Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
25/12/2024, 10:32 UTC
General
-
Target
2024-12-25_929106faad5dba31b540295444b7ffb0_wannacry.exe
-
Size
5.0MB
-
MD5
929106faad5dba31b540295444b7ffb0
-
SHA1
a7b332919eab4d9d39f05bd3c4451572772931c6
-
SHA256
3ec5029b4fcfc8d06a3f7c13d77492a820ae16f3ddf08799f5b8764ae366852c
-
SHA512
a0c7622ef4dbf8161f8feb7bbd2c1cfb144fe1a23dcf2395af10a3d88d195d71257f0a00decad35048c149782bbc6542529d1945e703d37a4d239ab4b72a6407
-
SSDEEP
98304:yDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8:yDqPe1Cxcxk3ZAEUadzR8
Score
10/10
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Wannacry family
-
Contacts a large (3221) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 1 IoCs
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies data under HKEY_USERS 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-25_929106faad5dba31b540295444b7ffb0_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-25_929106faad5dba31b540295444b7ffb0_wannacry.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\2024-12-25_929106faad5dba31b540295444b7ffb0_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2024-12-25_929106faad5dba31b540295444b7ffb0_wannacry.exe -m security1⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
Network
-
DNSwww.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comRemote address:8.8.8.8:53Requestwww.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comIN AResponsewww.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comIN A104.16.166.228www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comIN A104.16.167.228 -
GEThttp://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/Remote address:104.16.166.228:80RequestGET / HTTP/1.1
Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
Date: Wed, 25 Dec 2024 10:32:38 GMT
Content-Type: text/html
Content-Length: 607
Connection: close
Server: cloudflare
CF-RAY: 8f782b1759b59538-LHR
-
DNS8.8.8.8.in-addr.arpaRemote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle
-
GEThttp://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/Remote address:104.16.166.228:80RequestGET / HTTP/1.1
Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
Date: Wed, 25 Dec 2024 10:32:38 GMT
Content-Type: text/html
Content-Length: 607
Connection: close
Server: cloudflare
CF-RAY: 8f782b184ad1eef7-LHR
-
DNS228.166.16.104.in-addr.arpaRemote address:8.8.8.8:53Request228.166.16.104.in-addr.arpaIN PTRResponse
-
DNS28.118.140.52.in-addr.arpaRemote address:8.8.8.8:53Request28.118.140.52.in-addr.arpaIN PTRResponse
-
DNS133.130.81.91.in-addr.arpaRemote address:8.8.8.8:53Request133.130.81.91.in-addr.arpaIN PTRResponse
-
DNS20.160.190.20.in-addr.arpaRemote address:8.8.8.8:53Request20.160.190.20.in-addr.arpaIN PTRResponse
-
DNS95.221.229.192.in-addr.arpaRemote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
DNS228.249.119.40.in-addr.arpaRemote address:8.8.8.8:53Request228.249.119.40.in-addr.arpaIN PTRResponse
-
DNS13.86.106.20.in-addr.arpaRemote address:8.8.8.8:53Request13.86.106.20.in-addr.arpaIN PTRResponse
-
DNS53.210.109.20.in-addr.arpaRequest53.210.109.20.in-addr.arpaIN PTRResponse
