wannacry | 6c572b6aff7c9f052e68de8d725857884df43849171790022602bd218c4dbcb4

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15-12-2024 11:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-12-15_b810a574d573a1f0a65548226326287e_wannacry.exe
Size

5.0MB
MD5

b810a574d573a1f0a65548226326287e
SHA1

6949560b42ee9ea1798724e97a9c7e13554db5ae
SHA256

6c572b6aff7c9f052e68de8d725857884df43849171790022602bd218c4dbcb4
SHA512

5e51acc3bb3ecb0d19ae83d855e3f2e933e32faa63e7fd40f643b6a66d1d91157766ee6efb9ad2b2e3e494634bc44af32fef80128c17ad7286f564de56da663d
SSDEEP

49152:2nAQqMSPbcBVQej/1INRx+TSqTdd1HkQo6SAARdhnvxJM0H9:yDqPoBhz1aRxcSUZk36SAEdhvxWa9

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Wannacry family
wannacry
Contacts a large (3327) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 1 IoCs

pid	Process
4504	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	2024-12-15_b810a574d573a1f0a65548226326287e_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-12-15_b810a574d573a1f0a65548226326287e_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-12-15_b810a574d573a1f0a65548226326287e_wannacry.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	2024-12-15_b810a574d573a1f0a65548226326287e_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	2024-12-15_b810a574d573a1f0a65548226326287e_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	2024-12-15_b810a574d573a1f0a65548226326287e_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	2024-12-15_b810a574d573a1f0a65548226326287e_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	2024-12-15_b810a574d573a1f0a65548226326287e_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2024-12-15_b810a574d573a1f0a65548226326287e_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2024-12-15_b810a574d573a1f0a65548226326287e_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1448
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:4504

C:\Users\Admin\AppData\Local\Temp\2024-12-15_b810a574d573a1f0a65548226326287e_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2024-12-15_b810a574d573a1f0a65548226326287e_wannacry.exe -m security
1⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:4608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
20cfa6deb0d408096befde90d27f705f

SHA1
c02d52e59e60296a2577d9233e430011d7684013

SHA256
12c8b2e872e42c5d24f24b3db627bb29de1afdcbb4886c7b6538c38493522b51

SHA512
46bed8b83d48b2d5e2ce9ef35294367837e573ca3582b0b17527a92b44b9a20d967ca7de3282543d0ff45971d27b11cc9c1d1814eeeb661514dbfdbb79d38271

Download Submit