Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
04/01/2025, 12:47 UTC
General
-
Target
2025-01-04_b249555a66ac0faecf3e11e9029a1302_wannacry.exe
-
Size
5.0MB
-
MD5
b249555a66ac0faecf3e11e9029a1302
-
SHA1
111f3338de440e87526cccc6c933ae1875e4e13a
-
SHA256
be27124de1f236871ed3a317e6000be145aea559d5cfff5ea8082bb4b7e72328
-
SHA512
719daa697e18b34d4ebb1afd895e50b4b5e4373049264283924298545f3f77fcfd076da13816854eb1b4f160807d6f3f9c596af14c13164d6c3e09b34dc196f9
-
SSDEEP
98304:yDqPoBhz1aRxcSUDk36SAEdhvxWa9P59:yDqPe1Cxcxk3ZAEUad
Score
10/10
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Wannacry family
-
Contacts a large (3352) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 1 IoCs
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in System32 directory 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies data under HKEY_USERS 24 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-04_b249555a66ac0faecf3e11e9029a1302_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-04_b249555a66ac0faecf3e11e9029a1302_wannacry.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\2025-01-04_b249555a66ac0faecf3e11e9029a1302_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2025-01-04_b249555a66ac0faecf3e11e9029a1302_wannacry.exe -m security1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
Network
-
DNSwww.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comRemote address:8.8.8.8:53Requestwww.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comIN AResponsewww.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comIN A104.16.167.228www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comIN A104.16.166.228 -
GEThttp://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/Remote address:104.16.167.228:80RequestGET / HTTP/1.1
Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
Date: Sat, 04 Jan 2025 12:47:34 GMT
Content-Type: text/html
Content-Length: 607
Connection: close
Server: cloudflare
CF-RAY: 8fcb568269fd653e-LHR
-
GEThttp://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/Remote address:104.16.167.228:80RequestGET / HTTP/1.1
Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
Date: Sat, 04 Jan 2025 12:47:35 GMT
Content-Type: text/html
Content-Length: 607
Connection: close
Server: cloudflare
CF-RAY: 8fcb5683adc6459b-LHR
-
104.16.167.228:80http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/http
HTTP Request
GET http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/HTTP Response
200 -
104.16.167.228:80http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/http
HTTP Request
GET http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/HTTP Response
200 -
164.55.77.61:445
-
10.127.0.1:445 -
10.127.1.1:445
-
10.127.2.1:445
-
10.127.3.1:445
-
10.127.4.1:445
-
10.127.5.1:445
-
10.127.6.1:445
-
10.127.7.1:445
-
10.127.8.1:445
-
10.127.9.1:445
-
10.127.10.1:445
-
134.204.92.51:445
-
10.127.11.1:445
-
10.127.12.1:445
-
10.127.13.1:445
-
10.127.14.1:445
-
10.127.15.1:445
-
10.127.16.1:445
-
10.127.17.1:445
-
195.147.15.140:445 -
164.125.124.115:445 -
10.127.18.1:445
-
10.127.19.1:445
-
10.127.20.1:445
-
10.127.21.1:445
-
10.127.22.1:445
-
10.127.23.1:445
-
10.127.24.1:445
-
10.127.25.1:445
