Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
17/01/2025, 13:06 UTC
General
-
Target
2025-01-17_ef81701ccdc59dd94ad6b48ad46f62a0_wannacry.exe
-
Size
5.0MB
-
MD5
ef81701ccdc59dd94ad6b48ad46f62a0
-
SHA1
f92c12edd7669f9e23072f1f5cd5a2747e5a6341
-
SHA256
94932326eb5d21e13dac1ead1be2d203ee34a24aac1644a0cf7468cb80d52d89
-
SHA512
e1c4167e153458970a2751d33680f3fba5dd1411eb39c8a2e6c15d8fe91032c8d173c5ec8aa12970b6ef646a3e1f632325b7aecbfffa3f6f0e6f644fa2a64d4f
-
SSDEEP
49152:VnjQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJMpAH:Z8qPoBhz1aRxcSUDk36SAEdhvxWyH
Score
10/10
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Wannacry family
-
Contacts a large (3253) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 1 IoCs
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-17_ef81701ccdc59dd94ad6b48ad46f62a0_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-17_ef81701ccdc59dd94ad6b48ad46f62a0_wannacry.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\2025-01-17_ef81701ccdc59dd94ad6b48ad46f62a0_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2025-01-17_ef81701ccdc59dd94ad6b48ad46f62a0_wannacry.exe -m security1⤵
- System Location Discovery: System Language Discovery
Network
-
DNS149.220.183.52.in-addr.arpaRemote address:8.8.8.8:53Request149.220.183.52.in-addr.arpaIN PTRResponse -
DNS5.114.82.104.in-addr.arpaRemote address:8.8.8.8:53Request5.114.82.104.in-addr.arpaIN PTRResponse5.114.82.104.in-addr.arpaIN PTRa104-82-114-5deploystaticakamaitechnologiescom
-
DNS67.31.126.40.in-addr.arpaRemote address:8.8.8.8:53Request67.31.126.40.in-addr.arpaIN PTRResponse
-
DNS209.205.72.20.in-addr.arpaRemote address:8.8.8.8:53Request209.205.72.20.in-addr.arpaIN PTRResponse
-
DNS104.219.191.52.in-addr.arpaRemote address:8.8.8.8:53Request104.219.191.52.in-addr.arpaIN PTRResponse
-
DNS56.163.245.4.in-addr.arpaRequest56.163.245.4.in-addr.arpaIN PTRResponse
-
DNS18.31.95.13.in-addr.arpaRequest18.31.95.13.in-addr.arpaIN PTRResponse
-
DNS60.114.200.31.in-addr.arpaRequest60.114.200.31.in-addr.arpaIN PTRResponse
-
DNS1.114.200.31.in-addr.arpaRequest1.114.200.31.in-addr.arpaIN PTRResponse
-
DNS46.92.201.35.in-addr.arpaRequest46.92.201.35.in-addr.arpaIN PTRResponse46.92.201.35.in-addr.arpaIN PTR469220135bcgoogleusercontentcom
-
DNS11.92.201.35.in-addr.arpaRequest11.92.201.35.in-addr.arpaIN PTRResponse11.92.201.35.in-addr.arpaIN PTR119220135bcgoogleusercontentcom
-
DNS14.92.201.35.in-addr.arpaRequest14.92.201.35.in-addr.arpaIN PTRResponse14.92.201.35.in-addr.arpaIN PTR149220135bcgoogleusercontentcom
-
DNS20.92.201.35.in-addr.arpaRequest20.92.201.35.in-addr.arpaIN PTRResponse20.92.201.35.in-addr.arpaIN PTR209220135bcgoogleusercontentcom
-
DNS23.92.201.35.in-addr.arpaRequest23.92.201.35.in-addr.arpaIN PTRResponse23.92.201.35.in-addr.arpaIN PTR239220135bcgoogleusercontentcom
-
DNS24.92.201.35.in-addr.arpaRequest24.92.201.35.in-addr.arpaIN PTRResponse24.92.201.35.in-addr.arpaIN PTR249220135bcgoogleusercontentcom
-
DNS28.92.201.35.in-addr.arpaRequest28.92.201.35.in-addr.arpaIN PTRResponse28.92.201.35.in-addr.arpaIN PTR289220135bcgoogleusercontentcom
-
DNS30.92.201.35.in-addr.arpaRequest30.92.201.35.in-addr.arpaIN PTRResponse30.92.201.35.in-addr.arpaIN PTR309220135bcgoogleusercontentcom
-
DNS114.211.167.144.in-addr.arpaRequest114.211.167.144.in-addr.arpaIN PTRResponse
-
DNS1.211.167.144.in-addr.arpaRequest1.211.167.144.in-addr.arpaIN PTRResponse
-
DNS36.92.201.35.in-addr.arpaRequest36.92.201.35.in-addr.arpaIN PTRResponse36.92.201.35.in-addr.arpaIN PTR369220135bcgoogleusercontentcom
-
DNS2.114.200.31.in-addr.arpaRequest2.114.200.31.in-addr.arpaIN PTRResponse
-
DNS38.92.201.35.in-addr.arpaRequest38.92.201.35.in-addr.arpaIN PTRResponse38.92.201.35.in-addr.arpaIN PTR389220135bcgoogleusercontentcom
-
DNS47.92.201.35.in-addr.arpaRequest47.92.201.35.in-addr.arpaIN PTRResponse47.92.201.35.in-addr.arpaIN PTR479220135bcgoogleusercontentcom
-
DNS48.92.201.35.in-addr.arpaRequest48.92.201.35.in-addr.arpaIN PTRResponse48.92.201.35.in-addr.arpaIN PTR489220135bcgoogleusercontentcom
-
142.232.240.70:445 -
10.127.0.1:445 -
139.133.161.114:445 -
10.127.1.1:445
-
10.127.2.1:445
-
10.127.3.1:445
-
10.127.4.1:445
-
10.127.5.1:445
-
10.127.6.1:445
-
10.127.7.1:445
-
10.127.8.1:445
-
10.127.9.1:445
-
10.127.10.1:445
-
10.127.11.1:445
-
10.127.12.1:445
-
10.127.13.1:445
-
10.127.14.1:445
-
10.127.15.1:445
-
10.127.16.1:445
-
10.127.17.1:445
-
10.127.18.1:445
-
10.127.19.1:445
-
10.127.20.1:445
-
10.127.21.1:445
-
183.213.108.162:445 -
102.251.254.173:445 -
134.165.70.216:445
-
10.127.22.1:445
-
10.127.23.1:445
-
10.127.24.1:445
-
10.127.25.1:445
-
10.127.26.1:445
-
10.127.27.1:445
-
10.127.28.1:445
-
10.127.29.1:445
-
10.127.30.1:445
-
10.127.31.1:445
-
10.127.32.1:445
-
10.127.33.1:445
-
10.127.34.1:445
-
152.67.10.11:445 -
10.127.35.1:445
-
10.127.36.1:445
-
10.127.37.1:445
-
10.127.38.1:445
-
10.127.39.1:445
-
141.16.141.12:445 -
147.176.118.78:445 -
218.137.106.97:445
-
10.127.40.1:445
-
180.194.234.112:445 -
10.127.41.1:445
-
10.127.42.1:445
-
10.127.43.1:445
-
10.127.44.1:445
-
10.127.45.1:445
-
10.127.46.1:445
-
10.127.47.1:445
-
10.127.48.1:445
-
10.127.49.1:445
-
10.127.50.1:445
-
10.127.51.1:445
-
10.127.52.1:445
-
10.127.53.1:445
-
10.127.54.1:445
-
57.94.23.229:445 -
10.127.55.1:445
-
10.127.56.1:445
-
10.127.57.1:445
-
123.145.240.73:445
-
10.127.58.1:445
-
151.13.120.36:445 -
10.127.59.1:445
-
21.66.146.193:445
-
4.23.242.105:445
-
87.92.25.164:445 -
175.127.144.26:445 -
10.127.60.1:445
-
10.127.61.1:445
-
10.127.62.1:445
-
10.127.63.1:445
-
10.127.64.1:445
-
10.127.65.1:445
-
10.127.66.1:445
-
10.127.67.1:445
-
10.127.68.1:445
-
10.127.69.1:445
-
10.127.70.1:445
-
10.127.71.1:445
-
10.127.72.1:445
-
10.127.73.1:445
-
