Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
11-10-2024 01:20
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-11_b7ab3e754ed6af3917628847902c825f_wannacry.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
2024-10-11_b7ab3e754ed6af3917628847902c825f_wannacry.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-10-11_b7ab3e754ed6af3917628847902c825f_wannacry.exe
-
Size
3.6MB
-
MD5
b7ab3e754ed6af3917628847902c825f
-
SHA1
cbd908a84e9c1cf1bb5b96d6e6e4d72ba11b7599
-
SHA256
4dbce54cfaf9c385aee5e8d55bcc0d7001e2c3ed84602f930b1ed7135db22b07
-
SHA512
2613df484de9ee4d3cc88b57529fa84b1e9044e09b9f30a9d31d934bbd2686cb986089e60fadf1330f2a2e9256c3f24f343cd3ad954de7ce896453854088402f
-
SSDEEP
24576:VbLgdeQhfdmMSirYbcMNgef0QeQjG/D8kIqRYoAdNLKVEG:VnjQqMSPbcBVQej/1INlG
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (3325) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 1 IoCs
pid Process 2592 tasksche.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat 2024-10-11_b7ab3e754ed6af3917628847902c825f_wannacry.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\WINDOWS\tasksche.exe 2024-10-11_b7ab3e754ed6af3917628847902c825f_wannacry.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-11_b7ab3e754ed6af3917628847902c825f_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-11_b7ab3e754ed6af3917628847902c825f_wannacry.exe -
Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings 2024-10-11_b7ab3e754ed6af3917628847902c825f_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-11_b7ab3e754ed6af3917628847902c825f_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-11_b7ab3e754ed6af3917628847902c825f_wannacry.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1748 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i2⤵
- Executes dropped EXE
PID:2592
-
-
C:\Users\Admin\AppData\Local\Temp\2024-10-11_b7ab3e754ed6af3917628847902c825f_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2024-10-11_b7ab3e754ed6af3917628847902c825f_wannacry.exe -m security1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2128
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.4MB
MD53cb5d371e74e0ca2f08b35d38486fc50
SHA175c88cdfdfdb79553ddce7e10ee5d7d1bb5c6a6e
SHA256981633af5bf08cd1a33bd360d9d59de0a9abc19df00fa74605e64fa7e2542c77
SHA512c59ddc7302f978b2d65d4fe2307cf30767164554e5965e54dfeb6369edd9357e998404d6f4fc577676c92501f3bd6002bc34a2ffe0609d95ccb9c05873ca0802