Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
30-11-2024 13:10
General
-
Target
2024-11-30_c34e711c8ef95e0cbe76c9ad2604b55a_wannacry.exe
-
Size
5.0MB
-
MD5
c34e711c8ef95e0cbe76c9ad2604b55a
-
SHA1
a15fdcdac7a1de530dbc0889721f5ebf7d3b8bf6
-
SHA256
4101de3224b2eded5ff636c52c6908eb1f807112a9a97a5b4e7065d08ea21b7d
-
SHA512
d4c0522066e876ffde5bc72f6342bdf2e98f360756de640822b18b332f79785853d0986c015c3100ba3dc5dfb922b58d14dc13f2ff209d53ae7af95dbb4d2044
-
SSDEEP
24576:VbLgdelLgiHIIBA7Od057/hZWI86X6LBhiLeTLQD2ou:VnjNgmDQTujbwEK
Score
10/10
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Wannacry family
-
Contacts a large (3302) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in System32 directory 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies data under HKEY_USERS 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-30_c34e711c8ef95e0cbe76c9ad2604b55a_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-30_c34e711c8ef95e0cbe76c9ad2604b55a_wannacry.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2024-11-30_c34e711c8ef95e0cbe76c9ad2604b55a_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2024-11-30_c34e711c8ef95e0cbe76c9ad2604b55a_wannacry.exe -m security1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS