wannacry | 1b6d5ecf20a1164838c89fa70ccdfc05c55a2668afb60cba37d01a207bbfea2b

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2024 01:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-11_d1bc96b6d7bf1c80c022e7bd423bba7c_wannacry.exe
Size

3.6MB
MD5

d1bc96b6d7bf1c80c022e7bd423bba7c
SHA1

b749cc2a95f139484db293422427cf88787afb67
SHA256

1b6d5ecf20a1164838c89fa70ccdfc05c55a2668afb60cba37d01a207bbfea2b
SHA512

32479860692fc3d3f023b560de39d1c41e7bffaba3342d8eb9bd3b17cec69698bf9c3f85692c6a4dea217fe4c06ae76b32d39a09be010f649820f9361fcea8bf
SSDEEP

98304:Z8qPoBhzxAVrl7lRokQsKHOUI//Lotg9gWb0J:Z8qPecrRwxs5Me9b6

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3330) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 1 IoCs

pid	Process
4116	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	2024-10-11_d1bc96b6d7bf1c80c022e7bd423bba7c_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-11_d1bc96b6d7bf1c80c022e7bd423bba7c_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-11_d1bc96b6d7bf1c80c022e7bd423bba7c_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2024-10-11_d1bc96b6d7bf1c80c022e7bd423bba7c_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-11_d1bc96b6d7bf1c80c022e7bd423bba7c_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1808
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:4116

C:\Users\Admin\AppData\Local\Temp\2024-10-11_d1bc96b6d7bf1c80c022e7bd423bba7c_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2024-10-11_d1bc96b6d7bf1c80c022e7bd423bba7c_wannacry.exe -m security
1⤵
- System Location Discovery: System Language Discovery
PID:3616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
30e97fc32533f599fc41c1c4a57152f1

SHA1
979e9dd5fd6a7f6fb866d044ef0b5f558e817b02

SHA256
e82652f8483ed5cf3d0fd6a0378f62bf12293b2411d1eef176bcef0ad667bef6

SHA512
0e002ca29b9fba08e6c5870544456582701cbac9367e260f094fdb4bafe2601550c203f71d3dea151c93ea8f0d35d6d7dad04fdb3363e885ed4cef460cf29ba3

Download Submit