wannacry | 74f7db23b87ef33032e9ac9aac39d7d90538d860512c848e12d06f87af33795e

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
01-01-2025 11:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-01-01_6812a4773a1895e8cfcc40a51c4c0ae1_wannacry.exe
Size

3.6MB
MD5

6812a4773a1895e8cfcc40a51c4c0ae1
SHA1

894fe56f871d13831fc85370152e0ecb371636c9
SHA256

74f7db23b87ef33032e9ac9aac39d7d90538d860512c848e12d06f87af33795e
SHA512

db0fc6995c4db34d727d3ad7e955da6d441a6f8935477b2aa4a156200ed6dffa61559b3142c76088137361cfc109a33995975d772d1daa55d8e4334c87f1689e
SSDEEP

49152:XnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAsI6:XDqPoBhz1aRxcSUDk36SAi

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Wannacry family
wannacry
Contacts a large (3228) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 1 IoCs

pid	Process
5108	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	2025-01-01_6812a4773a1895e8cfcc40a51c4c0ae1_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-01-01_6812a4773a1895e8cfcc40a51c4c0ae1_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-01-01_6812a4773a1895e8cfcc40a51c4c0ae1_wannacry.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	2025-01-01_6812a4773a1895e8cfcc40a51c4c0ae1_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	2025-01-01_6812a4773a1895e8cfcc40a51c4c0ae1_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	2025-01-01_6812a4773a1895e8cfcc40a51c4c0ae1_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	2025-01-01_6812a4773a1895e8cfcc40a51c4c0ae1_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	2025-01-01_6812a4773a1895e8cfcc40a51c4c0ae1_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2025-01-01_6812a4773a1895e8cfcc40a51c4c0ae1_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2025-01-01_6812a4773a1895e8cfcc40a51c4c0ae1_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4196
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:5108

C:\Users\Admin\AppData\Local\Temp\2025-01-01_6812a4773a1895e8cfcc40a51c4c0ae1_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2025-01-01_6812a4773a1895e8cfcc40a51c4c0ae1_wannacry.exe -m security
1⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
ae99332c21b72147a5a229e65d2bf7f6

SHA1
c9a2db1cfa246f6cf6e5093ba2463047ccd72275

SHA256
3c37426360b04d022f5331ab8f0c83d4801d1f46d2bb3b990cc7b34f4a83ec9f

SHA512
4091ec4b857eebf03a64d969b1c1199e2cd69ea905e2d807b05fd01c1392e8154147caed3d68b41a522c7b4cef3a1240668f05eeb30dd5e97ffa9ecc39680169

Download Submit