10.127.74.1:445
-
10.127.75.1:445
-
10.127.76.1:445
-
117.65.231.224:445
-
10.127.77.1:445
-
110.120.141.120:445
-
10.127.78.1:445
-
10.127.79.1:445
-
187.40.115.78:445 -
66.117.60.3:445
-
85.4.56.210:445 -
148.4.250.54:445
-
188.59.122.177:445 -
22.177.126.119:445
-
91.111.31.226:445
-
159.211.86.204:445
-
10.127.80.1:445
-
10.127.81.1:445
-
10.127.82.1:445
-
10.127.83.1:445
-
10.127.84.1:445
-
10.127.85.1:445
-
10.127.86.1:445
-
10.127.87.1:445
-
10.127.88.1:445
-
10.127.89.1:445
-
10.127.90.1:445
-
10.127.91.1:445
-
10.127.92.1:445
-
10.127.93.1:445
-
10.127.94.1:445
-
10.127.95.1:445
-
10.127.96.1:445
-
10.127.97.1:445
-
10.127.98.1:445
-
66.135.51.128:445
-
172.123.232.170:445
-
172.4.50.136:445
-
110.69.165.119:445
-
7.236.117.105:445
-
98.83.188.23:445
-
170.254.252.64:445
-
172.151.106.211:445
-
139.93.183.246:445
-
50.173.187.207:445
-
138.188.186.163:445
-
10.127.99.1:445
-
10.127.100.1:445
-
10.127.101.1:445
-
10.127.102.1:445
-
10.127.103.1:445
-
10.127.104.1:445
-
10.127.105.1:445
-
10.127.106.1:445
-
10.127.107.1:445
-
10.127.108.1:445
-
10.127.109.1:445
-
10.127.110.1:445
-
10.127.111.1:445
-
10.127.112.1:445
-
10.127.113.1:445
-
10.127.114.1:445
-
10.127.115.1:445
-
10.127.116.1:445
-
10.127.117.1:445
-
10.127.118.1:445
-
10.127.119.1:445
-
24.137.197.108:445
-
10.127.120.1:445
-
76.102.214.212:445
-
193.222.68.173:445
-
141.132.143.170:445 -
178.242.220.221:445
-
3.54.129.141:445
-
104.28.208.36:445
-
52.86.247.67:445
-
10.127.121.1:445
-
10.127.122.1:445
-
10.127.123.1:445
-
10.127.124.1:445
-
10.127.125.1:445
-
10.127.126.1:445
-
10.127.127.1:445
-
10.127.128.1:445
-
10.127.129.1:445
-
90.232.3.63:445 -
109.159.78.31:445
-
221.252.249.155:445
-
111.26.84.79:445
-
63.113.74.214:445
-
10.127.130.1:445
-
10.127.131.1:445
-
10.127.132.1:445
-
10.127.133.1:445
-
10.127.134.1:445
-
10.127.135.1:445
-
10.127.136.1:445
-
10.127.137.1:445
-
10.127.138.1:445
-
10.127.139.1:445
-
125.83.94.172:445
-
10.127.140.1:445
-
153.55.56.228:445
-
41.148.118.241:445
-
119.203.245.124:445
-
95.155.41.169:445 -
42.115.53.122:445 -
10.127.141.1:445
-
50.10.184.242:445
-
104.144.120.122:445
-
59.65.198.184:445
-
170.194.127.64:445
-
58.4.197.212:445
-
6.92.220.85:445
-
215.99.45.80:445
-
155.247.118.73:445
-
10.127.142.1:445
-
10.127.143.1:445
-
10.127.144.1:445
-
10.127.145.1:445
-
10.127.146.1:445
-
10.127.147.1:445
-
10.127.148.1:445
-
10.127.149.1:445
-
10.127.150.1:445
-
10.127.151.1:445
-
10.127.152.1:445
-
10.127.153.1:445
-
10.127.154.1:445
-
10.127.155.1:445
-
10.127.156.1:445
-
10.127.157.1:445
-
10.127.158.1:445
-
38.26.21.144:445
-
156.74.104.160:445
-
188.173.219.220:445 -
166.249.27.123:445
-
89.94.21.239:445 -
95.227.57.98:445
-
8.39.174.53:445
-
217.173.225.41:445 -
88.25.87.199:445 -
10.127.159.1:445
-
55.218.143.227:445
-
136.138.103.12:445
-
204.9.248.132:445
-
71.176.1.100:445
-
