Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12-10-2024 04:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe
-
Size
2.4MB
-
MD5
23a5c1c38637a6fe7613bc19b9a96ce3
-
SHA1
732ca2c4891f33e105c67743259f3fd5c49ce769
-
SHA256
60e13430e13be770d5485ba71b97ef4ee4a6ef3227b057f3f21e10ac67c23aa7
-
SHA512
ee27fd61c6d3c429dbe92b54b0599faa6eb003a5af6ce48884a6d9a87555020b4422c8e6c986233ecd0e21a874ac4d8e759ee7728d21636463e5838d37e8b7e8
-
SSDEEP
49152:hnNQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvXiHgYk6:FWqPoBhz1aRxcSUDk36SAEdhvXiHgYk
Score
10/10
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (2468) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in Drivers directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\npf.sys 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\drivers\npf.sys 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe -
resource yara_rule behavioral2/files/0x000a000000023b57-13.dat aspack_v212_v242 behavioral2/files/0x000a000000023b58-15.dat aspack_v212_v242 behavioral2/files/0x000b000000023b56-21.dat aspack_v212_v242 -
Executes dropped EXE 1 IoCs
pid Process 1000 CTFMON.EXE -
Loads dropped DLL 5 IoCs
pid Process 1000 CTFMON.EXE 1000 CTFMON.EXE 1000 CTFMON.EXE 1000 CTFMON.EXE 1000 CTFMON.EXE -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\dllhst3g.exe 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\MSNP.ax 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\runonce.exe 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\TpmTool.exe 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\write.exe 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\bg-BG 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\user.exe 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\WCN 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\compmgmt.msc 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\fi-FI 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\forfiles.exe 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\SecurityAndMaintenance_Alert.png 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\sysprint.sep 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\fontview.exe 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\l3codeca.acm 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\newdev.exe 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\pcaui.exe 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\perfmon.exe 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\wshom.ocx 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\attrib.exe 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\comexp.msc 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\NETSTAT.EXE 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\PresentationHost.exe 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\SearchIndexer.exe 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\cs-CZ 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\perfhost.exe 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\PkgMgr.exe 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\RdpSa.exe 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\eventvwr.msc 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\html.iec 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\provlaunch.exe 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\tzutil.exe 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\uk-UA 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\cmd.exe 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\ctfmon.exe 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\doskey.exe 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\driverquery.exe 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\ja-JP 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesPerformance.exe 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\certlm.msc 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\dcomcnfg.exe 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\fr-FR 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\ipconfig.exe 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\l3codecp.acm 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\wdmaud.drv 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\cleanmgr.exe 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\fsutil.exe 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\msgsm32.acm 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\print.exe 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\tar.exe 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\mspaint.exe 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\taskkill.exe 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\chkdsk.exe 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\kmddsp.tsp 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\reg.exe 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\typeperf.exe 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\w32tm.exe 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\Ipmi 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\Recovery 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\takeown.exe 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\FxsTmp 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\SysWOW64\pcl.sep 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe -
