wannacry | 86c78c77dd2118b29d06899ef6da37abb0406556fdaf042b3761099d3842030d

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-12-2024 10:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-12-17_63e29e22ca0885ce066a2f6bde092449_wannacry.exe
Size

5.0MB
MD5

63e29e22ca0885ce066a2f6bde092449
SHA1

0c7c437637a6ae60aaf5fb4fbe1bfff5ba35c968
SHA256

86c78c77dd2118b29d06899ef6da37abb0406556fdaf042b3761099d3842030d
SHA512

5af88d0e07afc7b829a4ad0d8d2251154213e0dbf4f31d5eb4ef7d90be74e50bd83b93e9e60cfa094171c5857b3f7265eb0a824bc3bb8f67b33a75cf6f28dfaa
SSDEEP

24576:2bLgddQhfdmMSirYbcMNgef0QeQjG/D8kIqRYoAdNLKz66:2nAQqMSPbcBVQej/1INR

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Wannacry family
wannacry
Contacts a large (3356) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 1 IoCs

pid	Process
3700	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	2024-12-17_63e29e22ca0885ce066a2f6bde092449_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-12-17_63e29e22ca0885ce066a2f6bde092449_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-12-17_63e29e22ca0885ce066a2f6bde092449_wannacry.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	2024-12-17_63e29e22ca0885ce066a2f6bde092449_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	2024-12-17_63e29e22ca0885ce066a2f6bde092449_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	2024-12-17_63e29e22ca0885ce066a2f6bde092449_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	2024-12-17_63e29e22ca0885ce066a2f6bde092449_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	2024-12-17_63e29e22ca0885ce066a2f6bde092449_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2024-12-17_63e29e22ca0885ce066a2f6bde092449_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2024-12-17_63e29e22ca0885ce066a2f6bde092449_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4392
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:3700

C:\Users\Admin\AppData\Local\Temp\2024-12-17_63e29e22ca0885ce066a2f6bde092449_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2024-12-17_63e29e22ca0885ce066a2f6bde092449_wannacry.exe -m security
1⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:4336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
d995af840393bc57a9ec0e5f8d5e0762

SHA1
f696d6cb65d8e0399e66dd4def76a34a337f43a8

SHA256
466859149943b7b70b55636b1c7e5143cdc67c47926b5af09cd0a05a4c818246

SHA512
d3aa91bb50ae7bfd2eb3837b200033f6ea5f7adc60bb7ad647aa5f8f0943c192deed531d721e567e00f824aea59b0669325fde0da1adacd0261ef1b4468b2830

Download Submit