wannacry | cbd27305bc8316d15e94c98da2e271dfa13ddfc7d1043fc563b7c73ed85668d9

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19-12-2024 01:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cbd27305bc8316d15e94c98da2e271dfa13ddfc7d1043fc563b7c73ed85668d9.exe
Size

5.0MB
MD5

400cf8c6a860b2778da44e732ca3bc1f
SHA1

2e860c5598f9b53b38e50f103b8e1917fc613a3c
SHA256

cbd27305bc8316d15e94c98da2e271dfa13ddfc7d1043fc563b7c73ed85668d9
SHA512

0be046f987ad9c717c6dddae7bd897af29fc31e41cf862b1966b2a1861c8c60493127a340c6fa961a5e2031464160155f04dd2564b2a8267a9d6b476b41aec1e
SSDEEP

24576:XbLgddQhfdmMSirYbcMNgef0QeQjGDdhAdmv1LJMfcH9PO6LLuYz:XnAQqMSPbcBVQejDdhnvxJM0H9Pz

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Wannacry family
wannacry
Contacts a large (3262) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 1 IoCs

pid	Process
3636	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	cbd27305bc8316d15e94c98da2e271dfa13ddfc7d1043fc563b7c73ed85668d9.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cbd27305bc8316d15e94c98da2e271dfa13ddfc7d1043fc563b7c73ed85668d9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cbd27305bc8316d15e94c98da2e271dfa13ddfc7d1043fc563b7c73ed85668d9.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	cbd27305bc8316d15e94c98da2e271dfa13ddfc7d1043fc563b7c73ed85668d9.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	cbd27305bc8316d15e94c98da2e271dfa13ddfc7d1043fc563b7c73ed85668d9.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	cbd27305bc8316d15e94c98da2e271dfa13ddfc7d1043fc563b7c73ed85668d9.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	cbd27305bc8316d15e94c98da2e271dfa13ddfc7d1043fc563b7c73ed85668d9.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	cbd27305bc8316d15e94c98da2e271dfa13ddfc7d1043fc563b7c73ed85668d9.exe

C:\Users\Admin\AppData\Local\Temp\cbd27305bc8316d15e94c98da2e271dfa13ddfc7d1043fc563b7c73ed85668d9.exe
"C:\Users\Admin\AppData\Local\Temp\cbd27305bc8316d15e94c98da2e271dfa13ddfc7d1043fc563b7c73ed85668d9.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3868
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:3636

C:\Users\Admin\AppData\Local\Temp\cbd27305bc8316d15e94c98da2e271dfa13ddfc7d1043fc563b7c73ed85668d9.exe
C:\Users\Admin\AppData\Local\Temp\cbd27305bc8316d15e94c98da2e271dfa13ddfc7d1043fc563b7c73ed85668d9.exe -m security
1⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
65a4d25424ad86f9d17606447faebe29

SHA1
158ec1c76a8274d0e6470411d97a45ad60470ce1

SHA256
2f4226ed974bde0e538afd2a230f7ecadb586e5be0e268f1619ffc112d6ff9b2

SHA512
4823ea8681e64e1fc1a03c0c8e9c60eeda99a6d2ef05d899c155b2093b1e09396ec65c53e8bdb14be6f23ae2bb85fe9799ee094a50e8291358151993c4e46fe5

Download Submit