Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
04/12/2024, 10:52 UTC
General
-
Target
2024-12-04_d860b5d7abca8ac7151d795486c8e477_wannacry.exe
-
Size
5.0MB
-
MD5
d860b5d7abca8ac7151d795486c8e477
-
SHA1
7697b47e9714f2f4c20d3659c463da46f9710915
-
SHA256
8f3a7bc2022ba3865ee97ea1610cddab7a7774e0b4e20db7b5cf652030f2faa6
-
SHA512
4173435039084304589e064c37ff639a8934ac5698b3748b3fe3c0e82c7ee14879d83e7a2b7b7833bb805a77eb7e7d37bca15b2e6f451c77e2dae803a3c280b7
-
SSDEEP
98304:mDqPoBhz1aRxcSUDk36SAEdhvxWa9P59Uc/J:mDqPe1Cxcxk3ZAEUadv
Score
10/10
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Wannacry family
-
Contacts a large (3236) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 1 IoCs
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in System32 directory 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies data under HKEY_USERS 24 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-04_d860b5d7abca8ac7151d795486c8e477_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-04_d860b5d7abca8ac7151d795486c8e477_wannacry.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\2024-12-04_d860b5d7abca8ac7151d795486c8e477_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2024-12-04_d860b5d7abca8ac7151d795486c8e477_wannacry.exe -m security1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
Network
-
DNSwww.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comRemote address:8.8.8.8:53Requestwww.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comIN AResponsewww.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comIN A104.16.166.228www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comIN A104.16.167.228 -
GEThttp://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/Remote address:104.16.166.228:80RequestGET / HTTP/1.1
Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
Date: Wed, 04 Dec 2024 10:52:48 GMT
Content-Type: text/html
Content-Length: 607
Connection: close
Server: cloudflare
CF-RAY: 8ecb3fc5cf92ef15-LHR
-
GEThttp://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/Remote address:104.16.166.228:80RequestGET / HTTP/1.1
Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
Date: Wed, 04 Dec 2024 10:52:49 GMT
Content-Type: text/html
Content-Length: 607
Connection: close
Server: cloudflare
CF-RAY: 8ecb3fc70aeb93da-LHR
-
104.16.166.228:80http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/http
HTTP Request
GET http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/HTTP Response
200 -
104.16.166.228:80http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/http
HTTP Request
GET http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/HTTP Response
200 -
215.103.120.191:445
-
10.127.0.1:445 -
10.127.1.1:445
-
10.127.2.1:445
-
10.127.3.1:445
-
10.127.4.1:445
-
10.127.5.1:445
-
10.127.6.1:445
-
10.127.7.1:445
-
10.127.8.1:445
-
10.127.9.1:445
-
10.127.10.1:445
-
10.127.11.1:445
-
144.200.180.198:445 -
146.122.173.253:445
-
179.56.146.94:445 -
10.127.12.1:445
-
10.127.13.1:445
-
10.127.14.1:445
-
10.127.15.1:445
-
10.127.16.1:445
-
10.127.17.1:445
-
10.127.18.1:445
-
10.127.19.1:445
-
10.127.20.1:445
-
10.127.21.1:445
-
10.127.22.1:445
-
10.127.23.1:445
-
10.127.24.1:445
-
10.127.25.1:445
-
10.127.26.1:445