Drops file in Windows directory 10 IoCs
description ioc Process File created C:\Windows\pthreadvc.dll 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File created C:\Windows\packet.dll 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File created C:\Windows\wpcap.dll 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File created C:\Windows\CTFMON.EXE 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File opened for modification C:\Windows\CTFMON.EXE 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File created C:\Windows\pthreadvc.dll 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File created C:\WINDOWS\tasksche.exe 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File created C:\Windows\packet.dll 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File created C:\Windows\wpcap.dll 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe File created C:\Windows\CTFMON.EXE 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CTFMON.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3028 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe 3028 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe 1000 CTFMON.EXE 1000 CTFMON.EXE 1000 CTFMON.EXE 1000 CTFMON.EXE 1000 CTFMON.EXE 1000 CTFMON.EXE 1000 CTFMON.EXE 1000 CTFMON.EXE 1000 CTFMON.EXE 1000 CTFMON.EXE 1000 CTFMON.EXE 1000 CTFMON.EXE 1000 CTFMON.EXE 1000 CTFMON.EXE 1000 CTFMON.EXE 1000 CTFMON.EXE 1000 CTFMON.EXE 1000 CTFMON.EXE 1000 CTFMON.EXE 1000 CTFMON.EXE 1000 CTFMON.EXE 1000 CTFMON.EXE 1000 CTFMON.EXE 1000 CTFMON.EXE 1000 CTFMON.EXE 1000 CTFMON.EXE 1000 CTFMON.EXE 1000 CTFMON.EXE 1000 CTFMON.EXE 1000 CTFMON.EXE 1000 CTFMON.EXE 1000 CTFMON.EXE 1000 CTFMON.EXE 1000 CTFMON.EXE 1000 CTFMON.EXE 1000 CTFMON.EXE 1000 CTFMON.EXE 1000 CTFMON.EXE 1000 CTFMON.EXE 1000 CTFMON.EXE 1000 CTFMON.EXE 1000 CTFMON.EXE 1000 CTFMON.EXE 1000 CTFMON.EXE 1000 CTFMON.EXE 1000 CTFMON.EXE 1000 CTFMON.EXE 1000 CTFMON.EXE 1000 CTFMON.EXE 1000 CTFMON.EXE 1000 CTFMON.EXE 1000 CTFMON.EXE 1000 CTFMON.EXE 1000 CTFMON.EXE 1000 CTFMON.EXE 1000 CTFMON.EXE 1000 CTFMON.EXE 1000 CTFMON.EXE 1000 CTFMON.EXE 1000 CTFMON.EXE 1000 CTFMON.EXE 1000 CTFMON.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1000 CTFMON.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3028 wrote to memory of 1000 3028 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe 84 PID 3028 wrote to memory of 1000 3028 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe 84 PID 3028 wrote to memory of 1000 3028 2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe"1⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\CTFMON.EXEC:\Windows\CTFMON.EXE2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1000
-
-
C:\Users\Admin\AppData\Local\Temp\2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2024-10-12_23a5c1c38637a6fe7613bc19b9a96ce3_wannacry.exe -m security1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:5068
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD51f4f4949134ae76c770248635b207e3e
SHA16f35d95a273060a3b8bcd99b1010f7f8b0a34c99
SHA256f581d37ca5a751abdb03c74a1189b81f5dbc8e9608c9a266b74fc87f8e4b4ac9
SHA5124412bc9a8fffad370a73805c1c5181c1847fbcd46c69b3853d88a099c406da941928bc310e525be92c9c8cbab62c2cc349e07975cd666156aed11bceecef4b36
-
Filesize
40.4MB
MD51b9c1da0efb1ca9b81c700a467e320d2
SHA16025ae49fd921dc503280261aa74a363eabe6abd
SHA2562e4e8bf069405218752d9f6f3da59c70730f5d956ca51d60745428a537a0bbc2
SHA51218b6dc5f9e3d95589dcc6449ff2d04ff595f72f5a852f1d71d1a127854bffb1a7dc3a389d74d7b84a5dbe69cbcfd4242b2811d2f4f8b00c86e1b5f4f5d5d83e7
-
Filesize
255KB
MD51b40297524fc0e21d2afcf86519a4fb1
SHA18318a5aa466c19b7420c1c3b60b93f96595168ed
SHA2560c8b34c0ddaa112e7b6dbd420d7dde1f8622e4179fce2f38452473d1f4744df3
SHA512045384eb7748cd51affd58cb6ea8d894646b5c4359fa98552b3a854aea9de82f125496183f4c7b29d921a5cb6d53b65c55c2e9499d26c1204859e7c7bb039342
-
Filesize
29KB
MD55c14de7d04d00aac3f03b569f2ea4664
SHA1a26ae78a204791548be000824a1ad05524bdd2e8
SHA256fac5bcebde87a261b4fb5a110765e53c96f0ef27b24ca94762f2c2ddb4da4204
SHA5124bcbc4f0ab7b52f4303206fafd9d0bafea02bb25d8395a80eb6390b30ccc750379fb7fe9e0bf5a4a025cedb9e4702b7655963e360f2f983526dbc2e1efaa814f
-
Filesize
32KB
MD5f46c27d67c0ce202ebf4b771cb56ec00
SHA1f999454d0aaabccfda7a50c8cb0818e50a7a1d91
SHA256a68c877cd9c7562c66c722b4d0cd9fa366c65465d4c47ab63bf28bd5f1a69bcc
SHA5122b7c6f7e865f88625a05c85226a95319656648029ef1c1b92b3a6c2dea7a4f7cf7d157c09af32c8689c76c6247852cd5af72d4f0dbb4dbcc3fe3c24681d53dbf
-
Filesize
24KB
MD5ea20ca545a351384486cef574b7a5571
SHA1a1f01df09df62e933e4ff289361641b06ff31548
SHA2562bd8d9dd8739e17828f8a87b73d592d4fd17988bbb0ea4a4d4cbda57129e8e48
SHA51264b3dee275fb1830254fa2a95778b26864708c0b5e348cf5919ded013cda3872fe26304c846fa7968b24f60e2b6105c4813ff9e695bd6bb52897318cdecd382b
-
Filesize
117KB
MD56d79c447d16b96e7a72b12e450b6fa8e
SHA1d2afa5eb9c9ba598f82a6025c1a07d31cb8a30bb
SHA256afe533c6990520d49a4963bb9ce6d563b02d7b299ff4a9c9e4bca31ca6920deb
SHA5126b96c6e79608256807f37a4b74b264074274642b4e4e09ef870d13246b7706582535c1e4f33f2a61281ab4c0ef59fc03c60a54faa6627aee92df52f356b8d966