183.20.233.62:445
-
10.127.160.1:445
-
109.222.8.197:445
-
166.173.6.93:445
-
10.127.161.1:445
-
10.127.162.1:445
-
10.127.163.1:445
-
10.127.164.1:445
-
10.127.165.1:445
-
10.127.166.1:445
-
10.127.167.1:445
-
10.127.168.1:445
-
10.127.169.1:445
-
10.127.170.1:445
-
10.127.171.1:445
-
10.127.172.1:445
-
10.127.173.1:445
-
10.127.174.1:445
-
10.127.175.1:445
-
10.127.176.1:445
-
10.127.177.1:445
-
10.127.178.1:445
-
133.154.63.167:445
-
10.127.179.1:445
-
125.215.124.226:445
-
98.160.31.72:445
-
3.200.30.2:445
-
20.170.226.44:445
-
164.77.40.239:445 -
71.137.160.114:445
-
189.215.236.44:445 -
166.26.32.208:445
-
58.62.48.140:445
-
78.196.190.143:445
-
213.154.244.178:445 -
10.127.180.1:445
-
125.58.31.93:445
-
82.14.241.161:445
-
170.109.249.45:445
-
70.142.99.39:445
-
53.50.101.146:445
-
47.235.152.148:445
-
10.127.181.1:445
-
10.127.182.1:445
-
10.127.183.1:445
-
10.127.184.1:445
-
10.127.185.1:445
-
10.127.186.1:445
-
10.127.187.1:445
-
10.127.188.1:445
-
10.127.189.1:445
-
10.127.190.1:445
-
10.127.191.1:445
-
10.127.192.1:445
-
10.127.193.1:445
-
10.127.194.1:445
-
10.127.195.1:445
-
10.127.196.1:445
-
10.127.197.1:445
-
10.127.198.1:445
-
10.127.199.1:445
-
10.127.200.1:445
-
101.208.178.66:445
-
189.92.247.105:445
-
41.218.222.38:445 -
1.89.23.71:445
-
148.24.167.4:445
-
10.194.161.84:445
-
221.27.141.172:445
-
222.2.63.101:445
-
6.88.134.200:445
-
2.168.223.110:445
-
130.224.241.50:445
-
10.127.201.1:445
-
10.127.202.1:445
-
10.127.203.1:445
-
10.127.204.1:445
-
10.127.205.1:445
-
10.127.206.1:445
-
10.127.207.1:445
-
10.127.208.1:445
-
10.127.209.1:445
-
10.127.210.1:445
-
10.127.211.1:445
-
10.127.212.1:445
-
120.140.85.23:445 -
79.164.89.93:445 -
10.127.213.1:445
-
10.127.214.1:445
-
41.149.180.227:445
-
10.127.215.1:445
-
97.196.94.218:445
-
10.127.216.1:445
-
46.79.210.177:445
-
76.157.152.241:445
-
195.156.33.164:445
-
10.127.217.1:445
-
10.127.218.1:445
-
10.127.219.1:445
-
10.127.220.1:445
-
2.226.168.102:445
-
100.183.168.206:445
-
10.127.221.1:445
-
10.127.222.1:445
-
112.123.136.165:445
-
48.68.86.27:445
-
99.90.106.252:445
-
99.24.9.227:445
-
173.166.183.238:445
-
30.95.127.77:445
-
159.231.146.242:445
-
169.222.10.38:445
-
30.49.185.6:445
-
66.67.26.47:445
-
51.30.30.79:445
-
155.62.20.85:445 -
10.127.223.1:445
-
10.127.224.1:445
-
10.127.225.1:445
-
10.127.226.1:445
-
10.127.227.1:445
-
10.127.228.1:445
-
10.127.229.1:445
-
10.127.230.1:445
-
10.127.231.1:445
-
10.127.232.1:445
-
10.127.233.1:445
-
14.198.20.36:445 -
140.125.222.250:445 -
10.127.234.1:445
-
100.88.106.5:445
-
111.230.244.102:445
-
10.127.235.1:445
-
10.127.236.1:445
-
10.127.237.1:445
-
193.143.139.197:445
-
217.68.130.217:445
-
97.91.63.227:445
-
10.127.238.1:445
-
202.182.133.36:445
-
88.107.218.212:445
-
173.126.66.231:445
-
10.127.239.1:445
-
10.127.240.1:445
-
10.127.241.1:445
-
208.51.131.85:445
-
1.165.251.144:445
