wannacry | 8ea8d1f743eb958af70a9e3c6d1127995c60af96abb8a0654647631f0fbfe7b6

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2024, 20:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-10-05_71a5ae65fb56e95cc0eddb92ffa8685a_wannacry.exe
Size 3.6MB
Sample241005-zd7sdssaml
SHA256 8ea8d1f743eb958af70a9e3c6d1127995c60af96abb8a0654647631f0fbfe7b6
MD5 71a5ae65fb56e95cc0eddb92ffa8685a
SHA1 5edc527213f33b8c7a064f7f677a17ce05f914eb
SHA512 8a36f7b50c0022f6a3d21a76aef53b59ed8d658dd1b6493e8f89ca04d2e1de9d7c11ad0e33d2d2a508db0cec1727875f748f1cd55081e4739a6a10f12a395201
SSDEEP 98304:XDqPoBhz1aRxcSUDk36SAmxWa9P5qAVp2Bj:XDqPe1Cxcxk3ZA5adYc4Bj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3271) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 1 IoCs

pid	Process
3876	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	2024-10-05_71a5ae65fb56e95cc0eddb92ffa8685a_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-05_71a5ae65fb56e95cc0eddb92ffa8685a_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-05_71a5ae65fb56e95cc0eddb92ffa8685a_wannacry.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	2024-10-05_71a5ae65fb56e95cc0eddb92ffa8685a_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	2024-10-05_71a5ae65fb56e95cc0eddb92ffa8685a_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	2024-10-05_71a5ae65fb56e95cc0eddb92ffa8685a_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	2024-10-05_71a5ae65fb56e95cc0eddb92ffa8685a_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	2024-10-05_71a5ae65fb56e95cc0eddb92ffa8685a_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2024-10-05_71a5ae65fb56e95cc0eddb92ffa8685a_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-05_71a5ae65fb56e95cc0eddb92ffa8685a_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3056
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:3876

C:\Users\Admin\AppData\Local\Temp\2024-10-05_71a5ae65fb56e95cc0eddb92ffa8685a_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2024-10-05_71a5ae65fb56e95cc0eddb92ffa8685a_wannacry.exe -m security
1⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:3540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 ca4e44dda3249e9fea7153a46ca34dc6dfa0f9d6b28625487cd3df94b69df016
MD5 da23d9da01ad8ee0321c2139e4b20d0e
SHA1 cbed0c81bdbf0afe5ec6a657a11e1a08b82918f9
SHA512 ca41caae4fba961aa30f2d26f9e6dd775e9c79c21e0b911e27891afbb26203a5e77109ceb3b5206f4633c146f70403c1fbae3b19b7f68ecb6f35b90059c9a7a3
SSDEEP 98304:QqPoBhz1aRxcSUDk36SAmxWa9P5qAVp2Bj:QqPe1Cxcxk3ZA5adYc4Bj
MD5 SHA1 SHA512 SSDEEP

Submit Download