Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
15/01/2025, 12:09
250115-pbg4vaskhs 1015/01/2025, 12:05
250115-n9j6estndq 1015/01/2025, 10:51
250115-mx374a1jft 10Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
15/01/2025, 12:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe
Resource
win7-20240729-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe
-
Size
5.0MB
-
MD5
075ca33b35164058d848ac1cb410dc42
-
SHA1
5e37df9dd0fe22c3623453476d4a13f0b96826e0
-
SHA256
a201e56c992edf1fd30417991b95127f99888c6d27747899f65504e6893ddd1d
-
SHA512
f22cb008f65544cb00947ce6f7995aeba073473da25b3584b0217bc32c18a44807a05246ab4fff58a5d86e01be49e01efbe27045decc681f051edbe1e609d545
-
SSDEEP
98304:XDaiEkmnfZ1aRxcSUDk36SAEdhX0Aj4Ouenmur2uuh:XDa6mnfZ1Cxcxk3ZAE70AjKem/uuh
Score
10/10
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Wannacry family
-
Contacts a large (3254) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 1 IoCs
pid Process 2000 tasksche.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\WINDOWS\tasksche.exe 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe -
Modifies data under HKEY_USERS 24 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-b2-d5-76-d1-c9\WpadDecisionTime = 4016734c4667db01 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0127000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A7443692-E514-43B5-B715-15866F785080}\WpadDecisionTime = 4016734c4667db01 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A7443692-E514-43B5-B715-15866F785080}\WpadNetworkName = "Network 3" 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-b2-d5-76-d1-c9\WpadDecisionReason = "1" 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A7443692-E514-43B5-B715-15866F785080}\WpadDecision = "0" 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-b2-d5-76-d1-c9 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A7443692-E514-43B5-B715-15866F785080}\WpadDecisionReason = "1" 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A7443692-E514-43B5-B715-15866F785080}\0a-b2-d5-76-d1-c9 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-b2-d5-76-d1-c9\WpadDecision = "0" 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A7443692-E514-43B5-B715-15866F785080} 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 556 taskmgr.exe -
Suspicious use of FindShellTrayWindow 38 IoCs
pid Process 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe -
Suspicious use of SendNotifyMessage 38 IoCs
pid Process 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe 556 taskmgr.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2504 wrote to memory of 2000 2504 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe 31 PID 2504 wrote to memory of 2000 2504 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe 31 PID 2504 wrote to memory of 2000 2504 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe 31 PID 2504 wrote to memory of 2000 2504 2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i2⤵
- Executes dropped EXE
PID:2000
-
-
C:\Users\Admin\AppData\Local\Temp\2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2025-01-15_075ca33b35164058d848ac1cb410dc42_wannacry.exe -m security1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2680
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:320
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:556
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2224
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.4MB
MD54a392478a337b59561bbabcb609db282
SHA1e1983828982ff6597d151169582c06f5f56ba453
SHA256f5bea6ca87381376fea669c72f49c7b0bf8ef5fdf307cd5057a23dfa40917125
SHA5127d9885e893abb73fe65cfa38c97303b4dd32a98f23972c5e7c12074fa2dd16d7bc84e4bcad7dffb8ec219cc3bd7a23ab272bbce5f4a3c3c6ea326fddab924fdd