-
DNS171.39.242.20.in-addr.arpaRequest171.39.242.20.in-addr.arpaIN PTRResponse
-
DNS20.49.80.91.in-addr.arpaRequest20.49.80.91.in-addr.arpaIN PTRResponse
-
DNS144.128.198.200.in-addr.arpaRequest144.128.198.200.in-addr.arpaIN PTRResponse144.128.198.200.in-addr.arpaIN PTRselpro2434procergscombr
-
DNS20.128.198.200.in-addr.arpaRequest20.128.198.200.in-addr.arpaIN PTRResponse20.128.198.200.in-addr.arpaIN PTRlogincidadaorsgovbr
-
DNS182.129.81.91.in-addr.arpaRequest182.129.81.91.in-addr.arpaIN PTRResponse
-
DNS156.79.175.213.in-addr.arpaRequest156.79.175.213.in-addr.arpaIN PTRResponse
-
DNS1.79.175.213.in-addr.arpaRequest1.79.175.213.in-addr.arpaIN PTRResponse
-
DNS172.210.232.199.in-addr.arpaRequest172.210.232.199.in-addr.arpaIN PTRResponse
-
DNS23.236.111.52.in-addr.arpaRequest23.236.111.52.in-addr.arpaIN PTRResponse
-
DNS29.128.198.200.in-addr.arpaRequest29.128.198.200.in-addr.arpaIN PTRResponse
-
DNS2.79.175.213.in-addr.arpaRequest2.79.175.213.in-addr.arpaIN PTRResponse
-
DNS135.60.49.34.in-addr.arpaRequest135.60.49.34.in-addr.arpaIN PTRResponse135.60.49.34.in-addr.arpaIN PTR135604934bcgoogleusercontentcom
-
DNS3.60.49.34.in-addr.arpaRequest3.60.49.34.in-addr.arpaIN PTRResponse3.60.49.34.in-addr.arpaIN PTR3604934bcgoogleusercontentcom
-
DNS6.60.49.34.in-addr.arpaRequest6.60.49.34.in-addr.arpaIN PTRResponse6.60.49.34.in-addr.arpaIN PTR6604934bcgoogleusercontentcom
-
DNS8.60.49.34.in-addr.arpaRequest8.60.49.34.in-addr.arpaIN PTRResponse8.60.49.34.in-addr.arpaIN PTR8604934bcgoogleusercontentcom
-
104.16.166.228:80http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/http
HTTP Request
GET http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/HTTP Response
200 -
104.16.166.228:80http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/http
HTTP Request
GET http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/HTTP Response
200 -
177.95.211.246:445 -
10.127.0.1:445 -
10.127.1.1:445
-
10.127.2.1:445
-
10.127.3.1:445
-
10.127.4.1:445
-
10.127.5.1:445
-
10.127.6.1:445
-
10.127.7.1:445
-
10.127.8.1:445
-
10.127.9.1:445
-
10.127.10.1:445
-
10.127.11.1:445
-
10.127.12.1:445
-
143.133.181.69:445
-
10.127.13.1:445
-
10.127.14.1:445
-
161.158.62.206:445
-
10.127.15.1:445
-
137.83.66.34:445
-
10.127.16.1:445
-
10.127.17.1:445
-
10.127.18.1:445
-
10.127.19.1:445
-
10.127.20.1:445
-
10.127.21.1:445
-
10.127.22.1:445
-
10.127.23.1:445
-
10.127.24.1:445
-
10.127.25.1:445
-
10.127.26.1:445
-
10.127.27.1:445
-
10.127.28.1:445
-
10.127.29.1:445
-
10.127.30.1:445
-
10.127.31.1:445
-
10.127.32.1:445
-
159.82.69.127:445
-
53.54.39.234:445 -
10.127.33.1:445
-
107.88.223.176:445
-
172.189.80.161:445
-
10.127.34.1:445
-
10.127.35.1:445
-
10.127.36.1:445
-
10.127.37.1:445
-
10.127.38.1:445
-
10.127.39.1:445
-
10.127.40.1:445
-
10.127.41.1:445
-
10.127.42.1:445
-
10.127.43.1:445
-
10.127.44.1:445
-
10.127.45.1:445
-
195.121.238.225:445 -
10.127.46.1:445
-
10.127.47.1:445
-
10.127.48.1:445
-
10.127.49.1:445
-
10.127.50.1:445
-
10.127.51.1:445
-
163.96.220.141:445 -
128.48.229.15:445
-
10.127.52.1:445
-
213.31.231.237:445 -
163.192.140.43:445
-
79.101.82.119:445 -
