Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
14/11/2024, 09:04 UTC
General
-
Target
2024-11-14_0290f270994dde3502f7b78b0bcb6236_wannacry.exe
-
Size
3.6MB
-
MD5
0290f270994dde3502f7b78b0bcb6236
-
SHA1
b451248188ee6f475ed3dda00db928f4be710e29
-
SHA256
03dff98732bb5a21b31a2bb41a87960b7907aa8a91a178a64466e76411f49222
-
SHA512
c8cb8b1a1f57d78df79d419a8abfe38de9ff76953c060b034acf306013ebf00b3c363f61be614e0ca4e4bbf8fb590d3b65b6221db5ba9321269bef93c7d51df9
-
SSDEEP
12288:GvbLgPlu+QhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zU:2bLgddQhfdmMSirYbcMNgefU
Score
10/10
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Wannacry family
-
Contacts a large (3215) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 1 IoCs
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in System32 directory 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies data under HKEY_USERS 24 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-14_0290f270994dde3502f7b78b0bcb6236_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-14_0290f270994dde3502f7b78b0bcb6236_wannacry.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\2024-11-14_0290f270994dde3502f7b78b0bcb6236_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2024-11-14_0290f270994dde3502f7b78b0bcb6236_wannacry.exe -m security1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
Network
-
DNSwww.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comRemote address:8.8.8.8:53Requestwww.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comIN AResponsewww.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comIN A104.16.166.228www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comIN A104.16.167.228 -
GEThttp://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/Remote address:104.16.166.228:80RequestGET / HTTP/1.1
Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
Date: Thu, 14 Nov 2024 09:04:23 GMT
Content-Type: text/html
Content-Length: 607
Connection: close
Server: cloudflare
CF-RAY: 8e25d5723c79632e-LHR
-
GEThttp://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/Remote address:104.16.166.228:80RequestGET / HTTP/1.1
Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
Date: Thu, 14 Nov 2024 09:04:23 GMT
Content-Type: text/html
Content-Length: 607
Connection: close
Server: cloudflare
CF-RAY: 8e25d5742d32beb5-LHR
-
104.16.166.228:80http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/http
HTTP Request
GET http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/HTTP Response
200 -
104.16.166.228:80http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/http
HTTP Request
GET http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/HTTP Response
200 -
50.249.108.8:445
-
10.127.0.1:445 -
10.127.2.1:445
-
10.127.9.1:445
-
10.127.6.1:445
-
10.127.7.1:445
-
10.127.1.1:445
-
49.103.95.104:445 -
10.127.10.1:445
-
10.127.3.1:445
-
10.127.4.1:445
-
10.127.5.1:445
-
10.127.8.1:445
-
10.127.11.1:445
-
10.127.12.1:445
-
10.127.13.1:445
-
10.127.14.1:445
-
10.127.15.1:445
-
10.127.16.1:445
-
10.127.17.1:445
-
10.127.18.1:445
-
10.127.19.1:445
-
10.127.20.1:445
-
10.127.21.1:445
-
123.155.80.27:445 -
170.170.242.156:445
-
10.127.24.1:445
-
10.127.22.1:445
-
10.127.23.1:445
-
10.127.28.1:445
-
10.127.29.1:445
-
216.38.141.116:445
-
10.127.25.1:445
-
10.127.26.1:445
-
10.127.27.1:445
-
10.127.30.1:445
-
10.127.31.1:445
-
10.127.32.1:445
-
10.127.33.1:445
-
156.8.194.6:445 -
10.127.34.1:445
-
10.127.35.1:445
-
10.127.36.1:445
-
10.127.37.1:445
-
10.127.38.1:445
-
10.127.39.1:445
-
10.127.40.1:445
-
182.1.115.181:445 -
10.127.41.1:445
-
141.76.252.133:445 -
10.127.43.1:445
-
105.242.91.22:445
-
10.127.42.1:445
-
10.127.44.1:445
-
10.127.45.1:445
-
10.127.46.1:445
-
10.127.47.1:445
-
10.127.49.1:445
-
10.127.50.1:445
-
86.57.208.164:445 -
10.127.48.1:445
-
10.127.51.1:445
-
10.127.52.1:445
-
10.127.53.1:445
-
10.127.54.1:445
-
121.187.109.110:445 -
10.127.55.1:445
-
77.124.162.123:445 -
10.127.56.1:445
-
10.127.57.1:445
-
10.127.58.1:445
-
220.153.35.241:445
-
10.127.61.1:445
-
10.127.60.1:445
-
10.127.64.1:445
-
94.189.56.138:445 -
10.127.62.1:445
-
10.127.59.1:445
-
76.242.240.61:445
-
10.127.63.1:445
-
181.243.210.128:445 -
10.127.65.1:445
-
10.127.69.1:445
-
10.127.67.1:445
-
140.33.200.38:445
-
10.127.72.1:445
-
10.127.66.1:445
-
10.127.68.1:445
-
10.127.70.1:445
-
10.127.71.1:445
-
10.127.73.1:445
-
10.127.74.1:445
-
10.127.75.1:445
-
153.136.13.105:445
-
10.127.76.1:445
-
198.223.75.142:445
-
10.127.77.1:445
-
48.28.136.149:445
-
10.127.78.1:445
-
91.179.114.94:445 -
210.114.72.65:445 -
10.127.83.1:445
-
80.127.26.158:445 -
10.127.84.1:445
-
10.127.79.1:445
-
10.127.80.1:445
-
151.221.199.210:445
-
10.127.82.1:445
-
10.127.81.1:445
-
10.127.85.1:445
-
159.91.155.87:445
-
10.127.87.1:445
-
10.127.86.1:445
-
117.186.173.80:445
-
10.127.90.1:445
-
10.127.88.1:445
-
10.127.89.1:445
-
10.127.91.1:445
-
10.127.92.1:445
-
10.127.93.1:445
-
10.127.94.1:445
-
195.90.105.68:445 -
10.127.95.1:445
-
10.127.96.1:445
-
10.127.97.1:445
-
183.130.186.40:445
-
10.127.98.1:445
-
107.214.112.165:445
-
93.85.133.28:445
-
69.125.33.121:445
-
10.127.99.1:445
-
143.156.162.193:445
-
10.127.101.1:445
-
10.127.100.1:445
-
53.19.93.85:445
-
10.127.104.1:445
-
153.204.106.200:445
-
10.127.103.1:445
-
10.127.109.1:445
-
10.127.102.1:445
-
10.127.105.1:445
-
10.127.106.1:445
-
10.127.108.1:445
-
82.76.212.229:445 -
10.127.107.1:445
-
171.115.82.121:445
-
106.2.176.133:445
-
183.5.27.3:445
-
10.127.110.1:445
-
10.127.111.1:445
-
10.127.112.1:445
-
10.127.113.1:445
-
10.127.114.1:445
-
10.127.115.1:445
-
15.56.208.17:445
-
10.127.116.1:445
-
10.127.117.1:445
-
10.127.118.1:445
-
10.127.119.1:445
-
215.189.164.148:445
-
23.253.90.44:445
-
99.64.211.112:445
-
94.60.114.77:445 -
216.157.5.92:445
-
20.54.28.249:445 -
10.127.120.1:445
-
10.127.121.1:445
-
10.127.122.1:445
-
10.127.123.1:445
-
203.85.12.138:445 -
10.127.125.1:445
-
10.127.128.1:445
-
10.127.127.1:445
-
68.226.114.11:445
-
10.127.124.1:445
-
166.163.156.168:445
-
97.40.246.10:445
-
10.127.126.1:445
-
132.26.92.51:445
-
201.184.35.92:445
-
10.127.129.1:445
-
10.127.130.1:445
-
10.127.131.1:445
-
10.127.132.1:445
-
10.127.133.1:445
-
10.127.134.1:445
-
172.127.34.220:445
-
10.127.135.1:445
-
10.127.136.1:445
-
10.127.137.1:445
-
180.74.137.234:445 -
97.24.154.235:445
-
10.127.138.1:445
-
115.212.215.135:445
-
10.127.139.1:445
-
91.212.47.3:445 -
10.127.141.1:445
-
56.57.64.175:445
-
10.127.144.1:445
-
186.227.117.177:445 -
28.249.91.220:445
-
10.127.140.1:445
-
10.127.142.1:445
-
10.127.143.1:445
-
112.55.142.132:445
-
10.127.145.1:445
-
27.56.0.4:445 -
65.86.143.5:445
-
26.107.22.106:445
-
10.127.147.1:445
-
180.82.198.68:445
-
10.127.151.1:445
-
19.15.207.141:445
-
10.127.146.1:445
-
10.127.148.1:445
-
10.127.149.1:445
-
10.127.150.1:445
-
10.127.152.1:445
-
10.127.153.1:445
-
10.127.154.1:445
-
10.127.155.1:445
-
142.96.127.181:445 -
16.127.199.199:445
-
23.92.25.6:445
-
71.18.122.212:445
-
125.80.25.2:445
-
10.127.158.1:445
-
10.127.157.1:445
-
185.70.221.215:445
-
143.25.73.203:445
-
10.127.156.1:445
-
10.127.161.1:445
-
10.127.163.1:445
-
10.127.164.1:445
-
121.95.3.171:445
-
57.47.78.0:445 -
10.127.160.1:445
-
10.127.159.1:445
-
56.186.209.215:445 -
20.36.190.97:445
-
10.127.162.1:445
-
10.127.165.1:445
-
10.127.167.1:445
-
45.232.140.12:445
-
109.59.114.6:445
-
10.127.169.1:445
-
163.123.126.57:445
-
10.127.166.1:445
-
21.214.122.207:445
-
112.135.55.11:445 -
10.127.168.1:445
-
10.127.170.1:445
-
10.127.171.1:445
-
10.127.172.1:445
-
10.127.173.1:445
-
10.127.174.1:445
-
10.127.175.1:445
-
10.127.176.1:445
-
143.138.87.57:445
-
210.228.156.9:445
-
10.127.177.1:445
-
115.135.26.45:445
-
112.193.183.140:445
-
14.60.26.253:445
-
161.238.94.168:445 -
129.198.161.189:445
-
10.127.181.1:445
-
162.213.116.199:445
-
10.127.178.1:445
-
10.127.180.1:445
-
10.127.179.1:445
-
213.231.48.40:445 -
176.197.100.122:445
-
10.127.185.1:445
-
54.165.133.197:445
-
93.122.64.215:445
-
10.127.187.1:445
-
10.127.183.1:445
-
10.127.184.1:445
-
169.240.223.104:445
-
10.127.182.1:445
-
10.127.188.1:445
-
83.164.194.123:445 -
10.127.186.1:445
-
66.219.58.106:445
-
202.42.216.148:445
-
10.127.190.1:445
-
4.234.148.240:445 -
36.3.236.139:445
-
10.127.189.1:445
-
10.127.191.1:445
-
10.127.192.1:445
-
10.127.193.1:445
-
10.127.194.1:445
-
10.127.195.1:445
-
112.238.132.19:445
-
10.127.196.1:445
-
181.48.196.239:445
-
10.127.197.1:445
-
10.127.198.1:445
-
44.193.251.18:445
-
76.132.96.109:445
-
116.12.190.23:445 -
69.6.183.163:445
-
10.127.199.1:445
-
14.152.144.31:445
-
153.216.128.175:445
-
10.127.201.1:445
-
71.137.36.87:445
-
191.62.151.163:445
-
10.127.200.1:445
-
196.240.143.25:445
-
10.127.207.1:445
-
108.40.144.48:445
-
10.127.206.1:445
-
10.127.204.1:445
-
10.127.205.1:445
-
66.12.89.138:445
-
10.127.209.1:445
-
15.111.78.129:445
-
10.127.202.1:445
-
10.127.203.1:445
-
181.39.63.192:445 -
182.139.3.196:445
-
10.127.208.1:445
-
124.66.95.21:445
-
170.246.190.10:445
-
128.137.226.166:445
-
10.127.210.1:445
-
10.127.211.1:445
-
10.127.212.1:445
-
10.127.213.1:445
-
10.127.214.1:445
-
131.138.69.63:445
-
10.127.215.1:445
-
5.90.171.2:445 -
10.127.216.1:445
-
22.171.143.140:445
-
106.237.52.79:445
-
10.127.217.1:445
-
51.229.209.245:445
-
188.85.152.99:445 -
160.169.71.177:445 -
167.92.66.232:445
-
10.127.219.1:445
-
20.28.5.57:445
-
218.117.67.133:445
-
10.127.220.1:445
-
10.127.218.1:445
-
12.14.96.29:445
-
84.212.183.79:445 -
10.127.221.1:445
-
10.127.222.1:445
-
55.47.87.33:445
-
184.46.156.27:445
-
10.127.224.1:445
-
139.104.42.19:445
-
10.127.223.1:445
-
10.127.231.1:445
-
89.173.165.2:445 -
10.127.230.1:445
-
196.195.138.191:445 -
135.224.48.12:445
-
10.127.227.1:445
-
10.127.225.1:445
-
104.75.5.208:445
-
178.218.136.56:445
-
132.97.16.135:445
-
10.127.229.1:445
-
10.127.233.1:445
-
10.127.226.1:445
-
10.127.228.1:445
-
169.11.173.127:445
-
10.127.232.1:445
-
59.32.221.97:445
-
10.127.234.1:445
-
201.26.92.18:445
-
58.244.117.57:445
-
10.127.237.1:445
-
10.127.236.1:445
-
7.60.33.84:445
-
157.34.142.202:445
-
76.21.136.253:445
-
10.127.235.1:445
-
54.75.25.122:445
-
10.127.240.1:445
-
117.192.30.136:445
-
10.127.239.1:445
-
69.47.170.235:445
-
45.241.108.187:445 -
99.8.51.11:445
-
19.102.63.157:445
-
10.127.238.1:445
-
96.210.121.131:445
-
10.127.241.1:445
-
49.179.43.10:445
-
10.127.242.1:445
-
10.127.244.1:445
-
203.117.76.242:445
-
13.33.60.7:445
-
10.127.243.1:445
-
10.127.247.1:445
-
10.127.245.1:445
-
7.67.58.101:445
-
179.149.145.11:445
-
149.120.54.69:445
-
10.127.246.1:445
-
10.127.250.1:445
-
10.127.253.1:445
-
131.244.55.125:445
-
196.160.91.33:445
-
103.105.95.165:445
-
10.127.248.1:445
-
10.127.252.1:445
-
132.231.237.167:445
-
10.127.251.1:445
-
10.127.249.1:445
-
10.127.254.1:445
-
10.127.255.1:445
-
80.32.99.32:445
-
9.53.42.104:445
-
157.162.29.188:445
-
49.188.40.47:445
-
201.92.84.8:445
-
101.126.17.221:445
-
51.81.83.178:445
-
10.127.0.2:445
-
10.127.3.2:445
-
132.214.223.71:445
-
118.202.47.134:445
-
48.13.108.250:445
-
10.127.5.2:445
-
10.127.6.2:445
-
48.15.210.124:445
-
10.127.1.2:445
-
36.173.80.97:445
-
10.127.7.2:445
-
106.117.131.25:445
-
43.84.84.54:445
-
178.80.63.106:445 -
10.127.4.2:445
-
147.36.91.124:445
-
10.127.2.2:445
-
10.127.8.2:445
-
130.216.225.109:445 -
34.183.112.156:445
-
10.127.9.2:445
-
175.134.16.23:445
-
112.33.127.47:445
-
10.127.10.2:445
-
79.82.70.27:445 -
190.141.254.241:445 -
10.127.11.2:445
-
10.127.13.2:445
-
96.164.152.2:445
-
33.234.175.37:445
-
10.127.17.2:445
-
10.127.15.2:445
-
14.104.235.157:445
-
90.40.98.201:445
-
10.127.12.2:445
-
10.127.14.2:445
-
10.127.16.2:445
-
10.127.18.2:445
-
10.127.19.2:445
-
10.127.20.2:445
-
10.127.21.2:445
-
15.9.103.52:445
-
77.42.21.41:445 -
98.140.224.167:445
-
119.130.204.126:445
-
195.207.153.195:445
-
47.38.253.189:445
-
139.131.101.90:445
-
81.43.95.85:445
-
172.156.49.224:445
-
10.127.24.2:445
-
72.127.117.26:445
-
132.129.219.116:445
-
64.158.90.143:445
-
10.127.26.2:445
-
10.127.25.2:445
-
44.141.196.228:445
-
10.127.23.2:445
-
111.128.130.92:445
-
10.127.22.2:445
-
162.238.2.180:445
-
10.127.30.2:445
-
29.200.88.93:445
-
195.155.154.101:445 -
10.127.28.2:445
-
154.214.163.196:445
-
116.190.225.101:445
-
38.37.104.128:445
-
10.127.27.2:445
-
132.203.228.229:445
-
10.127.29.2:445
-
8.8.8.8:53www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comdns
DNS Request
www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
DNS Response
104.16.166.228104.16.167.228
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.4MB
MD5bff7a3cbcd7c2450553cdc3647d366fa
SHA19c6fec1111ab160eadc71e9b92538319bf1c038a
SHA256c4ee52f2ec9f934854b6b5ae8801d9fa45828881c98ded93c9d65fdc22ed6496
SHA512e29254b3cc7840f6a75d445ca943a880f51d357e08ee0f4ed24bac90296d7a3e28bc876ae644e7851bdec83397fb195f1366fefff3b6dc015a73b2d5fb7a70f9