wannacry | be0d17a91ce084ebc76813f5d9572fee9662d460644305150fa6bb95d1404744

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
28-12-2024 13:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-12-28_9d93291540884678aafc3c17e7be5eb8_wannacry.exe
Size

5.0MB
MD5

9d93291540884678aafc3c17e7be5eb8
SHA1

628187a79e96848ab0667aa9cf0b8394c78fdea0
SHA256

be0d17a91ce084ebc76813f5d9572fee9662d460644305150fa6bb95d1404744
SHA512

8e4436c87049572c6f20d3da624ba67256e21145c0fb7e4fb506e1739ade6edd0d257807259e5aa695a3aee6882ce8f23c4595ca9529eabf1708066af08bcfe7
SSDEEP

98304:yDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp:yDqPe1Cxcxk3ZAEUadzR8yc

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Wannacry family
wannacry
Contacts a large (3358) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 1 IoCs

pid	Process
1472	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	2024-12-28_9d93291540884678aafc3c17e7be5eb8_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-12-28_9d93291540884678aafc3c17e7be5eb8_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-12-28_9d93291540884678aafc3c17e7be5eb8_wannacry.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	2024-12-28_9d93291540884678aafc3c17e7be5eb8_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	2024-12-28_9d93291540884678aafc3c17e7be5eb8_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	2024-12-28_9d93291540884678aafc3c17e7be5eb8_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	2024-12-28_9d93291540884678aafc3c17e7be5eb8_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	2024-12-28_9d93291540884678aafc3c17e7be5eb8_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2024-12-28_9d93291540884678aafc3c17e7be5eb8_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2024-12-28_9d93291540884678aafc3c17e7be5eb8_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2036
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:1472

C:\Users\Admin\AppData\Local\Temp\2024-12-28_9d93291540884678aafc3c17e7be5eb8_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2024-12-28_9d93291540884678aafc3c17e7be5eb8_wannacry.exe -m security
1⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
6ddc505cb244be8b08828e63fa632278

SHA1
617709b046b4a45b78508683c1ce7f8b9cdb7851

SHA256
0c8d99acf6e785d264a5add1c4dbf8070ee1ed7ef91deca40c2b2ea781e8b59e

SHA512
d151478af1e6409e4797cc17acd2ab18d0d6b37d8aa106ead846b4d2b87071e637cfe6d79b8d7fd4365ea40b96b683a42f8969c00aa79da8d0268240a5c1de90

Download Submit