wannacry | 001ea567a43fb9d692bb6818268bf71f9c14eb6a76deca777a4f6bc8320f61bb

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2024 13:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-11_f5dbf918166a7e6dac039257ae18f5ca_wannacry.exe
Size

5.0MB
MD5

f5dbf918166a7e6dac039257ae18f5ca
SHA1

427b8374283dc21fd7dc38678371c03c3ae4a78c
SHA256

001ea567a43fb9d692bb6818268bf71f9c14eb6a76deca777a4f6bc8320f61bb
SHA512

a27cbac3fa52280ef445e45f1a3f167bccecdf45b4400dde36d9369b50e07ef4aeef81f951b13e702dbb9915d0d6de6828637904c248c7d36d7d4e632937eaa3
SSDEEP

98304:yDqPoBhz1aRxcSUDk36SAEdhkubyrn59Z8yAVp2H:yDqPe1Cxcxk3ZAEouOrnV8yc4H

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3156) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 1 IoCs

pid	Process
3948	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	2024-10-11_f5dbf918166a7e6dac039257ae18f5ca_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-11_f5dbf918166a7e6dac039257ae18f5ca_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-11_f5dbf918166a7e6dac039257ae18f5ca_wannacry.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	2024-10-11_f5dbf918166a7e6dac039257ae18f5ca_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	2024-10-11_f5dbf918166a7e6dac039257ae18f5ca_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	2024-10-11_f5dbf918166a7e6dac039257ae18f5ca_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	2024-10-11_f5dbf918166a7e6dac039257ae18f5ca_wannacry.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	2024-10-11_f5dbf918166a7e6dac039257ae18f5ca_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2024-10-11_f5dbf918166a7e6dac039257ae18f5ca_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-11_f5dbf918166a7e6dac039257ae18f5ca_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3952
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:3948

C:\Users\Admin\AppData\Local\Temp\2024-10-11_f5dbf918166a7e6dac039257ae18f5ca_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2024-10-11_f5dbf918166a7e6dac039257ae18f5ca_wannacry.exe -m security
1⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
24e4900e5990ff8ebeb9ee002cbf2d4f

SHA1
f15cd9ee42bb9a3ebdf393f16add2a30061de9b0

SHA256
1ab8dfb869467aad544a70b4b810703317282b817b9c326c8f2f3f831ff346d2

SHA512
70e8d0f5639f6bef8d4664ac075132cf62412a17e8b8ffdaea324ab5b52db020f4b6f5496e230ed13e036499c19226da16d6a37f7b4f8b0c77982643349b5906

Download Submit