Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    17-01-2025 03:47

General

  • Target

    2025-01-17_e5c2a69fb7d0534f11e5278f98cfb420_wannacry.exe

  • Size

    3.6MB

  • MD5

    e5c2a69fb7d0534f11e5278f98cfb420

  • SHA1

    4855bf08db7b937a61bd85ed225b08f0497c2e1e

  • SHA256

    ea7c389d70c92a52ef6c6e6be13bf3b7cd0c0862d2fc1928f52cdc7b9f0a2f40

  • SHA512

    a332a406c548f5f9deff58fa26b0a3ab1d7da3b9cd6eb5ded160bbfbec128eac02afb7a64a5895411ec0ade6e7edc5f953ae76894099cf66b48145efd20380f2

  • SSDEEP

    98304:XDqPoBhzyk36SAEdhvxWa9P593R8yAVp2HI:XDqPeyk3ZAEUadzR8yc4HI

Malware Config

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

  • Wannacry family
  • Contacts a large (3318) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Executes dropped EXE 1 IoCs
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-01-17_e5c2a69fb7d0534f11e5278f98cfb420_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-01-17_e5c2a69fb7d0534f11e5278f98cfb420_wannacry.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    PID:2792
    • C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      2⤵
      • Executes dropped EXE
      PID:2336
  • C:\Users\Admin\AppData\Local\Temp\2025-01-17_e5c2a69fb7d0534f11e5278f98cfb420_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp\2025-01-17_e5c2a69fb7d0534f11e5278f98cfb420_wannacry.exe -m security
    1⤵
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    PID:2296

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\tasksche.exe

    Filesize

    3.4MB

    MD5

    a556cc99d7a52801e97a0f3c02d61f87

    SHA1

    2c2a8ab0adddc307eb2cc35e62dc1496794d3942

    SHA256

    c157dacd4ea2a1c46494a4bbc8d6835de32d6cf9577a4b0206d9aa5e3c95ed63

    SHA512

    336ec1d020451f426a04aaec2af51c1e455a174d0f400e9c487f9f75314757f974daea360dd2076a49c0c0f21596626902395ad88766e8c53de396938c2ad397