-
10.127.26.1:445
-
10.127.27.1:445
-
10.127.28.1:445
-
10.127.29.1:445
-
10.127.30.1:445
-
10.127.31.1:445
-
10.127.32.1:445
-
182.133.200.232:445 -
78.24.30.105:445 -
10.127.33.1:445
-
216.198.16.245:445
-
137.38.150.50:445
-
133.195.74.29:445 -
10.127.34.1:445
-
10.127.35.1:445
-
10.127.36.1:445
-
10.127.37.1:445
-
10.127.38.1:445
-
10.127.39.1:445
-
10.127.40.1:445
-
10.127.41.1:445
-
10.127.42.1:445
-
10.127.43.1:445
-
10.127.44.1:445
-
10.127.45.1:445
-
10.127.46.1:445
-
10.127.47.1:445
-
10.127.48.1:445
-
10.127.49.1:445
-
10.127.50.1:445
-
10.127.51.1:445
-
10.127.52.1:445
-
10.127.53.1:445
-
10.127.54.1:445
-
20.116.209.138:445 -
80.65.115.146:445 -
7.70.175.169:445
-
50.230.209.27:445
-
65.251.252.51:445
-
210.25.245.109:445
-
183.165.8.86:445
-
10.127.55.1:445
-
10.127.56.1:445
-
10.127.57.1:445
-
10.127.58.1:445
-
10.127.59.1:445
-
10.127.60.1:445
-
10.127.61.1:445
-
10.127.62.1:445
-
10.127.63.1:445
-
10.127.64.1:445
-
10.127.65.1:445
-
10.127.66.1:445
-
10.127.67.1:445
-
10.127.68.1:445
-
10.127.69.1:445
-
10.127.70.1:445
-
10.127.71.1:445
-
10.127.72.1:445
-
35.60.128.127:445
-
10.127.73.1:445
-
10.127.74.1:445
-
10.127.75.1:445
-
10.127.76.1:445
-
70.74.138.238:445
-
161.66.3.168:445 -
112.29.14.178:445
-
128.37.5.192:445
-
187.231.56.91:445 -
106.65.164.192:445 -
32.40.124.159:445
-
10.127.77.1:445
-
10.127.78.1:445
-
10.127.79.1:445
-
10.127.80.1:445
-
10.127.81.1:445
-
10.127.82.1:445
-
10.127.83.1:445
-
10.127.84.1:445
-
10.127.85.1:445
-
10.127.86.1:445
-
10.127.87.1:445
-
10.127.88.1:445
-
172.234.197.218:445
-
10.127.89.1:445
-
10.127.90.1:445
-
106.36.140.45:445
-
10.127.91.1:445
-
10.127.92.1:445
-
10.127.93.1:445
-
10.127.94.1:445
-
63.31.230.209:445
-
10.127.95.1:445
-
81.0.153.158:445 -
70.91.41.33:445
-
54.252.0.76:445 -
103.164.247.183:445 -
118.158.9.225:445
-
213.140.81.148:445 -
148.165.140.78:445
-
10.127.96.1:445
-
10.127.97.1:445
-
10.127.98.1:445
-
10.127.99.1:445
-
10.127.100.1:445
-
10.127.101.1:445
-
10.127.102.1:445
-
10.127.103.1:445
-
10.127.104.1:445
-
10.127.105.1:445
-
10.127.106.1:445
-
10.127.107.1:445
-
10.127.108.1:445
-
10.127.109.1:445
-
9.152.137.190:445
-
10.127.110.1:445
-
10.127.111.1:445
-
65.102.107.97:445
-
78.18.71.148:445 -
10.127.112.1:445
-
56.234.102.111:445
-
10.127.113.1:445
-
161.186.116.225:445
-
190.94.111.66:445 -
32.120.115.143:445
-
60.80.129.69:445
-
114.149.131.189:445
-
154.188.230.121:445 -
78.118.34.25:445 -
77.17.244.36:445
-
10.127.114.1:445
-
10.127.115.1:445
-
10.127.116.1:445
-
10.127.117.1:445
-
10.127.118.1:445
-
10.127.119.1:445
-
10.127.120.1:445
-
10.127.121.1:445
-
10.127.122.1:445
-
10.127.123.1:445
-
10.127.124.1:445
-
10.127.125.1:445
-
10.127.126.1:445
-
10.127.127.1:445
-
10.127.128.1:445
-
10.127.129.1:445
-
10.127.130.1:445
-
10.127.131.1:445
-
117.50.89.217:445
-
202.21.135.1:445
-
10.127.132.1:445
-
10.127.133.1:445
-
115.54.191.138:445
-
123.0.85.58:445
-
124.193.83.27:445
-
138.79.81.36:445
-
112.85.37.120:445
-
145.52.83.27:445
-
14.117.25.140:445
-
121.50.178.140:445
-
30.10.188.137:445
-
221.214.26.190:445
-
77.136.249.95:445
-
6.208.188.166:445
-
10.127.134.1:445
-
10.127.135.1:445
-
10.127.136.1:445
-
10.127.137.1:445
