wannacry | 87f659fb0e0958e9cd80195fecda5a7c7a5592a78dc473d07b00ffad6acc7599

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-12-2024 10:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-12-11_60adb46853cd0e9c497eacb0fb66bd41_wannacry.exe
Size

5.0MB
MD5

60adb46853cd0e9c497eacb0fb66bd41
SHA1

e13e7617c6a5ffdf382908a743ac2dbab2b82573
SHA256

87f659fb0e0958e9cd80195fecda5a7c7a5592a78dc473d07b00ffad6acc7599
SHA512

0f1dad701111c35b9604ee4c431b4b2dbd8667ad813f9b77a268c66fa53af08129077586ba9a44f72243c66ff18c6d3875e605ae23447a5d169ea2c2baba96af
SSDEEP

49152:XnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6S:XDqPoBhz1aRxcSUDk36S

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Wannacry family
wannacry
Contacts a large (3248) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 1 IoCs

pid	Process
4840	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	2024-12-11_60adb46853cd0e9c497eacb0fb66bd41_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-12-11_60adb46853cd0e9c497eacb0fb66bd41_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-12-11_60adb46853cd0e9c497eacb0fb66bd41_wannacry.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	2024-12-11_60adb46853cd0e9c497eacb0fb66bd41_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	2024-12-11_60adb46853cd0e9c497eacb0fb66bd41_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	2024-12-11_60adb46853cd0e9c497eacb0fb66bd41_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	2024-12-11_60adb46853cd0e9c497eacb0fb66bd41_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	2024-12-11_60adb46853cd0e9c497eacb0fb66bd41_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2024-12-11_60adb46853cd0e9c497eacb0fb66bd41_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2024-12-11_60adb46853cd0e9c497eacb0fb66bd41_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2496
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:4840

C:\Users\Admin\AppData\Local\Temp\2024-12-11_60adb46853cd0e9c497eacb0fb66bd41_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2024-12-11_60adb46853cd0e9c497eacb0fb66bd41_wannacry.exe -m security
1⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
113be9e3062d9bf016c70f809f1e26f8

SHA1
1efb235af1adaefdd1c45fcc8ed6a33427e7a431

SHA256
3bf39520acf3452a5446d64c84cbd2982031f71fb185f66ac3e126555448a083

SHA512
4f466b4f82ee605308c0645432a9e35e66cfb5ee8f2d0e16d9c541f4a534b140f815ccb3d329a632c450a3261c0cf690579bae0c1b994d7025ecd8dadc176833

Download Submit