Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-10-2024 23:55
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-10_6c9574e40dcd7e6d5756b680ad03481f_wannacry.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
2024-10-10_6c9574e40dcd7e6d5756b680ad03481f_wannacry.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-10-10_6c9574e40dcd7e6d5756b680ad03481f_wannacry.exe
-
Size
3.6MB
-
MD5
6c9574e40dcd7e6d5756b680ad03481f
-
SHA1
f8a3ac3529e69d298338e58fae74bbe7d3e0a12c
-
SHA256
c73637208230cbba3540609cc77d43a19f345ee314d999e79abfc05e5a7bbd59
-
SHA512
68699a242e7039fc71b0ff29a270378ed87b5b99441d496f449974fca70ce5d9cd2f3a14df1053a184b99bcd48293986004380f4990666aa48d47a1290623d24
-
SSDEEP
98304:Z8qPoBhz1aRpAEdhvxWa9P593R8yAVp2HI:Z8qPe1CpAEUadzR8yc4HI
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (3027) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 1 IoCs
pid Process 4572 tasksche.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\WINDOWS\tasksche.exe 2024-10-10_6c9574e40dcd7e6d5756b680ad03481f_wannacry.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-10_6c9574e40dcd7e6d5756b680ad03481f_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-10_6c9574e40dcd7e6d5756b680ad03481f_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-10_6c9574e40dcd7e6d5756b680ad03481f_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-10_6c9574e40dcd7e6d5756b680ad03481f_wannacry.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2948 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i2⤵
- Executes dropped EXE
PID:4572
-
-
C:\Users\Admin\AppData\Local\Temp\2024-10-10_6c9574e40dcd7e6d5756b680ad03481f_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2024-10-10_6c9574e40dcd7e6d5756b680ad03481f_wannacry.exe -m security1⤵
- System Location Discovery: System Language Discovery
PID:2604
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.4MB
MD564130504f35b0092b5b1b4ae6bd0e6e1
SHA13b9a1b966d230f88ae2fab4e0cf53ebc34b11409
SHA256108288cdce49198dd79bf0331ce85503362514c84fd2ff4129bb04f5e53aa1f5
SHA512ba947681b3f3a21cf68727a5fed8e8234b61b6ed71314b39eb20f8f82ed7c4e94a678e6e19657ceb7906d2dff6e9fb89b2afb1e4db90b1c6ef38037a05b361fb