-
10.127.138.1:445
-
10.127.139.1:445
-
10.127.140.1:445
-
10.127.141.1:445
-
10.127.142.1:445
-
10.127.143.1:445
-
10.127.144.1:445
-
10.127.145.1:445
-
10.127.146.1:445
-
10.127.147.1:445
-
10.127.148.1:445
-
10.127.149.1:445
-
10.127.150.1:445
-
10.127.151.1:445
-
10.127.152.1:445
-
12.14.27.89:445
-
10.127.153.1:445
-
75.218.251.163:445
-
184.65.35.138:445
-
38.80.112.94:445
-
98.121.198.65:445
-
44.172.110.21:445
-
51.130.156.140:445
-
190.23.220.78:445 -
85.206.67.78:445 -
3.110.102.162:445
-
45.124.49.132:445
-
175.76.247.202:445
-
171.2.103.132:445
-
200.232.229.247:445 -
199.151.122.10:445
-
195.225.49.211:445 -
10.127.154.1:445
-
10.127.155.1:445
-
10.127.156.1:445
-
10.127.157.1:445
-
10.127.158.1:445
-
10.127.159.1:445
-
10.127.160.1:445
-
10.127.161.1:445
-
10.127.162.1:445
-
10.127.163.1:445
-
10.127.164.1:445
-
10.127.165.1:445
-
10.127.166.1:445
-
10.127.167.1:445
-
10.127.168.1:445
-
10.127.169.1:445
-
10.127.170.1:445
-
93.199.115.159:445 -
10.127.171.1:445
-
193.214.125.58:445
-
10.127.172.1:445
-
10.127.173.1:445
-
10.127.174.1:445
-
167.85.138.84:445
-
106.73.70.155:445
-
120.244.184.34:445
-
12.188.227.116:445
-
54.64.170.129:445
-
174.30.2.223:445
-
94.230.53.37:445
-
192.158.198.163:445
-
211.0.73.101:445
-
191.99.17.66:445 -
187.152.83.65:445
-
107.88.174.86:445
-
81.246.200.159:445 -
16.90.107.193:445
-
176.166.34.25:445
-
3.194.201.60:445
-
10.127.175.1:445
-
10.127.176.1:445
-
10.127.177.1:445
-
10.127.178.1:445
-
10.127.179.1:445
-
10.127.180.1:445
-
10.127.181.1:445
-
10.127.182.1:445
-
10.127.183.1:445
-
10.127.184.1:445
-
10.127.185.1:445
-
10.127.186.1:445
-
10.127.187.1:445
-
10.127.188.1:445
-
10.127.189.1:445
-
104.138.6.30:445
-
194.198.146.10:445 -
10.127.190.1:445
-
10.127.191.1:445
-
10.127.192.1:445
-
2.113.223.142:445 -
85.252.179.115:445
-
10.201.251.35:445
-
195.66.195.62:445
-
100.73.112.1:445
-
72.167.71.120:445
-
131.125.64.121:445
-
191.17.210.16:445
-
175.176.155.149:445 -
44.243.72.168:445
-
131.223.238.90:445
-
171.142.172.128:445
-
103.187.228.16:445
-
5.70.52.154:445
-
189.241.103.32:445
-
159.113.12.116:445
-
126.52.173.196:445
-
10.127.193.1:445
-
10.127.194.1:445
-
10.127.195.1:445
-
10.127.196.1:445
-
10.127.197.1:445
-
10.127.198.1:445
-
10.127.199.1:445
-
10.127.200.1:445
-
10.127.201.1:445
-
10.127.202.1:445
-
10.127.203.1:445
-
10.127.204.1:445
-
10.127.205.1:445
-
10.127.206.1:445
-
10.127.207.1:445
-
10.127.208.1:445
-
10.127.209.1:445
-
10.127.210.1:445
-
27.132.46.203:445
-
207.13.69.115:445
-
32.111.76.106:445
-
183.175.120.72:445
-
115.184.227.19:445
-
133.26.124.12:445
-
219.17.72.188:445
-
44.156.1.163:445
-
33.122.179.223:445
-
53.3.80.174:445
-
187.77.133.49:445
-
65.132.4.163:445
-
101.95.225.219:445
-
205.162.171.251:445
-
116.176.48.117:445
-
96.246.91.94:445
-
10.127.211.1:445
-
114.13.154.126:445 -
163.0.161.195:445
-
110.245.6.30:445
-
153.254.227.150:445
-
121.244.197.177:445
-
10.127.212.1:445
-
10.127.213.1:445
-
10.127.214.1:445
-
10.127.215.1:445
-
10.127.216.1:445
-
10.127.217.1:445
-
10.127.218.1:445
-
10.127.219.1:445
-
10.127.220.1:445
-
10.127.221.1:445
-
10.127.222.1:445
-
10.127.223.1:445
-
10.127.224.1:445
-
10.127.225.1:445
