wannacry | b4402b78fa66985c0d39adbcb925826374c1f5f5b435eca4adc5183f38aaea33

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-12-2024 10:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-12-07_4c6473e47348405899f76a0151b8957d_wannacry.exe
Size

5.0MB
MD5

4c6473e47348405899f76a0151b8957d
SHA1

0b8b8abe11769e60e682406e55c9b31a44a94dd7
SHA256

b4402b78fa66985c0d39adbcb925826374c1f5f5b435eca4adc5183f38aaea33
SHA512

42a048607f4264029ea4e78130862067b202dc751f2f88f3c732796faab090ebfed0b851199db53fe471aea2050cc1ff47152781bf4e0d9a2429160115d82bff
SSDEEP

98304:yDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2:yDqPe1Cxcxk3ZAEUadzR8yc4

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Wannacry family
wannacry
Contacts a large (3283) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 1 IoCs

pid	Process
1764	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	2024-12-07_4c6473e47348405899f76a0151b8957d_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-12-07_4c6473e47348405899f76a0151b8957d_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-12-07_4c6473e47348405899f76a0151b8957d_wannacry.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	2024-12-07_4c6473e47348405899f76a0151b8957d_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	2024-12-07_4c6473e47348405899f76a0151b8957d_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	2024-12-07_4c6473e47348405899f76a0151b8957d_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	2024-12-07_4c6473e47348405899f76a0151b8957d_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	2024-12-07_4c6473e47348405899f76a0151b8957d_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2024-12-07_4c6473e47348405899f76a0151b8957d_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2024-12-07_4c6473e47348405899f76a0151b8957d_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3816
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:1764

C:\Users\Admin\AppData\Local\Temp\2024-12-07_4c6473e47348405899f76a0151b8957d_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2024-12-07_4c6473e47348405899f76a0151b8957d_wannacry.exe -m security
1⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
16cf4ff41c9fd0e30aa6afb7ee6c5f1c

SHA1
f388b94b8624db2f08b370a30d6564cb866ee826

SHA256
9c3d2923e7fbaeefe6987714217148e8f23fc0bd8c049e3690fbe0d940de27ac

SHA512
2d5a4be22c5ddf5051cfaf8e5871a1d5eea675749ecd8c3e32ec7dc7935d4e788fa51ac5c962df967424bdd845c8543a992e656ea6a40c137ea0944a38aabb14

Download Submit