Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
11/11/2024, 16:25 UTC
General
-
Target
2024-11-11_18b2c11158e471eed32ed6f966ad984d_wannacry.exe
-
Size
5.0MB
-
MD5
18b2c11158e471eed32ed6f966ad984d
-
SHA1
0bddb663e71e7e2d5b803058d0e5b0fae4a6182c
-
SHA256
8e1672053395a1b003b17b41952e3918e2e0d12030b66ca12768a87b82519033
-
SHA512
77b06a1705065a29c1cc945e87fb20b3b43fa78c3a69ef492e4436512fa22b5955bb248fbb4c5328f66a09c1c0a70c837b84f2e8af5026979a3acc94ef085a43
-
SSDEEP
12288:GvbLgPlu+QhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7z:2bLgddQhfdmMSirYbcMNgef
Score
10/10
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Wannacry family
-
Contacts a large (3310) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 1 IoCs
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in System32 directory 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies data under HKEY_USERS 24 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-11_18b2c11158e471eed32ed6f966ad984d_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-11_18b2c11158e471eed32ed6f966ad984d_wannacry.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\2024-11-11_18b2c11158e471eed32ed6f966ad984d_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2024-11-11_18b2c11158e471eed32ed6f966ad984d_wannacry.exe -m security1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
Network
-
DNSwww.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comRemote address:8.8.8.8:53Requestwww.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comIN AResponsewww.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comIN A104.16.166.228www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comIN A104.16.167.228 -
GEThttp://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/Remote address:104.16.166.228:80RequestGET / HTTP/1.1
Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
Date: Mon, 11 Nov 2024 16:25:04 GMT
Content-Type: text/html
Content-Length: 607
Connection: close
Server: cloudflare
CF-RAY: 8e0fa2dbce70731e-LHR
-
GEThttp://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/Remote address:104.16.166.228:80RequestGET / HTTP/1.1
Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
Date: Mon, 11 Nov 2024 16:25:04 GMT
Content-Type: text/html
Content-Length: 607
Connection: close
Server: cloudflare
CF-RAY: 8e0fa2dd2c0663da-LHR
-
104.16.166.228:80http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/http
HTTP Request
GET http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/HTTP Response
200 -
104.16.166.228:80http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/http
HTTP Request
GET http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/HTTP Response
200 -
136.165.187.16:445
-
10.127.0.1:445 -
10.127.1.1:445
-
10.127.2.1:445
-
10.127.3.1:445
-
10.127.4.1:445
-
10.127.5.1:445
-
10.127.6.1:445
-
10.127.7.1:445
-
10.127.8.1:445
-
10.127.9.1:445
-
10.127.10.1:445
-
69.31.22.169:445
-
10.127.12.1:445
-
10.127.14.1:445
-
10.127.13.1:445
-
10.127.18.1:445
-
10.127.16.1:445
-
10.127.11.1:445
-
10.127.17.1:445
-
10.127.21.1:445
-
42.209.124.198:445 -
10.127.15.1:445
-
10.127.19.1:445
-
10.127.20.1:445
-
10.127.22.1:445
-
23.51.15.170:445 -
10.127.23.1:445
-
10.127.24.1:445