-
10.127.27.1:445
-
10.127.28.1:445
-
10.127.29.1:445
-
10.127.30.1:445
-
10.127.31.1:445
-
91.6.150.73:445 -
54.179.204.99:445 -
130.42.212.214:445
-
58.68.17.50:445 -
10.127.32.1:445
-
10.127.33.1:445
-
10.127.34.1:445
-
10.127.35.1:445
-
10.127.36.1:445
-
10.127.37.1:445
-
10.127.38.1:445
-
10.127.39.1:445
-
10.127.40.1:445
-
10.127.41.1:445
-
10.127.42.1:445
-
10.127.43.1:445
-
10.127.44.1:445
-
62.19.46.211:445 -
10.127.45.1:445
-
10.127.46.1:445
-
10.127.47.1:445
-
10.127.48.1:445
-
10.127.49.1:445
-
114.125.115.15:445 -
214.205.204.76:445
-
93.29.136.245:445 -
169.99.218.32:445
-
10.127.50.1:445
-
173.88.161.212:445
-
10.127.51.1:445
-
10.127.52.1:445
-
10.127.53.1:445
-
10.127.54.1:445
-
10.127.55.1:445
-
10.127.56.1:445
-
10.127.57.1:445
-
10.127.58.1:445
-
10.127.59.1:445
-
10.127.60.1:445
-
10.127.61.1:445
-
10.127.62.1:445
-
10.127.63.1:445
-
10.127.64.1:445
-
10.127.65.1:445
-
55.38.160.92:445
-
10.127.66.1:445
-
130.88.211.63:445 -
10.127.67.1:445
-
197.213.52.88:445 -
92.71.141.102:445
-
133.191.10.185:445 -
122.79.150.203:445 -
7.176.109.83:445
-
10.127.68.1:445
-
54.137.220.64:445
-
10.127.69.1:445
-
10.127.70.1:445
-
10.127.71.1:445
-
10.127.72.1:445
-
10.127.73.1:445
-
10.127.74.1:445
-
10.127.75.1:445
-
10.127.76.1:445
-
10.127.77.1:445
-
10.127.78.1:445
-
10.127.79.1:445
-
10.127.80.1:445
-
10.127.81.1:445
-
10.127.82.1:445
-
10.127.83.1:445
-
60.76.134.199:445
-
10.127.84.1:445
-
10.127.85.1:445
-
10.127.86.1:445
-
10.127.87.1:445
-
169.217.30.253:445 -
10.127.88.1:445
-
108.123.162.205:445
-
10.127.89.1:445
-
121.8.93.79:445
-
40.195.183.169:445
-
220.15.157.100:445
-
78.29.254.101:445 -
118.227.239.183:445
-
174.206.211.49:445
-
18.22.83.16:445
-
161.138.153.86:445 -
10.127.90.1:445
-
10.127.91.1:445
-
10.127.92.1:445
-
10.127.93.1:445
-
10.127.94.1:445
-
10.127.95.1:445
-
10.127.96.1:445
-
10.127.97.1:445
-
10.127.98.1:445
-
10.127.99.1:445
-
10.127.100.1:445
-
10.127.101.1:445
-
10.127.102.1:445
-
10.127.103.1:445
-
10.127.104.1:445
-
10.127.105.1:445
-
10.127.106.1:445
-
77.28.249.212:445 -
10.127.107.1:445
-
10.127.108.1:445
-
10.127.109.1:445
-
5.89.133.206:445 -
10.127.110.1:445
-
55.72.166.233:445
-
204.34.16.79:445
-
131.197.201.139:445
-
193.107.44.13:445 -
179.221.205.251:445 -
82.244.106.163:445
-
82.69.178.103:445
-
45.117.76.108:445 -
114.246.178.132:445
-
4.145.123.247:445
-
10.127.111.1:445
-
10.127.112.1:445
-
10.127.113.1:445
-
10.127.114.1:445
-
10.127.115.1:445
-
10.127.116.1:445
-
10.127.117.1:445
-
10.127.118.1:445
-
10.127.119.1:445
-
10.127.120.1:445
-
10.127.121.1:445
-
10.127.122.1:445
-
10.127.123.1:445
-
10.127.124.1:445
-
115.57.40.201:445
-
10.127.125.1:445
-
10.127.126.1:445
-
10.127.127.1:445
-
47.7.65.239:445
-
10.127.128.1:445
-
10.127.129.1:445
-
168.242.146.188:445
-
68.132.172.164:445
-
32.117.39.7:445
-
173.178.246.183:445 -
48.160.43.23:445
-
135.93.154.250:445
-
192.16.239.88:445
-
63.152.190.198:445
-
43.50.106.135:445
-
151.96.142.38:445
-
64.209.210.215:445
-
131.114.14.112:445
-
10.127.130.1:445
-
10.127.131.1:445
-
10.127.132.1:445
-
10.127.133.1:445
-
10.127.134.1:445
-
10.127.135.1:445
-
10.127.136.1:445
-
10.127.137.1:445
-
10.127.138.1:445
-
10.127.139.1:445
-
10.127.140.1:445
