Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-10-2024 01:06

General

  • Target

    2024-10-11_36bc79e694b0b73425ce807988680b54_wannacry.exe

  • Size

    2.2MB

  • MD5

    36bc79e694b0b73425ce807988680b54

  • SHA1

    1b8ce45395057afdf576e0ed1230338bdc4b745d

  • SHA256

    68f22c3d9ccafa019399fc2d58afbd9904afdc52da6b8733fb6cce95b560b40f

  • SHA512

    de848fc38dbf785050cb2a55053c65d6ebcf682526bb55030a53b74f1d1e42c30e2e1591f03e8dc3b7ee600a88a73a24d0072cd3597e3702ec741d6d241306da

  • SSDEEP

    49152:QnFQqMSPbcBVCR+TSqTdX1HkQo6SAARdhnvn:QeqPoBacSUDk36SAEdhvn

Malware Config

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

  • Contacts a large (3095) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Drops file in System32 directory 4 IoCs
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-10-11_36bc79e694b0b73425ce807988680b54_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-10-11_36bc79e694b0b73425ce807988680b54_wannacry.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    PID:2604
  • C:\Users\Admin\AppData\Local\Temp\2024-10-11_36bc79e694b0b73425ce807988680b54_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp\2024-10-11_36bc79e694b0b73425ce807988680b54_wannacry.exe -m security
    1⤵
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    PID:1148

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads