wannacry | 971f763939910cc04c170936ad2467e592678a301997aa80adde2e94040afe28

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2024 13:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-11-26_111499d873815c3d6face3a8480f286d_wannacry.exe
Size

3.6MB
MD5

111499d873815c3d6face3a8480f286d
SHA1

6a05bfc9806784884ca6c260bbdb5785fca2762d
SHA256

971f763939910cc04c170936ad2467e592678a301997aa80adde2e94040afe28
SHA512

e7ba9fa467498e8db5df1c03f315bbbfbea1429268778ac792346bd5e050bfe1db310ccab887a78d162831b885c3a1c3e67a5bd16b300a9aaacd1edd41cf83fd
SSDEEP

49152:XnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo69I:XDqPoBhz1aRxcSUDk369I

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Wannacry family
wannacry
Contacts a large (3320) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 1 IoCs

pid	Process
2872	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	2024-11-26_111499d873815c3d6face3a8480f286d_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-11-26_111499d873815c3d6face3a8480f286d_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-11-26_111499d873815c3d6face3a8480f286d_wannacry.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	2024-11-26_111499d873815c3d6face3a8480f286d_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	2024-11-26_111499d873815c3d6face3a8480f286d_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	2024-11-26_111499d873815c3d6face3a8480f286d_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	2024-11-26_111499d873815c3d6face3a8480f286d_wannacry.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	2024-11-26_111499d873815c3d6face3a8480f286d_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2024-11-26_111499d873815c3d6face3a8480f286d_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-26_111499d873815c3d6face3a8480f286d_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3944
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:2872

C:\Users\Admin\AppData\Local\Temp\2024-11-26_111499d873815c3d6face3a8480f286d_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2024-11-26_111499d873815c3d6face3a8480f286d_wannacry.exe -m security
1⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
b71a10d0e3f3255cdce7903784d380a7

SHA1
46ac26d48c204458cca61147fbfb356b8b468a8e

SHA256
571305f8160f8b4bf8063845763578794f215e3c525b198881d0e38e2f70e89c

SHA512
23204156ce4afd6b5ec24a906c7c9ed88c23a1483b089f7d0151be731105079f84d22a46a5912359d096afa8e9dc90a778d50025ba83b8714ad91f0ffaaa8017

Download Submit