10.127.53.1:445
-
10.127.54.1:445
-
10.127.55.1:445
-
10.127.56.1:445
-
10.127.57.1:445
-
10.127.58.1:445
-
10.127.59.1:445
-
10.127.60.1:445
-
10.127.61.1:445
-
10.127.62.1:445
-
10.127.63.1:445
-
10.127.64.1:445
-
10.127.65.1:445
-
10.127.66.1:445
-
10.127.67.1:445
-
207.143.32.207:445
-
38.203.36.148:445
-
10.127.68.1:445
-
10.127.69.1:445
-
10.127.70.1:445
-
70.184.179.40:445
-
61.221.52.133:445 -
199.149.100.108:445
-
192.32.63.130:445
-
27.77.228.76:445 -
137.110.238.136:445
-
10.127.71.1:445
-
10.127.72.1:445
-
10.127.73.1:445
-
10.127.74.1:445
-
10.127.75.1:445
-
10.127.76.1:445
-
10.127.77.1:445
-
10.127.78.1:445
-
10.127.79.1:445
-
10.127.80.1:445
-
10.127.81.1:445
-
10.127.82.1:445
-
10.127.83.1:445
-
10.127.84.1:445
-
10.127.85.1:445
-
10.127.86.1:445
-
184.24.195.103:445
-
10.127.87.1:445
-
10.127.88.1:445
-
10.127.89.1:445
-
69.223.54.249:445
-
10.127.90.1:445
-
117.10.216.17:445 -
10.127.91.1:445
-
73.114.17.8:445
-
77.28.102.59:445 -
107.53.138.40:445
-
66.163.11.10:445 -
131.149.30.204:445
-
56.250.89.99:445
-
29.252.52.6:445
-
10.127.92.1:445
-
10.127.93.1:445
-
10.127.94.1:445
-
10.127.95.1:445
-
10.127.96.1:445
-
10.127.97.1:445
-
10.127.98.1:445
-
10.127.99.1:445
-
10.127.100.1:445
-
10.127.101.1:445
-
10.127.102.1:445
-
10.127.103.1:445
-
10.127.104.1:445
-
10.127.105.1:445
-
10.127.106.1:445
-
153.247.222.142:445 -
10.127.107.1:445
-
10.127.108.1:445
-
48.13.244.47:445
-
10.127.109.1:445
-
10.127.110.1:445
-
10.127.111.1:445
-
144.0.157.52:445
-
10.127.112.1:445
-
107.56.96.197:445
-
49.201.129.79:445 -
163.193.118.39:445
-
111.228.173.141:445
-
98.145.27.166:445
-
200.235.70.184:445
-
83.53.236.148:445 -
202.246.92.34:445
-
163.2.83.249:445
-
10.127.113.1:445
-
10.127.114.1:445
-
10.127.115.1:445
-
10.127.116.1:445
-
10.127.117.1:445
-
10.127.118.1:445
-
10.127.119.1:445
-
10.127.120.1:445
-
10.127.121.1:445
-
10.127.122.1:445
-
10.127.123.1:445
-
10.127.124.1:445
-
10.127.125.1:445
-
10.127.126.1:445
-
106.207.199.118:445
-
10.127.127.1:445
-
10.127.128.1:445
-
121.99.116.99:445 -
10.127.129.1:445
-
10.127.130.1:445
-
10.127.131.1:445
-
9.185.3.21:445
-
10.127.132.1:445
-
10.127.133.1:445
-
168.135.153.238:445
-
5.119.249.25:445 -
11.9.212.212:445
-
61.213.137.246:445
-
10.127.134.1:445
-
125.116.251.98:445
-
10.127.135.1:445
-
195.152.99.133:445
-
40.14.251.203:445
-
114.185.218.169:445
-
140.217.38.54:445
-
153.179.15.19:445
-
62.91.103.160:445
-
10.127.136.1:445
-
10.127.137.1:445
-
10.127.138.1:445
-
10.127.139.1:445
-
10.127.140.1:445
-
10.127.141.1:445
-
10.127.142.1:445
-
10.127.143.1:445
-
10.127.144.1:445
-
10.127.145.1:445
-
10.127.146.1:445
-
153.169.148.133:445
-
10.127.147.1:445
-
10.127.148.1:445
-
10.127.149.1:445
-
10.127.150.1:445
-
106.72.153.154:445
-
10.127.151.1:445
-
175.122.121.32:445 -
87.238.26.100:445 -
36.36.202.218:445
-
10.127.152.1:445
-
33.27.209.45:445
-
41.49.230.206:445 -
218.163.182.244:445
-
5.183.167.187:445 -
22.225.28.36:445
-
177.54.246.184:445
-
159.187.193.242:445
-
220.34.130.136:445
-
91.144.216.36:445
-
113.252.179.212:445 -
219.121.155.111:445
-
10.127.153.1:445
-
10.127.154.1:445
-
10.127.155.1:445