-
10.127.226.1:445
-
10.127.227.1:445
-
10.127.228.1:445
-
10.127.229.1:445
-
10.127.230.1:445
-
10.127.231.1:445
-
145.5.93.181:445
-
11.0.98.173:445
-
10.127.232.1:445
-
111.122.6.22:445
-
108.5.46.76:445
-
74.17.224.229:445
-
102.16.212.187:445 -
138.64.217.76:445
-
145.171.27.2:445
-
79.26.79.15:445
-
18.140.43.191:445 -
27.239.37.8:445
-
22.100.193.52:445
-
159.30.3.192:445
-
30.216.164.92:445
-
136.87.222.219:445
-
94.29.180.186:445 -
155.165.48.76:445
-
89.150.250.13:445
-
132.108.9.170:445
-
16.109.98.29:445
-
114.24.150.188:445
-
156.194.128.112:445
-
118.81.28.183:445
-
173.6.166.63:445
-
10.127.233.1:445
-
10.127.234.1:445
-
10.127.235.1:445
-
10.127.236.1:445
-
10.127.237.1:445
-
10.127.238.1:445
-
10.127.239.1:445
-
10.127.240.1:445
-
10.127.241.1:445
-
10.127.242.1:445
-
10.127.243.1:445
-
10.127.244.1:445
-
10.127.245.1:445
-
10.127.246.1:445
-
10.127.247.1:445
-
10.127.248.1:445
-
10.127.249.1:445
-
10.127.250.1:445
-
10.127.251.1:445
-
129.171.84.16:445
-
10.127.252.1:445
-
60.215.16.104:445
-
10.127.253.1:445
-
111.49.63.35:445
-
118.49.42.125:445
-
18.135.119.231:445
-
20.72.108.214:445
-
215.154.165.116:445
-
218.44.184.180:445
-
42.40.73.212:445
-
81.114.197.212:445
-
35.187.64.252:445
-
35.187.64.1:445
-
116.4.193.125:445
-
150.191.55.89:445
-
213.8.106.220:445 -
137.164.158.196:445
-
50.229.17.155:445
-
135.245.221.252:445 -
206.156.199.48:445
-
63.85.216.106:445
-
206.117.120.148:445
-
154.219.71.185:445
-
179.126.162.91:445
-
114.183.30.236:445
-
56.112.134.187:445
-
35.187.64.2:445
-
10.127.254.1:445
-
10.127.255.1:445
-
10.127.0.2:445
-
10.127.1.2:445
-
10.127.2.2:445
-
10.127.3.2:445
-
10.127.4.2:445
-
10.127.5.2:445
-
10.127.6.2:445
-
10.127.7.2:445
-
10.127.8.2:445
-
10.127.9.2:445
-
10.127.10.2:445
-
10.127.11.2:445
-
10.127.12.2:445
-
10.127.13.2:445
-
189.51.200.61:445
-
10.127.14.2:445
-
23.116.82.201:445
-
10.127.15.2:445
-
41.87.77.138:445 -
112.190.154.155:445
-
81.19.239.54:445
-
178.41.162.80:445 -
75.136.91.252:445
-
210.120.114.108:445
-
3.208.89.190:445
-
149.25.81.18:445
-
47.53.151.123:445
-
88.66.112.233:445
-
194.148.87.75:445
-
10.10.113.70:445
-
35.187.64.3:445
-
171.19.125.249:445 -
85.241.215.240:445 -
10.127.16.2:445
-
121.86.57.64:445
-
133.136.242.252:445
-
158.166.90.116:445 -
28.55.236.88:445
-
58.236.129.90:445
-
95.233.101.62:445
-
132.151.164.175:445
-
187.61.137.81:445
-
152.149.132.147:445
-
78.3.137.8:445 -
101.8.7.184:445
-
10.127.17.2:445
-
10.127.18.2:445
-
10.127.19.2:445
-
10.127.20.2:445
-
10.127.21.2:445
-
10.127.22.2:445
-
10.127.23.2:445
-
10.127.24.2:445
-
10.127.25.2:445
-
10.127.26.2:445
-
10.127.27.2:445
-
10.127.28.2:445
-
8.8.8.8:53www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comdns
DNS Request
www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
DNS Response
104.16.167.228104.16.166.228
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.4MB
MD57ed52a0a7fb64ea981388b943ef73bc1
SHA1f43cf08116d21981e2db44e2bd751501da5deeb7
SHA256034b0589d1d80a63baa8e6357ef8f6aacf16a38de687ddc9eb904d7eb696a3f0
SHA512fd802bb5351fdbff365edf66dcb2e038785a9b53f20d898a141f058312bbce306cf2a9fa203d0914d2deec2326c096fe908094348c2154fa02c54c0e5757d99d