-
10.127.25.1:445
-
10.127.26.1:445
-
10.127.27.1:445
-
10.127.28.1:445
-
10.127.32.1:445
-
102.75.240.72:445 -
10.127.30.1:445
-
10.127.31.1:445
-
10.127.33.1:445
-
115.50.23.132:445
-
10.127.29.1:445
-
10.127.39.1:445
-
10.127.35.1:445
-
10.127.38.1:445
-
177.111.83.61:445 -
10.127.41.1:445
-
10.127.40.1:445
-
10.127.34.1:445
-
10.127.37.1:445
-
10.127.36.1:445
-
10.127.42.1:445
-
10.127.43.1:445
-
32.60.137.5:445
-
10.127.44.1:445
-
217.196.61.184:445
-
10.127.45.1:445
-
10.127.46.1:445
-
10.127.48.1:445
-
10.127.52.1:445
-
87.221.75.165:445 -
10.127.47.1:445
-
10.127.54.1:445
-
10.239.190.120:445
-
10.127.53.1:445
-
10.127.50.1:445
-
10.127.51.1:445
-
10.127.49.1:445
-
205.70.65.96:445
-
10.127.56.1:445
-
10.127.55.1:445
-
121.97.31.144:445 -
10.127.58.1:445
-
10.127.59.1:445
-
10.127.62.1:445
-
23.22.247.181:445
-
10.127.57.1:445
-
10.127.60.1:445
-
10.127.61.1:445
-
10.127.63.1:445
-
10.127.64.1:445
-
10.127.65.1:445
-
48.191.134.81:445
-
193.87.128.88:445 -
10.127.69.1:445
-
10.127.67.1:445
-
10.127.66.1:445
-
10.127.71.1:445
-
72.8.245.155:445
-
10.127.75.1:445
-
123.74.173.10:445
-
10.127.74.1:445
-
10.127.68.1:445
-
10.127.73.1:445
-
10.127.70.1:445
-
40.251.127.252:445
-
10.127.72.1:445
-
132.172.46.27:445
-
10.127.76.1:445
-
139.148.248.126:445
-
10.127.77.1:445
-
76.38.225.16:445
-
10.127.78.1:445
-
10.127.79.1:445
-
10.127.80.1:445
-
10.127.81.1:445
-
10.127.82.1:445
-
10.127.83.1:445
-
10.127.84.1:445
-
10.127.85.1:445
-
10.127.86.1:445
-
10.127.87.1:445
-
184.138.117.83:445
-
47.9.162.59:445 -
145.41.180.161:445 -
70.188.45.52:445
-
10.127.91.1:445
-
10.127.88.1:445
-
211.172.224.210:445 -
10.127.94.1:445
-
10.127.89.1:445
-
10.127.90.1:445
-
86.157.250.245:445 -
10.127.93.1:445
-
117.53.22.32:445
-
10.127.96.1:445
-
10.127.95.1:445
-
10.127.92.1:445
-
117.244.141.149:445
-
25.124.6.200:445
-
10.127.98.1:445
-
10.127.99.1:445
-
6.116.212.252:445
-
10.127.100.1:445
-
10.127.97.1:445
-
10.127.101.1:445
-
10.127.102.1:445
-
10.127.103.1:445
-
10.127.104.1:445
-
10.127.105.1:445
-
201.173.212.9:445 -
10.127.106.1:445
-
10.127.107.1:445
-
110.163.52.232:445
-
10.127.109.1:445
-
10.127.108.1:445
-
185.114.134.13:445 -
59.60.177.101:445
-
165.217.89.184:445
-
74.129.158.23:445
-
10.127.110.1:445
-
10.127.112.1:445
-
10.127.113.1:445
-
41.177.97.112:445 -
10.127.111.1:445
-
10.127.118.1:445
-
11.188.23.238:445
-
10.127.114.1:445
-
10.127.115.1:445
-
37.77.247.143:445 -
10.127.116.1:445
-
10.127.120.1:445
-
15.231.33.89:445
-
15.195.157.38:445
-
88.225.228.241:445 -
10.127.117.1:445
-
10.127.119.1:445
-
10.127.121.1:445
-
10.127.122.1:445
-
10.127.123.1:445
-
81.54.39.182:445 -
10.127.124.1:445
-
10.127.125.1:445
-
98.169.149.89:445
-
10.127.128.1:445
-
97.61.5.192:445
-
184.55.38.140:445
-
10.127.129.1:445
-
131.81.245.73:445
-
10.127.127.1:445
-
10.127.132.1:445
-
10.127.130.1:445
-
16.13.161.178:445
-
10.127.126.1:445
-
10.127.131.1:445
-
94.164.253.22:445 -
10.127.133.1:445
-
120.78.137.62:445
-
10.127.134.1:445
-
10.127.137.1:445
-
163.7.71.146:445 -
10.127.139.1:445
-
10.127.136.1:445
-
130.154.169.184:445
-
115.5.92.205:445
-
10.127.135.1:445
-
10.127.141.1:445
-
10.127.140.1:445
-
45.99.142.166:445 -
141.92.40.123:445