-
10.127.156.1:445
-
10.127.157.1:445
-
10.127.158.1:445
-
10.127.159.1:445
-
10.127.160.1:445
-
10.127.161.1:445
-
10.127.162.1:445
-
10.127.163.1:445
-
10.127.164.1:445
-
10.127.165.1:445
-
10.127.166.1:445
-
10.127.167.1:445
-
10.127.168.1:445
-
10.127.169.1:445
-
10.127.170.1:445
-
10.127.171.1:445
-
212.159.101.155:445
-
212.250.228.173:445
-
10.127.172.1:445
-
10.127.173.1:445
-
156.196.172.186:445 -
136.131.249.213:445
-
92.25.192.146:445
-
38.173.86.217:445
-
20.115.121.136:445
-
11.44.144.249:445
-
151.156.134.83:445 -
37.195.206.134:445 -
27.244.199.2:445
-
95.252.58.112:445
-
176.85.97.156:445
-
95.144.179.41:445
-
25.112.17.165:445
-
43.71.67.107:445 -
16.134.34.58:445
-
10.127.174.1:445
-
10.127.175.1:445
-
10.127.176.1:445
-
10.127.177.1:445
-
10.127.178.1:445
-
10.127.179.1:445
-
10.127.180.1:445
-
10.127.181.1:445
-
10.127.182.1:445
-
10.127.183.1:445
-
10.127.184.1:445
-
10.127.185.1:445
-
10.127.186.1:445
-
10.127.187.1:445
-
10.127.188.1:445
-
10.127.189.1:445
-
10.127.190.1:445
-
222.167.112.84:445
-
10.127.191.1:445
-
206.69.14.84:445
-
10.127.192.1:445
-
10.127.193.1:445
-
60.188.149.180:445
-
129.85.98.117:445
-
122.150.189.67:445 -
46.221.135.170:445 -
50.247.231.159:445
-
220.29.73.243:445
-
4.23.112.53:445
-
101.90.46.100:445
-
152.117.147.109:445
-
195.23.146.90:445 -
179.241.128.129:445
-
125.153.238.224:445
-
168.21.140.56:445
-
211.248.153.145:445
-
147.71.169.149:445
-
166.171.68.28:445
-
113.222.176.120:445
-
10.127.194.1:445
-
10.127.195.1:445
-
10.127.196.1:445
-
10.127.197.1:445
-
10.127.198.1:445
-
10.127.199.1:445
-
10.127.200.1:445
-
10.127.201.1:445
-
10.127.202.1:445
-
10.127.203.1:445
-
10.127.204.1:445
-
10.127.205.1:445
-
10.127.206.1:445
-
10.127.207.1:445
-
10.127.208.1:445
-
10.127.209.1:445
-
55.190.62.129:445
-
21.30.49.158:445
-
10.127.210.1:445
-
10.127.211.1:445
-
10.127.212.1:445
-
36.81.212.192:445 -
10.127.213.1:445
-
134.123.2.92:445
-
115.183.156.220:445
-
206.59.219.30:445
-
139.53.154.62:445
-
131.243.4.213:445
-
114.71.22.225:445
-
80.193.133.122:445
-
121.250.3.203:445
-
213.236.72.84:445
-
117.61.224.156:445
-
197.104.135.194:445
-
88.166.152.213:445
-
65.121.174.20:445
-
69.110.14.182:445
-
108.141.70.154:445
-
20.226.189.71:445
-
196.67.228.248:445 -
25.245.75.205:445
-
10.127.214.1:445
-
10.127.215.1:445
-
10.127.216.1:445
-
10.127.217.1:445
-
10.127.218.1:445
-
10.127.219.1:445
-
10.127.220.1:445
-
10.127.221.1:445
-
10.127.222.1:445
-
10.127.223.1:445
-
10.127.224.1:445
-
10.127.225.1:445
-
10.127.226.1:445
-
10.127.227.1:445
-
10.127.228.1:445
-
10.127.229.1:445
-
10.127.230.1:445
-
10.127.231.1:445
-
174.46.79.236:445
-
215.33.175.32:445
-
10.127.232.1:445
-
10.127.233.1:445
-
10.127.234.1:445
-
201.179.52.141:445 -
119.16.90.181:445
-
176.147.86.99:445
-
154.47.250.92:445
-
93.67.48.173:445
-
182.169.89.118:445
-
181.185.47.111:445 -
39.237.210.227:445
-
198.234.26.190:445
-
41.113.0.138:445
-
160.197.96.220:445
-
137.162.212.217:445
-
8.30.79.6:445
-
42.98.204.189:445
-
220.245.68.250:445
-
33.86.186.72:445
-
172.236.51.103:445
-
20.134.216.9:445
-
25.104.252.200:445
-
101.138.140.174:445
