wannacry | e72193fe924b374245e1588110df8b95b5db7adb8a360932ff9741b108d50cc4

Resubmissions

31-12-2024 22:05

241231-1znr3s1qdw 10

03-08-2024 09:22

240803-lb278sygmp 10

03-08-2024 09:16

240803-k8x44stenh 10

Analysis

max time kernel
77s
max time network
78s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241211-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
31-12-2024 22:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-08-03_deb24d34e3b6f271369605c8c0e734a0_wannacry.exe
Size

5.0MB
MD5

deb24d34e3b6f271369605c8c0e734a0
SHA1

3ca024882307e131d554221972e8dcf80879608a
SHA256

e72193fe924b374245e1588110df8b95b5db7adb8a360932ff9741b108d50cc4
SHA512

e0ade5414431536a40db5c3fec6990db8e94cf2f6bc8d9558619b10ac704662ad6c9426b70ca6613ab0f408612b79c402cfe6d82a8b6db13b033d8401e91541a
SSDEEP

98304:yDqPoBhz1aRxcSUDk36SAEdhvxWa9P5h3R8yAVp2H:yDqPe1Cxcxk3ZAEUadvR8yc4H

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Wannacry family
wannacry
Contacts a large (1271) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 1 IoCs

pid	Process
4036	tasksche.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	2024-08-03_deb24d34e3b6f271369605c8c0e734a0_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-08-03_deb24d34e3b6f271369605c8c0e734a0_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-08-03_deb24d34e3b6f271369605c8c0e734a0_wannacry.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	2024-08-03_deb24d34e3b6f271369605c8c0e734a0_wannacry.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	2024-08-03_deb24d34e3b6f271369605c8c0e734a0_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	2024-08-03_deb24d34e3b6f271369605c8c0e734a0_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	2024-08-03_deb24d34e3b6f271369605c8c0e734a0_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	2024-08-03_deb24d34e3b6f271369605c8c0e734a0_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2024-08-03_deb24d34e3b6f271369605c8c0e734a0_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2024-08-03_deb24d34e3b6f271369605c8c0e734a0_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2772
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:4036

C:\Users\Admin\AppData\Local\Temp\2024-08-03_deb24d34e3b6f271369605c8c0e734a0_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2024-08-03_deb24d34e3b6f271369605c8c0e734a0_wannacry.exe -m security
1⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:5004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
be7f83d3a49d5842456734af764a8bab

SHA1
7e7e0fb529e6dabcb6195c1a0451f6600df0424c

SHA256
1b4b9d18c07dfc10ae5d1bf25fee25eab200ce1db9efe44dd3889ce4507e13c3

SHA512
78bf6270b6abfa6984024c87298b8bf64fa298482a2dde35628cc5adc782f01a760342d5fbcacc08eeeb90c947a86e7ab1e72192e6b13352deb5a76d31240019

Download Submit