARdhnv:QZqPoBhzVaRxcSUZk36SAEdhv
Score
10/10
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (3351) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-02_57948559589d32ebea479bd67229e460_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-02_57948559589d32ebea479bd67229e460_wannacry.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2024-10-02_57948559589d32ebea479bd67229e460_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2024-10-02_57948559589d32ebea479bd67229e460_wannacry.exe -m security1⤵
- System Location Discovery: System Language Discovery