wannacry | c73637208230cbba3540609cc77d43a19f345ee314d999e79abfc05e5a7bbd59

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
10-10-2024 23:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-10_6c9574e40dcd7e6d5756b680ad03481f_wannacry.exe
Size

3.6MB
MD5

6c9574e40dcd7e6d5756b680ad03481f
SHA1

f8a3ac3529e69d298338e58fae74bbe7d3e0a12c
SHA256

c73637208230cbba3540609cc77d43a19f345ee314d999e79abfc05e5a7bbd59
SHA512

68699a242e7039fc71b0ff29a270378ed87b5b99441d496f449974fca70ce5d9cd2f3a14df1053a184b99bcd48293986004380f4990666aa48d47a1290623d24
SSDEEP

98304:Z8qPoBhz1aRpAEdhvxWa9P593R8yAVp2HI:Z8qPe1CpAEUadzR8yc4HI

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3323) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 1 IoCs

pid	Process
2368	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	2024-10-10_6c9574e40dcd7e6d5756b680ad03481f_wannacry.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	2024-10-10_6c9574e40dcd7e6d5756b680ad03481f_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-10_6c9574e40dcd7e6d5756b680ad03481f_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-10_6c9574e40dcd7e6d5756b680ad03481f_wannacry.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	2024-10-10_6c9574e40dcd7e6d5756b680ad03481f_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2024-10-10_6c9574e40dcd7e6d5756b680ad03481f_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-10_6c9574e40dcd7e6d5756b680ad03481f_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2920
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:2368

C:\Users\Admin\AppData\Local\Temp\2024-10-10_6c9574e40dcd7e6d5756b680ad03481f_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2024-10-10_6c9574e40dcd7e6d5756b680ad03481f_wannacry.exe -m security
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
64130504f35b0092b5b1b4ae6bd0e6e1

SHA1
3b9a1b966d230f88ae2fab4e0cf53ebc34b11409

SHA256
108288cdce49198dd79bf0331ce85503362514c84fd2ff4129bb04f5e53aa1f5

SHA512
ba947681b3f3a21cf68727a5fed8e8234b61b6ed71314b39eb20f8f82ed7c4e94a678e6e19657ceb7906d2dff6e9fb89b2afb1e4db90b1c6ef38037a05b361fb

Download Submit