Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    18/12/2024, 02:23

General

  • Target

    2024-12-18_82b7871b9138ee91a4b4431623045501_wannacry.exe

  • Size

    3.6MB

  • MD5

    82b7871b9138ee91a4b4431623045501

  • SHA1

    6f1586a7dfa7af697597ef8744ceb97195fab8c2

  • SHA256

    028d1781bc00cbad2f20dc8bc344fcb8b5f3aae82dd601ff257d663325896d13

  • SHA512

    3404556f9acb381550252bb57acf166db9d9de3eeeccd9b7c0a41125bbe63e3bf618c04e94da004b3595378502178d1efeb3a1ceb12f223c5bbbed011bfdaa6c

  • SSDEEP

    98304:Z8qPoBhz1aRxcSUDk36SAEdhvxWa9P59UcM8yAVp2HI:Z8qPe1Cxcxk3ZAEUadc8yc4HI

Malware Config

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

  • Wannacry family
  • Contacts a large (3299) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Executes dropped EXE 1 IoCs
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-12-18_82b7871b9138ee91a4b4431623045501_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-12-18_82b7871b9138ee91a4b4431623045501_wannacry.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    PID:764
    • C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      2⤵
      • Executes dropped EXE
      PID:1172
  • C:\Users\Admin\AppData\Local\Temp\2024-12-18_82b7871b9138ee91a4b4431623045501_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp\2024-12-18_82b7871b9138ee91a4b4431623045501_wannacry.exe -m security
    1⤵
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    PID:3064

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\tasksche.exe

    Filesize

    3.4MB

    MD5

    00313b6e050dc746409f65b436f124f7

    SHA1

    c9829dd4ba7b9345c20bcedcf15ee8c06c175b5f

    SHA256

    aff620ca3dc5d3dfcf617f4364898d34306329eabf5fa2ca4ec4eb735dfd1ad0

    SHA512

    cc519283b254157a3632bf4f5a3098205e9c2fae7a390c64d3fec1886f7f29134262707f14cc13e3607a0f95aaa5aff6eb6462960825dae335d1c2d1e5cb5fe4