-
103.138.239.11:445
-
213.35.236.210:445 -
53.131.87.241:445
-
10.127.235.1:445
-
10.127.236.1:445
-
10.127.237.1:445
-
10.127.238.1:445
-
10.127.239.1:445
-
10.127.240.1:445
-
10.127.241.1:445
-
10.127.242.1:445
-
10.127.243.1:445
-
10.127.244.1:445
-
10.127.245.1:445
-
10.127.246.1:445
-
10.127.247.1:445
-
10.127.248.1:445
-
10.127.249.1:445
-
10.127.250.1:445
-
10.127.251.1:445
-
10.127.252.1:445
-
10.127.253.1:445
-
10.127.254.1:445
-
138.248.94.12:445
-
82.64.121.170:445
-
148.37.31.127:445
-
88.152.175.204:445
-
91.207.106.186:445 -
187.58.7.148:445
-
73.76.106.239:445
-
211.41.42.202:445
-
150.207.99.93:445
-
83.85.208.158:445
-
141.6.247.169:445
-
66.75.38.65:445
-
156.57.116.221:445
-
10.67.166.238:445
-
120.138.112.39:445
-
162.107.82.132:445
-
186.168.130.150:445 -
114.198.68.163:445
-
93.68.91.190:445
-
152.78.51.12:445
-
56.220.32.34:445
-
149.122.232.223:445
-
24.203.105.107:445
-
200.112.10.202:445 -
154.104.4.231:445 -
10.127.255.1:445
-
10.127.0.2:445
-
10.127.1.2:445
-
10.127.2.2:445
-
10.127.3.2:445
-
10.127.4.2:445
-
10.127.5.2:445
-
10.127.6.2:445
-
10.127.7.2:445
-
10.127.8.2:445
-
10.127.9.2:445
-
10.127.10.2:445
-
10.127.11.2:445
-
10.127.12.2:445
-
10.127.13.2:445
-
10.127.14.2:445
-
10.127.15.2:445
-
10.127.16.2:445
-
10.127.17.2:445
-
10.127.18.2:445
-
218.151.127.225:445
-
187.252.21.72:445 -
176.116.75.71:445
-
73.19.136.122:445
-
120.100.248.62:445
-
9.92.208.90:445
-
68.155.206.240:445
-
74.100.205.242:445
-
85.59.10.178:445
-
143.175.250.94:445
-
180.109.183.133:445
-
9.185.14.11:445
-
6.240.212.2:445
-
23.68.245.207:445
-
39.122.175.39:445
-
25.163.129.146:445
-
165.99.214.27:445
-
66.178.109.234:445
-
183.172.207.83:445
-
71.36.18.249:445
-
59.190.208.218:445
-
99.77.141.180:445
-
168.90.103.118:445
-
5.254.154.101:445
-
162.18.190.208:445
-
152.219.144.144:445
-
10.127.19.2:445
-
10.127.20.2:445
-
10.127.21.2:445
-
10.127.22.2:445
-
10.127.23.2:445
-
10.127.24.2:445
-
10.127.25.2:445
-
8.8.8.8:53www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comdns
DNS Request
www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
DNS Response
104.16.166.228104.16.167.228
-
8.8.8.8:538.8.8.8.in-addr.arpadns
DNS Request
8.8.8.8.in-addr.arpa
-
8.8.8.8:53228.166.16.104.in-addr.arpadns
DNS Request
228.166.16.104.in-addr.arpa
-
8.8.8.8:5328.118.140.52.in-addr.arpadns
DNS Request
28.118.140.52.in-addr.arpa
-
8.8.8.8:53133.130.81.91.in-addr.arpadns
DNS Request
133.130.81.91.in-addr.arpa
-
8.8.8.8:5320.160.190.20.in-addr.arpadns
DNS Request
20.160.190.20.in-addr.arpa
-
8.8.8.8:5395.221.229.192.in-addr.arpadns
DNS Request
95.221.229.192.in-addr.arpa
-
8.8.8.8:53228.249.119.40.in-addr.arpadns
DNS Request
228.249.119.40.in-addr.arpa
-
8.8.8.8:5313.86.106.20.in-addr.arpadns
DNS Request
13.86.106.20.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.4MB
MD52b160169f573067fe9932060075e017d
SHA1ef58afdeb7da12360e45a6ddaadb50d7d79bfbc7
SHA256021043e408e2bcaa67e12aa5a0cbffc833451eb3202b9b9d059fdb84be7a2e42
SHA51209d25aaad4036be37016c331764b4f62adf87c75dca72c0e206712b49e2b3376c39933b1b6626ae9c19a507123e4195ad8cbeb1a357289f340d602249c9c36a2