Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
15/01/2025, 15:45 UTC
Static task
static1
Behavioral task
behavioral1
Sample
2025-01-15_0099cccd9edee63a16401de6ada30188_wannacry.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2025-01-15_0099cccd9edee63a16401de6ada30188_wannacry.exe
Resource
win10v2004-20241007-en
General
-
Target
2025-01-15_0099cccd9edee63a16401de6ada30188_wannacry.exe
-
Size
3.6MB
-
MD5
0099cccd9edee63a16401de6ada30188
-
SHA1
337fae1a1df732a03fdf36b8086722029552802d
-
SHA256
10f11a389f3bc20e9a7123820a6affd7fe354e9fe016a653f1d6151f4236c8cc
-
SHA512
4d6a908a03f279de051a972342ddc7cf731c4bd73f350b4368c8c462b44f7f344312c856f94baf7fe2ea7ce7cddd238f6f6d751161ffd056528ba753e0b38b39
-
SSDEEP
98304:yDqPoBhz1aRxcSUDk36SAEdhvxWa9P59UctAVp2HI:yDqPe1Cxcxk3ZAEUad9c4HI
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Wannacry family
-
Contacts a large (3260) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 1 IoCs
pid Process 4620 tasksche.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\WINDOWS\tasksche.exe 2025-01-15_0099cccd9edee63a16401de6ada30188_wannacry.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-01-15_0099cccd9edee63a16401de6ada30188_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-01-15_0099cccd9edee63a16401de6ada30188_wannacry.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 2025-01-15_0099cccd9edee63a16401de6ada30188_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 2025-01-15_0099cccd9edee63a16401de6ada30188_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 2025-01-15_0099cccd9edee63a16401de6ada30188_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 2025-01-15_0099cccd9edee63a16401de6ada30188_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 2025-01-15_0099cccd9edee63a16401de6ada30188_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-15_0099cccd9edee63a16401de6ada30188_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-15_0099cccd9edee63a16401de6ada30188_wannacry.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:840 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i2⤵
- Executes dropped EXE
PID:4620
-
-
C:\Users\Admin\AppData\Local\Temp\2025-01-15_0099cccd9edee63a16401de6ada30188_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2025-01-15_0099cccd9edee63a16401de6ada30188_wannacry.exe -m security1⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:3976
Network
-
DNSwww.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com2025-01-15_0099cccd9edee63a16401de6ada30188_wannacry.exeRemote address:8.8.8.8:53Requestwww.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comIN AResponsewww.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comIN A104.16.166.228www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comIN A104.16.167.228
-
Remote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle
-
GEThttp://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/2025-01-15_0099cccd9edee63a16401de6ada30188_wannacry.exeRemote address:104.16.166.228:80RequestGET / HTTP/1.1
Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 607
Connection: close
Server: cloudflare
CF-RAY: 9026fdba9f196539-LHR
-
GEThttp://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/2025-01-15_0099cccd9edee63a16401de6ada30188_wannacry.exeRemote address:104.16.166.228:80RequestGET / HTTP/1.1
Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 607
Connection: close
Server: cloudflare
CF-RAY: 9026fdbbce919496-LHR
-
Remote address:8.8.8.8:53Request13.86.106.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request228.166.16.104.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request8.153.16.2.in-addr.arpaIN PTRResponse8.153.16.2.in-addr.arpaIN PTRa2-16-153-8deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request71.31.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request167.173.78.104.in-addr.arpaIN PTRResponse167.173.78.104.in-addr.arpaIN PTRa104-78-173-167deploystaticakamaitechnologiescom
-
Request212.20.149.52.in-addr.arpaIN PTRResponse
-
Request206.23.85.13.in-addr.arpaIN PTRResponse
-
Request167.190.18.2.in-addr.arpaIN PTRResponse167.190.18.2.in-addr.arpaIN PTRa2-18-190-167deploystaticakamaitechnologiescom
-
Request172.210.232.199.in-addr.arpaIN PTRResponse
-
Request43.229.111.52.in-addr.arpaIN PTRResponse