-
10.127.138.1:445
-
10.127.142.1:445
-
10.127.143.1:445
-
195.20.88.153:445 -
10.127.144.1:445
-
9.62.64.137:445
-
211.134.127.150:445
-
10.127.145.1:445
-
97.27.38.194:445
-
10.127.147.1:445
-
10.127.146.1:445
-
214.24.173.43:445
-
10.127.151.1:445
-
188.117.210.196:445 -
10.127.148.1:445
-
14.58.122.178:445
-
43.248.177.32:445
-
10.127.149.1:445
-
126.164.131.159:445
-
10.127.152.1:445
-
10.127.153.1:445
-
168.76.136.142:445 -
10.127.150.1:445
-
10.127.156.1:445
-
32.224.105.80:445
-
10.127.154.1:445
-
10.127.155.1:445
-
10.127.157.1:445
-
140.52.68.54:445
-
160.125.124.228:445
-
10.127.159.1:445
-
10.127.158.1:445
-
10.127.161.1:445
-
65.202.61.121:445
-
156.4.73.243:445 -
10.127.165.1:445
-
10.127.160.1:445
-
10.127.162.1:445
-
10.127.163.1:445
-
10.127.164.1:445
-
118.137.80.92:445 -
10.127.166.1:445
-
191.180.40.217:445
-
95.71.126.151:445 -
218.156.109.242:445
-
94.39.242.83:445
-
10.127.168.1:445
-
202.193.247.42:445
-
36.51.247.126:445
-
10.127.169.1:445
-
148.240.244.105:445
-
187.172.198.118:445
-
10.127.167.1:445
-
151.11.33.254:445
-
10.127.172.1:445
-
157.123.182.44:445
-
10.127.176.1:445
-
10.127.174.1:445
-
10.127.170.1:445
-
10.127.175.1:445
-
10.127.171.1:445
-
67.91.187.130:445
-
192.236.154.25:445
-
10.127.173.1:445
-
43.51.239.13:445 -
46.132.69.74:445 -
10.127.179.1:445
-
10.127.177.1:445
-
37.243.173.177:445 -
138.61.103.71:445
-
10.127.181.1:445
-
99.81.134.26:445 -
10.127.178.1:445
-
10.127.180.1:445
-
10.127.182.1:445
-
10.127.183.1:445
-
10.127.184.1:445
-
10.127.185.1:445
-
10.127.186.1:445
-
177.125.5.211:445
-
221.221.233.207:445
-
102.215.113.14:445
-
10.127.188.1:445
-
28.21.157.124:445
-
147.45.251.189:445
-
82.11.144.6:445
-
206.15.167.143:445
-
10.127.187.1:445
-
201.149.183.37:445
-
10.127.190.1:445
-
60.243.103.87:445
-
10.127.193.1:445
-
10.127.191.1:445
-
10.127.189.1:445
-
10.127.192.1:445
-
10.127.194.1:445
-
10.127.195.1:445
-
10.127.196.1:445
-
221.184.128.191:445
-
10.127.197.1:445
-
122.117.38.96:445 -
10.127.198.1:445
-
219.53.209.73:445
-
10.127.199.1:445
-
150.70.30.227:445
-
195.86.60.205:445
-
172.246.155.137:445
-
119.89.50.226:445
-
10.127.200.1:445
-
206.185.132.211:445
-
22.101.173.252:445
-
10.127.201.1:445
-
10.127.202.1:445
-
10.127.203.1:445
-
140.67.54.129:445
-
10.127.204.1:445
-
105.142.206.136:445
-
148.141.201.123:445
-
68.33.202.236:445
-
10.127.206.1:445
-
10.127.207.1:445
-
134.194.205.82:445
-
72.214.124.194:445
-
14.35.139.77:445
-
10.127.205.1:445
-
14.241.136.49:445 -
10.127.208.1:445
-
91.123.8.64:445
-
10.127.210.1:445
-
10.127.211.1:445
-
162.148.120.161:445
-
3.85.34.88:445
-
10.127.209.1:445
-
10.127.212.1:445
-
10.127.213.1:445
-
10.127.214.1:445
-
10.127.215.1:445
-
107.96.23.99:445
-
10.127.216.1:445
-
10.127.217.1:445
-
10.127.218.1:445
-
32.102.188.219:445
-
10.127.219.1:445
-
76.174.137.174:445
-
10.127.220.1:445
-
73.107.116.232:445
-
20.251.229.253:445 -
10.127.221.1:445
-
70.150.208.14:445
-
29.32.76.177:445
-
67.140.238.117:445
-
5.95.11.235:445
-
10.127.222.1:445
-
10.127.223.1:445
-
32.26.39.166:445
-
185.59.116.97:445
-
10.127.224.1:445
-
168.175.254.56:445
-
167.125.223.100:445 -
10.127.226.1:445
-
10.127.227.1:445
-
42.226.31.210:445
-
