Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13/10/2024, 03:43
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-13_190b5b5bf1213609684937a23785f6e7_wannacry.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-10-13_190b5b5bf1213609684937a23785f6e7_wannacry.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-10-13_190b5b5bf1213609684937a23785f6e7_wannacry.exe
-
Size
3.6MB
-
MD5
190b5b5bf1213609684937a23785f6e7
-
SHA1
c65ecb3b24513d87a10acfefdf2ac679907f93d4
-
SHA256
9712e75274c790fb9b1560e4b4d356688ad558f2576ff64dffeeaa620f3fb044
-
SHA512
e92221672dfaa99bebe2e202731cd95fbf5148bd32419b2c0e67fe35617cd05b0a351e462d4cb448e73584ca1e7dd893c5c838b98af94900e7dace6bb125a7eb
-
SSDEEP
49152:XnAQqMSPbcBVQej/1UNRx+TSqTdX1HkQo6SAARdhnvrAH1plAHI:XDqPoBhz1mRxcSUDk36SAEdhvrAVp2HI
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (3301) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 1 IoCs
pid Process 1108 tasksche.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\WINDOWS\tasksche.exe 2024-10-13_190b5b5bf1213609684937a23785f6e7_wannacry.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-13_190b5b5bf1213609684937a23785f6e7_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-13_190b5b5bf1213609684937a23785f6e7_wannacry.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 2024-10-13_190b5b5bf1213609684937a23785f6e7_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 2024-10-13_190b5b5bf1213609684937a23785f6e7_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 2024-10-13_190b5b5bf1213609684937a23785f6e7_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 2024-10-13_190b5b5bf1213609684937a23785f6e7_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 2024-10-13_190b5b5bf1213609684937a23785f6e7_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-13_190b5b5bf1213609684937a23785f6e7_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-13_190b5b5bf1213609684937a23785f6e7_wannacry.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2896 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i2⤵
- Executes dropped EXE
PID:1108
-
-
C:\Users\Admin\AppData\Local\Temp\2024-10-13_190b5b5bf1213609684937a23785f6e7_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2024-10-13_190b5b5bf1213609684937a23785f6e7_wannacry.exe -m security1⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:4956
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.4MB
MD528bc0a432d42f583978dda1ec903d342
SHA1b376226a880cfb8606e644403ec0b1660bc4bcf1
SHA256487b9267cd8dcd2f6896984f83bd5541966795dfe66ef455a036fe230d4adee0
SHA51219e04da9b86e02690261186d88e8b8061db496a68c7e8cd6db71f7b9e733946fbda3924fc8e6f9f35a3f2a827dd95292075b149a06bae6bd379e675b3d53bea3