wannacry | 45c169c28b66a62f66b15163a0a2e8094664416012e903666198ac269e41b8c6

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2024 03:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-12_44997cba95dc1f01c9fc58319ce693b8_wannacry.exe
Size

3.6MB
MD5

44997cba95dc1f01c9fc58319ce693b8
SHA1

58f253041c2f86249625023626050c00f5abccfa
SHA256

45c169c28b66a62f66b15163a0a2e8094664416012e903666198ac269e41b8c6
SHA512

2206c06cc1c9a21a4f2a7350f20341357763060f04f54e008e06ad114e1406971d055eac658fc78127c62f5c9227d4ef65fa863293e9bb21f28bc40e4f90e55a
SSDEEP

98304:yDqPoBhz1aRxcSUDk36SAEdhvxWqP593R8yAVp2Y:yDqPe1Cxcxk3ZAEUUzR8yc4Y

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3335) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 1 IoCs

pid	Process
3604	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	2024-10-12_44997cba95dc1f01c9fc58319ce693b8_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-12_44997cba95dc1f01c9fc58319ce693b8_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-12_44997cba95dc1f01c9fc58319ce693b8_wannacry.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	2024-10-12_44997cba95dc1f01c9fc58319ce693b8_wannacry.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	2024-10-12_44997cba95dc1f01c9fc58319ce693b8_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	2024-10-12_44997cba95dc1f01c9fc58319ce693b8_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	2024-10-12_44997cba95dc1f01c9fc58319ce693b8_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	2024-10-12_44997cba95dc1f01c9fc58319ce693b8_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2024-10-12_44997cba95dc1f01c9fc58319ce693b8_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-12_44997cba95dc1f01c9fc58319ce693b8_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:372
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:3604

C:\Users\Admin\AppData\Local\Temp\2024-10-12_44997cba95dc1f01c9fc58319ce693b8_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2024-10-12_44997cba95dc1f01c9fc58319ce693b8_wannacry.exe -m security
1⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
9df9b3e32b56a26c432d70b00731825c

SHA1
a6378d9313bd5c035764892ec6804d89baefcf42

SHA256
10215ca5b3f9e0a9c9f2a960d0175112f78c54be5f030f13a55f881942ab59cb

SHA512
951dc97c885924db1e0f09804215dad1cc411c031672efc6d14aacf82dbce20cb7cae54513e655cd07d399c0511e23e034a8d6484e10ff7fe0d32ade6ba35092

Download Submit