wannacry | 0d0bf4d811fe2c11092f28733400b4fa02357bd2365d3f6a56df8290f87b3951

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15-12-2024 12:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-12-15_b98d8a3ef4481009debc98cd967df784_wannacry.exe
Size

5.0MB
MD5

b98d8a3ef4481009debc98cd967df784
SHA1

08f600f142b80f1057cf4b2ce9c26dfee4a53b5e
SHA256

0d0bf4d811fe2c11092f28733400b4fa02357bd2365d3f6a56df8290f87b3951
SHA512

d55821a49e478ead91391220d8df6bf2efe182ff7ddd7d3276087c55dbfa214a707ccf0bee1c1534871ddfec8ebb7b383b82a0d52f59ebc7278d23aa006b35cb
SSDEEP

6144:GE9l9yUqIYVTH5DgSg8ajldktM0XXrP2QhMV9qbBLIwYQ:GvbLgPlu+QhMbaIM

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Wannacry family
wannacry
Contacts a large (3209) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 1 IoCs

pid	Process
5032	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	2024-12-15_b98d8a3ef4481009debc98cd967df784_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-12-15_b98d8a3ef4481009debc98cd967df784_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-12-15_b98d8a3ef4481009debc98cd967df784_wannacry.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	2024-12-15_b98d8a3ef4481009debc98cd967df784_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	2024-12-15_b98d8a3ef4481009debc98cd967df784_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	2024-12-15_b98d8a3ef4481009debc98cd967df784_wannacry.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	2024-12-15_b98d8a3ef4481009debc98cd967df784_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	2024-12-15_b98d8a3ef4481009debc98cd967df784_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2024-12-15_b98d8a3ef4481009debc98cd967df784_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2024-12-15_b98d8a3ef4481009debc98cd967df784_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1100
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:5032

C:\Users\Admin\AppData\Local\Temp\2024-12-15_b98d8a3ef4481009debc98cd967df784_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2024-12-15_b98d8a3ef4481009debc98cd967df784_wannacry.exe -m security
1⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
d951b28dd0e7efa3a4420a2e9d520776

SHA1
7c700e60fc5cbe4325a58da6154018b2839c28f3

SHA256
d1c357e675f2aad8aae4d697602f8b83d9c862ddfe301e7834f0597d8dc7869c

SHA512
51ccdbd347ec66f3808acf83147315ea77cb1af9e6d1d7dd0df3dce334b932ad1e02b1bf09868de89729d909400e5ce84675ce6b62a3f30a133f3b59df95df2d

Download Submit