wannacry | cc545906881d35bc109b49b9e1f4a4790a5e88780c991a083aad65ad8a068086

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03-10-2024 09:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-03_4390f83d093b2d28dd8110adbe0ddfd4_wannacry.exe
Size

5.0MB
MD5

4390f83d093b2d28dd8110adbe0ddfd4
SHA1

0a32db3df530d69163214d70c04cc33ee43da0ac
SHA256

cc545906881d35bc109b49b9e1f4a4790a5e88780c991a083aad65ad8a068086
SHA512

7ab7ea9f304f34dd594fe38864ff7d5ddee15e2e621e0b68b399fc05116936f2abc895781acc37a7ee6b01d28239a72a42672e91f915a95a9fff52f2176d5783
SSDEEP

98304:yDqPoBhz1aRxcSUDk36SAEdhvxWa94593X8yAVp2H:yDqPe1Cxcxk3ZAEUaazX8yc4H

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3277) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 1 IoCs

pid	Process
4404	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	2024-10-03_4390f83d093b2d28dd8110adbe0ddfd4_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-03_4390f83d093b2d28dd8110adbe0ddfd4_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-03_4390f83d093b2d28dd8110adbe0ddfd4_wannacry.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	2024-10-03_4390f83d093b2d28dd8110adbe0ddfd4_wannacry.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	2024-10-03_4390f83d093b2d28dd8110adbe0ddfd4_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	2024-10-03_4390f83d093b2d28dd8110adbe0ddfd4_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	2024-10-03_4390f83d093b2d28dd8110adbe0ddfd4_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	2024-10-03_4390f83d093b2d28dd8110adbe0ddfd4_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2024-10-03_4390f83d093b2d28dd8110adbe0ddfd4_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-03_4390f83d093b2d28dd8110adbe0ddfd4_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1180
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:4404

C:\Users\Admin\AppData\Local\Temp\2024-10-03_4390f83d093b2d28dd8110adbe0ddfd4_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2024-10-03_4390f83d093b2d28dd8110adbe0ddfd4_wannacry.exe -m security
1⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:4056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
70e23e372b6f077d4e1e89f5c08418a6

SHA1
83d826f3abb42479378382e4805b8a5e42454814

SHA256
bc0e6e22a794b1b500e3d5d37b7ee0c68d1844d6c9f54126336ed6af62f70260

SHA512
22c7291e2742eb3d99552b62d2a08021ab9d2b08b42d52d480753ae31f25a4de91e4511e140d7e6e126ce9f4bf9fc4782933cc94aab8135c4a783937cf9a9787

Download Submit