Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
15/01/2025, 12:09
250115-pbg4vaskhs 1015/01/2025, 12:05
250115-n9j6estndq 1015/01/2025, 10:51
250115-mx374a1jft 10Analysis
-
max time kernel
38s -
max time network
38s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
15/01/2025, 12:05
Static task
static1
Behavioral task
behavioral1
Sample
2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe
Resource
win10v2004-20241007-en
General
-
Target
2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe
-
Size
5.0MB
-
MD5
075ca33b35164058d848ac1cb410dc42
-
SHA1
5e37df9dd0fe22c3623453476d4a13f0b96826e0
-
SHA256
a201e56c992edf1fd30417991b95127f99888c6d27747899f65504e6893ddd1d
-
SHA512
f22cb008f65544cb00947ce6f7995aeba073473da25b3584b0217bc32c18a44807a05246ab4fff58a5d86e01be49e01efbe27045decc681f051edbe1e609d545
-
SSDEEP
98304:XDaiEkmnfZ1aRxcSUDk36SAEdhX0Aj4Ouenmur2uuh:XDa6mnfZ1Cxcxk3ZAE70AjKem/uuh
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Wannacry family
-
Executes dropped EXE 1 IoCs
pid Process 1572 tasksche.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\WINDOWS\tasksche.exe 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies data under HKEY_USERS 24 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DE1E7939-25D2-4492-A652-BE4BBBF80907} 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DE1E7939-25D2-4492-A652-BE4BBBF80907}\WpadDecision = "0" 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DE1E7939-25D2-4492-A652-BE4BBBF80907}\WpadNetworkName = "Network 3" 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-31-61-cf-9d-5a\WpadDecisionTime = a04850d34567db01 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-31-61-cf-9d-5a\WpadDecisionReason = "1" 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-31-61-cf-9d-5a\WpadDecision = "0" 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00dc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DE1E7939-25D2-4492-A652-BE4BBBF80907}\WpadDecisionTime = a04850d34567db01 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-31-61-cf-9d-5a 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DE1E7939-25D2-4492-A652-BE4BBBF80907}\WpadDecisionReason = "1" 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DE1E7939-25D2-4492-A652-BE4BBBF80907}\06-31-61-cf-9d-5a 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe -
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\temp_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\.temp rundll32.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\temp_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\temp_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\temp_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\temp_auto_file\ rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\.temp\ = "temp_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\temp_auto_file\shell rundll32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1580 AcroRd32.exe 1580 AcroRd32.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2300 wrote to memory of 1572 2300 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe 32 PID 2300 wrote to memory of 1572 2300 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe 32 PID 2300 wrote to memory of 1572 2300 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe 32 PID 2300 wrote to memory of 1572 2300 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe 32 PID 2532 wrote to memory of 1580 2532 rundll32.exe 34 PID 2532 wrote to memory of 1580 2532 rundll32.exe 34 PID 2532 wrote to memory of 1580 2532 rundll32.exe 34 PID 2532 wrote to memory of 1580 2532 rundll32.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i2⤵
- Executes dropped EXE
PID:1572
-
-
C:\Users\Admin\AppData\Local\Temp\2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe -m security1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2440
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Desktop\RenameInstall.temp1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\Desktop\RenameInstall.temp"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1580
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.4MB
MD54a392478a337b59561bbabcb609db282
SHA1e1983828982ff6597d151169582c06f5f56ba453
SHA256f5bea6ca87381376fea669c72f49c7b0bf8ef5fdf307cd5057a23dfa40917125
SHA5127d9885e893abb73fe65cfa38c97303b4dd32a98f23972c5e7c12074fa2dd16d7bc84e4bcad7dffb8ec219cc3bd7a23ab272bbce5f4a3c3c6ea326fddab924fdd