-
118.74.37.109:445
-
135.162.240.109:445
-
57.160.9.221:445
-
41.38.76.217:445 -
214.199.118.251:445
-
207.92.15.105:445
-
190.71.226.86:445 -
106.135.56.44:445
-
223.203.146.160:445
-
88.16.136.111:445
-
143.245.174.108:445 -
10.127.242.1:445
-
10.127.243.1:445
-
10.127.244.1:445
-
10.127.245.1:445
-
10.127.246.1:445
-
10.127.247.1:445
-
10.127.248.1:445
-
10.127.249.1:445
-
10.127.250.1:445
-
10.127.251.1:445
-
10.127.252.1:445
-
10.127.253.1:445
-
10.127.254.1:445
-
204.112.177.156:445
-
12.241.33.240:445
-
10.127.255.1:445
-
10.127.0.2:445
-
35.204.243.180:445
-
125.101.204.202:445
-
10.127.1.2:445
-
168.14.123.97:445
-
63.26.224.23:445
-
121.66.31.197:445
-
10.127.2.2:445
-
10.127.3.2:445
-
174.174.247.56:445
-
10.127.4.2:445
-
8.114.70.149:445
-
99.188.1.56:445
-
10.127.5.2:445
-
10.127.6.2:445
-
13.196.92.25:445
-
117.106.45.163:445
-
27.113.7.46:445
-
140.123.46.57:445
-
138.253.213.117:445
-
19.67.30.13:445
-
135.188.53.65:445
-
88.247.92.154:445
-
203.65.250.52:445
-
124.101.204.27:445
-
114.135.44.98:445
-
83.209.117.125:445
-
83.204.220.42:445
-
41.104.138.177:445 -
10.127.7.2:445
-
10.127.8.2:445
-
10.127.9.2:445
-
10.127.10.2:445
-
10.127.11.2:445
-
10.127.12.2:445
-
10.127.13.2:445
-
10.127.14.2:445
-
10.127.15.2:445
-
10.127.16.2:445
-
10.127.17.2:445
-
124.2.5.177:445
-
180.224.185.220:445
-
37.8.72.52:445 -
10.127.18.2:445
-
10.127.19.2:445
-
10.127.20.2:445
-
96.124.84.169:445
-
32.208.133.32:445
-
10.127.21.2:445
-
10.127.22.2:445
-
66.124.20.17:445
-
171.50.0.163:445
-
51.14.216.33:445
-
10.127.23.2:445
-
10.127.24.2:445
-
10.127.25.2:445
-
136.18.67.200:445
-
92.165.215.234:445
-
10.127.26.2:445
-
62.126.90.212:445
-
10.127.27.2:445
-
28.85.62.166:445
-
10.127.28.2:445
-
168.5.20.168:445
-
46.40.150.201:445 -
176.138.94.241:445
-
67.181.251.89:445
-
7.68.26.93:445
-
73.124.169.159:445
-
160.232.87.155:445
-
37.206.207.172:445
-
154.173.71.83:445
-
213.121.204.228:445
-
173.39.243.22:445
-
141.68.35.98:445
-
93.102.4.189:445 -
29.102.195.97:445
-
136.99.208.186:445
-
10.127.29.2:445
-
10.127.30.2:445
-
10.127.31.2:445
-
10.127.32.2:445
-
10.127.33.2:445
-
8.8.8.8:53149.220.183.52.in-addr.arpadns
DNS Request
149.220.183.52.in-addr.arpa
-
8.8.8.8:535.114.82.104.in-addr.arpadns
DNS Request
5.114.82.104.in-addr.arpa
-
8.8.8.8:5367.31.126.40.in-addr.arpadns
DNS Request
67.31.126.40.in-addr.arpa
-
8.8.8.8:53209.205.72.20.in-addr.arpadns
DNS Request
209.205.72.20.in-addr.arpa
-
8.8.8.8:53104.219.191.52.in-addr.arpadns
DNS Request
104.219.191.52.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.4MB
MD5a49732eb38252b2d7b4e03f2d4e817ca
SHA18a564504cab420d56a68ce63a77b90b19edd68cb
SHA256f6cf0372e43b23516cd62d562491514757fa5e0974bfcead1837e66090ebb680
SHA5125ae174c7e6744145fab28189dcf9253ed798f52525b52affa4a595cf5c0c39159e0eab4cb129d9dca9932c1c0513a57ffcc67996b77fa906e3008dfe73182b20