wannacry | e8af6a8ea9b9fc9f7e31f6fd2330847703df9a79e567c9b08ce506804764b0ce

Analysis

max time kernel
120s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19-12-2024 11:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e8af6a8ea9b9fc9f7e31f6fd2330847703df9a79e567c9b08ce506804764b0ceN.exe
Size

5.0MB
MD5

eec13638a2c565f11b541cdb412c0870
SHA1

bdd19f2c025a906622e02a33d52070915c169101
SHA256

e8af6a8ea9b9fc9f7e31f6fd2330847703df9a79e567c9b08ce506804764b0ce
SHA512

bb5681b660a919395e5a9fcc38af65198fc582abf113a9c9bbbcb0e6f9b6fa9acc7aff57008d8a8ca6eeae124f21a73d8dbb8730d6a8ebb61b62f131a7b2c495
SSDEEP

24576:XbLgddQhfdmMSirYbcMNgef0QeQjGDdhAdmv1LJMfcH9PO6LLuY:XnAQqMSPbcBVQejDdhnvxJM0H9P

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Wannacry family
wannacry
Contacts a large (2387) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 1 IoCs

pid	Process
3544	tasksche.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	e8af6a8ea9b9fc9f7e31f6fd2330847703df9a79e567c9b08ce506804764b0ceN.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e8af6a8ea9b9fc9f7e31f6fd2330847703df9a79e567c9b08ce506804764b0ceN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e8af6a8ea9b9fc9f7e31f6fd2330847703df9a79e567c9b08ce506804764b0ceN.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	e8af6a8ea9b9fc9f7e31f6fd2330847703df9a79e567c9b08ce506804764b0ceN.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	e8af6a8ea9b9fc9f7e31f6fd2330847703df9a79e567c9b08ce506804764b0ceN.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	e8af6a8ea9b9fc9f7e31f6fd2330847703df9a79e567c9b08ce506804764b0ceN.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	e8af6a8ea9b9fc9f7e31f6fd2330847703df9a79e567c9b08ce506804764b0ceN.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	e8af6a8ea9b9fc9f7e31f6fd2330847703df9a79e567c9b08ce506804764b0ceN.exe

C:\Users\Admin\AppData\Local\Temp\e8af6a8ea9b9fc9f7e31f6fd2330847703df9a79e567c9b08ce506804764b0ceN.exe
"C:\Users\Admin\AppData\Local\Temp\e8af6a8ea9b9fc9f7e31f6fd2330847703df9a79e567c9b08ce506804764b0ceN.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2632
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:3544

C:\Users\Admin\AppData\Local\Temp\e8af6a8ea9b9fc9f7e31f6fd2330847703df9a79e567c9b08ce506804764b0ceN.exe
C:\Users\Admin\AppData\Local\Temp\e8af6a8ea9b9fc9f7e31f6fd2330847703df9a79e567c9b08ce506804764b0ceN.exe -m security
1⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:3680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
65a4d25424ad86f9d17606447faebe29

SHA1
158ec1c76a8274d0e6470411d97a45ad60470ce1

SHA256
2f4226ed974bde0e538afd2a230f7ecadb586e5be0e268f1619ffc112d6ff9b2

SHA512
4823ea8681e64e1fc1a03c0c8e9c60eeda99a6d2ef05d899c155b2093b1e09396ec65c53e8bdb14be6f23ae2bb85fe9799ee094a50e8291358151993c4e46fe5

Download Submit