-
10.127.141.1:445
-
10.127.142.1:445
-
10.127.143.1:445
-
10.127.144.1:445
-
92.164.160.106:445
-
10.127.145.1:445
-
10.127.146.1:445
-
12.109.225.59:445
-
10.127.147.1:445
-
221.23.82.206:445
-
6.137.224.162:445
-
71.229.43.54:445
-
103.211.25.15:445 -
193.180.199.61:445 -
53.229.68.115:445
-
133.33.154.208:445
-
10.99.199.224:445
-
95.4.239.199:445 -
88.227.113.125:445
-
80.130.38.56:445
-
195.246.191.17:445
-
120.58.145.52:445
-
10.127.148.1:445
-
10.127.149.1:445
-
10.127.150.1:445
-
10.127.151.1:445
-
10.127.152.1:445
-
10.127.153.1:445
-
10.127.154.1:445
-
10.127.155.1:445
-
10.127.156.1:445
-
10.127.157.1:445
-
10.127.158.1:445
-
10.127.159.1:445
-
10.127.160.1:445
-
10.127.161.1:445
-
10.127.162.1:445
-
10.127.163.1:445
-
10.127.164.1:445
-
10.127.165.1:445
-
113.129.202.96:445
-
10.127.166.1:445
-
131.174.236.229:445
-
46.142.220.232:445
-
220.20.145.160:445
-
48.34.27.227:445
-
111.208.204.240:445
-
222.213.172.141:445
-
180.209.111.215:445
-
31.62.72.108:445 -
95.154.117.228:445 -
40.192.229.71:445
-
142.15.122.123:445
-
209.4.105.89:445
-
204.125.211.67:445
-
119.157.161.134:445 -
65.154.203.140:445
-
39.169.91.1:445
-
10.127.167.1:445
-
10.127.168.1:445
-
10.127.169.1:445
-
10.127.170.1:445
-
10.127.171.1:445
-
10.127.172.1:445
-
10.127.173.1:445
-
10.127.174.1:445
-
10.127.175.1:445
-
10.127.176.1:445
-
10.127.177.1:445
-
10.127.178.1:445
-
10.127.179.1:445
-
10.127.180.1:445
-
10.127.181.1:445
-
10.127.182.1:445
-
10.127.183.1:445
-
10.127.184.1:445
-
10.127.185.1:445
-
204.217.89.169:445
-
10.127.186.1:445
-
106.168.132.3:445
-
10.127.187.1:445
-
169.16.59.45:445
-
10.127.188.1:445
-
173.246.39.54:445
-
190.148.54.114:445 -
123.128.73.46:445
-
124.177.211.175:445 -
65.214.4.49:445
-
117.197.117.197:445
-
53.92.240.119:445
-
121.125.204.226:445
-
134.172.202.94:445
-
142.178.46.165:445
-
178.109.229.129:445
-
122.45.85.169:445
-
115.85.90.142:445
-
37.159.146.59:445
-
196.252.210.48:445 -
89.129.217.136:445 -
10.127.189.1:445
-
10.127.190.1:445
-
10.127.191.1:445
-
10.127.192.1:445
-
10.127.193.1:445
-
10.127.194.1:445
-
10.127.195.1:445
-
10.127.196.1:445
-
10.127.197.1:445
-
10.127.198.1:445
-
10.127.199.1:445
-
10.127.200.1:445
-
10.127.201.1:445
-
10.127.202.1:445
-
10.127.203.1:445
-
10.127.204.1:445
-
163.22.199.149:445 -
88.164.166.131:445
-
10.127.205.1:445
-
10.127.206.1:445
-
10.127.207.1:445
-
41.181.35.223:445
-
10.127.208.1:445
-
100.251.22.10:445 -
168.131.230.4:445
-
129.202.57.108:445
-
146.6.51.246:445
-
108.238.77.8:445
-
15.37.10.8:445
-
19.139.21.81:445
-
35.62.49.12:445
-
66.186.227.129:445
-
211.75.51.177:445
-
34.177.253.124:445
-
78.42.17.247:445
-
42.5.143.152:445
-
48.227.173.127:445
-
34.163.171.167:445
-
167.162.123.178:445
-
26.245.57.182:445
-
74.150.193.245:445
-
10.127.209.1:445
-
10.127.210.1:445
-
10.127.211.1:445
-
10.127.212.1:445
-
10.127.213.1:445
-
10.127.214.1:445
-
10.127.215.1:445
-
10.127.216.1:445
-
10.127.217.1:445
-
10.127.218.1:445
-
10.127.219.1:445
-
10.127.220.1:445
-
10.127.221.1:445
-
10.127.222.1:445
-
10.127.223.1:445
-
81.193.148.230:445 -
214.218.35.61:445
-
10.127.224.1:445
-
10.127.225.1:445
-
10.127.226.1:445
-
14.135.184.177:445
-
73.109.137.209:445
-
