Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-10-2024 23:50

General

  • Target

    2024-10-10_6c9574e40dcd7e6d5756b680ad03481f_wannacry.exe

  • Size

    3.6MB

  • MD5

    6c9574e40dcd7e6d5756b680ad03481f

  • SHA1

    f8a3ac3529e69d298338e58fae74bbe7d3e0a12c

  • SHA256

    c73637208230cbba3540609cc77d43a19f345ee314d999e79abfc05e5a7bbd59

  • SHA512

    68699a242e7039fc71b0ff29a270378ed87b5b99441d496f449974fca70ce5d9cd2f3a14df1053a184b99bcd48293986004380f4990666aa48d47a1290623d24

  • SSDEEP

    98304:Z8qPoBhz1aRpAEdhvxWa9P593R8yAVp2HI:Z8qPe1CpAEUadzR8yc4HI

Malware Config

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

  • Contacts a large (3222) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Executes dropped EXE 1 IoCs
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-10-10_6c9574e40dcd7e6d5756b680ad03481f_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-10-10_6c9574e40dcd7e6d5756b680ad03481f_wannacry.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    PID:2932
    • C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      2⤵
      • Executes dropped EXE
      PID:4332
  • C:\Users\Admin\AppData\Local\Temp\2024-10-10_6c9574e40dcd7e6d5756b680ad03481f_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp\2024-10-10_6c9574e40dcd7e6d5756b680ad03481f_wannacry.exe -m security
    1⤵
    • System Location Discovery: System Language Discovery
    PID:5052

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\tasksche.exe

    Filesize

    3.4MB

    MD5

    64130504f35b0092b5b1b4ae6bd0e6e1

    SHA1

    3b9a1b966d230f88ae2fab4e0cf53ebc34b11409

    SHA256

    108288cdce49198dd79bf0331ce85503362514c84fd2ff4129bb04f5e53aa1f5

    SHA512

    ba947681b3f3a21cf68727a5fed8e8234b61b6ed71314b39eb20f8f82ed7c4e94a678e6e19657ceb7906d2dff6e9fb89b2afb1e4db90b1c6ef38037a05b361fb