-
Request1.190.30.152.in-addr.arpaIN PTRResponse
-
Request103.190.30.152.in-addr.arpaIN PTRResponse
-
Request79.148.66.83.in-addr.arpaIN PTRResponse
-
Request79.148.66.83.in-addr.arpaIN PTR
-
Request1.148.66.83.in-addr.arpaIN PTRResponse
-
Request87.145.215.85.in-addr.arpaIN PTRResponse87.145.215.85.in-addr.arpaIN PTRip85-215-5-145-87pbiaascom
-
Request12.145.215.85.in-addr.arpaIN PTRResponse12.145.215.85.in-addr.arpaIN PTRip85-215-5-145-12pbiaascom
-
Request2.190.30.152.in-addr.arpaIN PTRResponse
-
Request2.190.30.152.in-addr.arpaIN PTR
-
Request174.117.168.52.in-addr.arpaIN PTRResponse
-
104.16.166.228:80http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/http2025-01-15_0099cccd9edee63a16401de6ada30188_wannacry.exe376 B 990 B 6 5
HTTP Request
GET http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/HTTP Response
200 -
104.16.166.228:80http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/http2025-01-15_0099cccd9edee63a16401de6ada30188_wannacry.exe376 B 990 B 6 5
HTTP Request
GET http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/HTTP Response
200 -
52 B 1
-
52 B 1
-
-
-
-
-
-
-
-
-
-
-
104 B 2
-
-
-
-
-
-
-
-
-
-
-
-
52 B 1
-
-
104 B 2
-
-
-
-
-
104 B 2
-
52 B 1
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
104 B 2
-
104 B 2
-
-
-
52 B 1
-
104 B 2
-
104 B 2
-
52 B 1
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
104 B 2
-
-
-
104 B 2
-
52 B 1
-
104 B 2
-
104 B 2
-
52 B 1
-
52 B 1
-
104 B 2
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
52 B 1
-
-
52 B 1
-
-
-
-
104 B 2
-
104 B 2
-
52 B 1
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
104 B 2
-
-
52 B 1
-
-
-
-
52 B 1
-
-
-
52 B 1
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
52 B 1
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
52 B 1
-
-
104 B 2
-
-
104 B 2
-
-
-
104 B 2
-
104 B 2
-
52 B 1
-
104 B 2
-
104 B 2
-
-
104 B 2
-
52 B 1
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
104 B 2
-
-
52 B 1
-
-
-
-
104 B 2
-
104 B 2
-
104 B 2
-
52 B 1
-
-
104 B 2
-
52 B 1
-
52 B 1
-
104 B 2
-
104 B 2
-
104 B 80 B 2 2
-
104 B 2
-
104 B 2
-
104 B 2
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
104 B 2
-
-
104 B 2
-
-
-
52 B 1
-
52 B 1
-
-
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
52 B 1
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
52 B 1
-
104 B 2
-
-
-
52 B 1
-
-
104 B 2
-
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
104 B 2
-
-
52 B 1
-
104 B 2
-
-
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
52 B 1
-
104 B 2
-
104 B 2
-
104 B 2
-
52 B 1
-
104 B 2
-
104 B 2
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
52 B 1
-
104 B 2
-
52 B 1
-
-
-
104 B 2
-
104 B 2
-
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
-
104 B 2
-
104 B 2
-
104 B 2
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
104 B 2
-
104 B 2
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
104 B 2
-
104 B 2
-
-
104 B 2
-
-
104 B 2
-
52 B 1
-
52 B 1
-
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
52 B 1
-
52 B 1
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
52 B 1
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
104 B 2
-
104 B 2
-
104 B 2
-
52 B 1
-
52 B 1
-
104 B 80 B 2 2
-
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
104 B 2
-
-
52 B 1
-
104 B 2
-
104 B 2
-
104 B 2
-
104 B 2
-
52 B 1
-
8.8.8.8:53www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comdns2025-01-15_0099cccd9edee63a16401de6ada30188_wannacry.exe95 B 127 B 1 1
DNS Request
www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
DNS Response
104.16.166.228104.16.167.228
-
66 B 90 B 1 1
DNS Request
8.8.8.8.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
13.86.106.20.in-addr.arpa
-
73 B 135 B 1 1
DNS Request
228.166.16.104.in-addr.arpa
-
69 B 131 B 1 1
DNS Request
8.153.16.2.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
71.31.126.40.in-addr.arpa
-
73 B 139 B 1 1
DNS Request
167.173.78.104.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.4MB
MD553630114dbc51910879f968d0148abdb
SHA1e897138a0f0266d0d0e29e03f8816d08b483054d
SHA256a10c30f76c602083956bdc991486ea598b20b72e395106b39ac14434827688d2
SHA5127cb1ff56e009743c9574ae39034c880e40e0202b17d20ff5dc7cb923103c97428aa8b877c84a729b5f0b47f20cc087816be8eecaf38cd40f475d1a9f1227e769