18.214.208.183:445
-
7.248.193.197:445
-
19.144.107.124:445
-
184.244.232.253:445
-
47.165.202.251:445
-
10.127.225.1:445
-
31.238.252.36:445
-
113.58.157.191:445
-
10.127.231.1:445
-
10.127.229.1:445
-
10.127.233.1:445
-
10.127.228.1:445
-
10.127.230.1:445
-
10.127.232.1:445
-
10.127.234.1:445
-
30.79.98.5:445
-
33.118.169.118:445
-
10.127.235.1:445
-
10.127.236.1:445
-
82.112.79.61:445 -
10.127.237.1:445
-
94.128.74.28:445 -
10.127.238.1:445
-
10.127.239.1:445
-
190.223.213.105:445 -
10.127.240.1:445
-
141.179.134.63:445
-
10.127.241.1:445
-
78.11.180.174:445 -
10.127.242.1:445
-
188.6.150.208:445 -
80.151.144.24:445
-
10.127.243.1:445
-
146.100.31.167:445
-
14.91.136.237:445
-
40.0.122.26:445
-
10.19.11.15:445
-
46.117.108.116:445 -
2.222.173.20:445
-
10.127.245.1:445
-
214.241.204.213:445
-
112.171.125.171:445
-
10.127.248.1:445
-
126.111.27.227:445
-
118.10.182.48:445
-
10.127.244.1:445
-
10.127.246.1:445
-
220.143.133.189:445
-
10.127.250.1:445
-
12.37.194.170:445
-
220.81.246.226:445
-
99.37.170.235:445
-
10.127.251.1:445
-
10.127.252.1:445
-
10.127.247.1:445
-
10.127.249.1:445
-
81.108.207.197:445
-
10.127.253.1:445
-
10.127.254.1:445
-
48.9.96.213:445
-
162.216.243.210:445
-
10.127.255.1:445
-
10.127.0.2:445
-
82.78.5.11:445 -
164.149.14.227:445
-
10.127.1.2:445
-
17.55.51.113:445
-
10.127.2.2:445
-
40.122.150.19:445
-
10.127.3.2:445
-
46.96.173.177:445 -
10.127.4.2:445
-
10.127.5.2:445
-
157.239.207.19:445
-
10.127.6.2:445
-
74.224.133.224:445
-
10.127.7.2:445
-
223.60.220.52:445
-
10.127.8.2:445
-
10.127.9.2:445
-
51.133.105.230:445
-
135.70.229.93:445
-
32.100.253.129:445
-
195.66.246.11:445
-
64.196.217.46:445
-
101.142.173.226:445
-
10.127.10.2:445
-
146.58.201.133:445
-
203.165.99.137:445
-
188.39.143.73:445
-
10.127.13.2:445
-
196.224.202.216:445 -
10.127.11.2:445
-
121.160.201.195:445
-
10.127.12.2:445
-
163.251.113.180:445
-
10.127.16.2:445
-
215.76.85.137:445
-
88.179.122.209:445
-
143.202.190.191:445
-
223.251.245.136:445
-
10.127.14.2:445
-
10.127.15.2:445
-
10.127.17.2:445
-
10.127.18.2:445
-
10.127.19.2:445
-
10.127.20.2:445
-
12.237.213.123:445
-
121.57.135.196:445
-
198.142.163.229:445 -
86.38.51.40:445 -
10.127.21.2:445
-
10.127.22.2:445
-
150.186.101.251:445 -
108.40.22.215:445
-
45.59.250.163:445
-
10.127.23.2:445
-
68.247.49.225:445
-
10.127.24.2:445
-
38.137.4.237:445
-
10.127.25.2:445
-
213.76.2.9:445
-
10.127.26.2:445
-
10.127.27.2:445
-
159.25.217.249:445
-
91.178.21.84:445 -
86.238.112.125:445
-
33.102.15.1:445
-
184.57.238.80:445
-
10.127.30.2:445
-
190.69.227.18:445 -
10.127.28.2:445
-
71.205.32.32:445
-
117.121.0.116:445
-
13.43.214.123:445
-
149.156.108.212:445
-
10.127.33.2:445
-
8.8.8.8:53www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comdns
DNS Request
www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
DNS Response
104.16.166.228104.16.167.228
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.4MB
MD5bff7a3cbcd7c2450553cdc3647d366fa
SHA19c6fec1111ab160eadc71e9b92538319bf1c038a
SHA256c4ee52f2ec9f934854b6b5ae8801d9fa45828881c98ded93c9d65fdc22ed6496
SHA512e29254b3cc7840f6a75d445ca943a880f51d357e08ee0f4ed24bac90296d7a3e28bc876ae644e7851bdec83397fb195f1366fefff3b6dc015a73b2d5fb7a70f9