190.188.245.129:445 -
29.154.109.94:445
-
181.208.144.55:445 -
63.112.35.12:445
-
44.82.20.81:445
-
1.7.152.228:445
-
80.221.53.196:445 -
112.185.166.55:445
-
214.253.131.199:445
-
16.46.217.5:445
-
123.117.171.223:445
-
190.216.3.71:445
-
82.77.238.195:445 -
58.183.177.180:445
-
109.37.200.197:445
-
49.230.153.215:445 -
158.141.184.217:445
-
157.172.186.227:445
-
11.141.34.123:445
-
56.15.236.194:445
-
10.127.227.1:445
-
10.127.228.1:445
-
10.127.229.1:445
-
10.127.230.1:445
-
10.127.231.1:445
-
10.127.232.1:445
-
10.127.233.1:445
-
10.127.234.1:445
-
10.127.235.1:445
-
10.127.236.1:445
-
10.127.237.1:445
-
10.127.238.1:445
-
10.127.239.1:445
-
10.127.240.1:445
-
10.127.241.1:445
-
10.127.242.1:445
-
10.127.243.1:445
-
60.127.251.193:445
-
10.127.244.1:445
-
10.127.245.1:445
-
19.38.150.4:445
-
206.1.50.106:445
-
63.94.29.197:445
-
204.64.112.47:445
-
38.171.220.128:445
-
217.62.44.201:445
-
33.152.26.21:445
-
129.158.60.33:445
-
55.103.103.151:445
-
49.26.178.10:445
-
88.32.205.179:445
-
34.233.172.1:445
-
58.216.212.116:445
-
109.203.227.44:445 -
222.28.165.30:445
-
149.137.129.120:445
-
65.231.151.171:445
-
215.84.27.247:445
-
109.236.51.117:445
-
77.7.213.178:445
-
74.140.121.118:445
-
218.68.26.250:445
-
71.174.184.229:445
-
64.81.30.163:445
-
10.127.246.1:445
-
10.127.247.1:445
-
10.127.248.1:445
-
10.127.249.1:445
-
10.127.250.1:445
-
10.127.251.1:445
-
10.127.252.1:445
-
10.127.253.1:445
-
10.127.254.1:445
-
10.127.255.1:445
-
10.127.0.2:445
-
10.127.1.2:445
-
10.127.2.2:445
-
10.127.3.2:445
-
10.127.4.2:445
-
10.127.5.2:445
-
10.127.6.2:445
-
10.127.7.2:445
-
10.127.8.2:445
-
10.127.9.2:445
-
54.229.56.180:445 -
90.102.108.54:445
-
48.136.192.40:445
-
179.55.74.100:445
-
111.102.175.39:445
-
54.184.49.22:445
-
149.105.143.36:445
-
144.207.226.92:445
-
94.214.249.3:445
-
62.102.228.175:445
-
100.154.179.246:445
-
179.223.117.55:445
-
158.122.121.63:445
-
78.38.77.248:445
-
100.109.33.45:445
-
47.205.206.58:445
-
143.117.96.57:445
-
170.228.181.196:445
-
99.35.111.115:445
-
169.195.87.152:445
-
10.169.26.67:445
-
93.158.119.88:445
-
66.37.195.125:445
-
100.205.65.50:445
-
25.251.161.151:445
-
220.223.121.220:445
-
138.66.41.135:445
-
10.127.10.2:445
-
10.127.11.2:445
-
10.127.12.2:445
-
10.127.13.2:445
-
10.127.14.2:445
-
10.127.15.2:445
-
10.127.16.2:445
-
10.127.17.2:445
-
10.127.18.2:445
-
10.127.19.2:445
-
10.127.20.2:445
-
10.127.21.2:445
-
10.127.22.2:445
-
10.127.23.2:445
-
10.127.24.2:445
-
10.127.25.2:445
-
10.127.26.2:445
-
10.127.27.2:445
-
10.127.28.2:445
-
10.127.29.2:445
-
10.127.30.2:445
-
10.127.31.2:445
-
46.202.158.73:445 -
77.188.113.62:445
-
8.8.8.8:53www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comdns
DNS Request
www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
DNS Response
104.16.166.228104.16.167.228
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.4MB
MD572a0273e5bdad2089ab90020265fcbce
SHA14a64856c9b86cc9f74fc6e74524d3cb09c3668a4
SHA25645dc98a814d1bfd4ba7790b607da53678df7c99e3e1747f7ad4f56899e3805e4
SHA512e02a324565dee584ba64e47936c5ab6a70d0c00e69e9767bf82d8c8195771a8270699f72ad0d64a490d22b0be32b54ce04c3df973baa8e8b65434781e848eb02
-
Filesize
6.4MB
-
Filesize
6.4MB
-
Filesize
6.4MB
-
Filesize
6.4MB