wannacry | c6ab3a2d7944b32a00ed7be21558ce6d9115b0ad1fbdfabe371b5d44d6080628

Resubmissions

08-11-2024 14:44

241108-r4madathmk 10

08-11-2024 14:43

241108-r337hatjhy 10

08-11-2024 13:04

241108-qbakfasjf1 10

Analysis

max time kernel
25s
max time network
26s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
08-11-2024 14:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-11-08_f44e76524ae3e3db4c1f1b4532ced4dc_wannacry.exe
Size

5.0MB
MD5

f44e76524ae3e3db4c1f1b4532ced4dc
SHA1

2a1f60d41dfc4b15acf56168218d70744e6cf2a7
SHA256

c6ab3a2d7944b32a00ed7be21558ce6d9115b0ad1fbdfabe371b5d44d6080628
SHA512

424f130f8cfdbea149fb6ca57754e1fa4b11966944aa56774e424cc83f1b9a115011d27dfcdd590e24c25bcdbddc957fcbd18f3ed50f2db7d6ceea402c8fab75
SSDEEP

98304:yWqPoBhz1aP6SAEdhvxWa9P593R8yAVp2H:yWqPe1EZAEUadzR8yc4H

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Wannacry family
wannacry
Executes dropped EXE 1 IoCs

Processes:

tasksche.exe

pid process

1560 tasksche.exe
Drops file in Windows directory 1 IoCs

Processes:

2024-11-08_f44e76524ae3e3db4c1f1b4532ced4dc_wannacry.exe

description ioc process

File created C:\WINDOWS\tasksche.exe 2024-11-08_f44e76524ae3e3db4c1f1b4532ced4dc_wannacry.exe

pid	process
1560	tasksche.exe

description	ioc	process
File created	C:\WINDOWS\tasksche.exe	2024-11-08_f44e76524ae3e3db4c1f1b4532ced4dc_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

2024-11-08_f44e76524ae3e3db4c1f1b4532ced4dc_wannacry.exe2024-11-08_f44e76524ae3e3db4c1f1b4532ced4dc_wannacry.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-11-08_f44e76524ae3e3db4c1f1b4532ced4dc_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-11-08_f44e76524ae3e3db4c1f1b4532ced4dc_wannacry.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

2024-11-08_f44e76524ae3e3db4c1f1b4532ced4dc_wannacry.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	2024-11-08_f44e76524ae3e3db4c1f1b4532ced4dc_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	2024-11-08_f44e76524ae3e3db4c1f1b4532ced4dc_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	2024-11-08_f44e76524ae3e3db4c1f1b4532ced4dc_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	2024-11-08_f44e76524ae3e3db4c1f1b4532ced4dc_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	2024-11-08_f44e76524ae3e3db4c1f1b4532ced4dc_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2024-11-08_f44e76524ae3e3db4c1f1b4532ced4dc_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-08_f44e76524ae3e3db4c1f1b4532ced4dc_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3464
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:1560

C:\Users\Admin\AppData\Local\Temp\2024-11-08_f44e76524ae3e3db4c1f1b4532ced4dc_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2024-11-08_f44e76524ae3e3db4c1f1b4532ced4dc_wannacry.exe -m security
1⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1704

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
db0dc3e4c89ad8a7744c09b78b7032fa

SHA1
67ae5404d5ceb17fa752bcdd20d6f0690f878321

SHA256
c9f422bdf621d4ece515813b28459d0a016e94a03a0ef223cf46a2cc475152c4

SHA512
4d82b246e699ba763ace97ab4acaaf04c3ae8327bcfec6658e114c040d0ec87be4251ba2328b686515690591812e1cd1f16497b5e365035af5003b716d17fb49

Download Submit