wannacry | a35f1fb45698be16df064f19fd9094468a40dd902383f2474525725c3f43a1bc

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-11-2024 17:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-11-12_87cf62485bb1d738392084638b830933_wannacry.exe
Size

5.0MB
MD5

87cf62485bb1d738392084638b830933
SHA1

9f3e565bd3f8c4e9d086b8969eb986b71d501b6a
SHA256

a35f1fb45698be16df064f19fd9094468a40dd902383f2474525725c3f43a1bc
SHA512

8dd0670ae5a45399c72bc788610e43a8d5d1c0910b73c57f098e2df8538de8db635cfbeab7aaaf245df44c692cd1d98007328b63e83db8650bc3157ec36a8f43
SSDEEP

24576:2bLgddQhfdmMSirYbcMNgef0ZqziNQtXX0o0PDCugrAHGO:2nAQqMSPbcBVZLNQtHX0PDCugrAHGO

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Wannacry family
wannacry
Contacts a large (3258) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 1 IoCs

pid	Process
1612	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	2024-11-12_87cf62485bb1d738392084638b830933_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-11-12_87cf62485bb1d738392084638b830933_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-11-12_87cf62485bb1d738392084638b830933_wannacry.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	2024-11-12_87cf62485bb1d738392084638b830933_wannacry.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	2024-11-12_87cf62485bb1d738392084638b830933_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	2024-11-12_87cf62485bb1d738392084638b830933_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	2024-11-12_87cf62485bb1d738392084638b830933_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	2024-11-12_87cf62485bb1d738392084638b830933_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2024-11-12_87cf62485bb1d738392084638b830933_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-12_87cf62485bb1d738392084638b830933_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4112
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:1612

C:\Users\Admin\AppData\Local\Temp\2024-11-12_87cf62485bb1d738392084638b830933_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2024-11-12_87cf62485bb1d738392084638b830933_wannacry.exe -m security
1⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
ff420439145fdee4045e51d079d276b1

SHA1
6eaa685ad83a9fb6b64c6d342d0d937322358a8a

SHA256
b47913688df44fc915081a1532afbc89974e6c54e9d0e13559e7e6717765a35c

SHA512
ff783df9ae0f2d49f84e422d9aafe0f3c5e27994fd3fb94a0ba40d728bd7b9ed4f73e6e0e5f09a720932fc997c2bdfc481d83003773eb28d34d402f6ed2b1e25

Download Submit