Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/01/2025, 02:45
Static task
static1
Behavioral task
behavioral1
Sample
2025-01-19_0dfbe354449a11d48528f7a30958d50a_wannacry.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
2025-01-19_0dfbe354449a11d48528f7a30958d50a_wannacry.exe
Resource
win10v2004-20241007-en
General
-
Target
2025-01-19_0dfbe354449a11d48528f7a30958d50a_wannacry.exe
-
Size
3.6MB
-
MD5
0dfbe354449a11d48528f7a30958d50a
-
SHA1
d2c5a9532ce5e3942be36f204f16ef00757c7ee8
-
SHA256
4298725c1f46975007bf47bdea49062da9cc99c9456c1da9a2dccac2fb78f900
-
SHA512
61aae062b0c698626233a4065080477eefb7dde3f6d6e3434856e0714b63f9323df89da828def58052c337fa245a846d0f5bdd3e1ac7d829686324e1d8b119c5
-
SSDEEP
98304:ZdPoBL1aRxcSUDk36SAEdhvxWa9P593R8yAVp2g3R:ZdPg1Cxcxk3ZAEUadzR8yc4gB
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Wannacry family
-
Contacts a large (3318) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 1 IoCs
pid Process 4448 tasksche.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\WINDOWS\tasksche.exe 2025-01-19_0dfbe354449a11d48528f7a30958d50a_wannacry.exe -
Program crash 2 IoCs
pid pid_target Process procid_target 5036 4448 WerFault.exe 83 3380 4448 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-01-19_0dfbe354449a11d48528f7a30958d50a_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-01-19_0dfbe354449a11d48528f7a30958d50a_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasksche.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3692 wrote to memory of 4448 3692 2025-01-19_0dfbe354449a11d48528f7a30958d50a_wannacry.exe 83 PID 3692 wrote to memory of 4448 3692 2025-01-19_0dfbe354449a11d48528f7a30958d50a_wannacry.exe 83 PID 3692 wrote to memory of 4448 3692 2025-01-19_0dfbe354449a11d48528f7a30958d50a_wannacry.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-19_0dfbe354449a11d48528f7a30958d50a_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-19_0dfbe354449a11d48528f7a30958d50a_wannacry.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4448 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4448 -s 2203⤵
- Program crash
PID:5036
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4448 -s 2243⤵
- Program crash
PID:3380
-
-
-
C:\Users\Admin\AppData\Local\Temp\2025-01-19_0dfbe354449a11d48528f7a30958d50a_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2025-01-19_0dfbe354449a11d48528f7a30958d50a_wannacry.exe -m security1⤵
- System Location Discovery: System Language Discovery
PID:4100
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4448 -ip 44481⤵PID:2996
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4448 -ip 44481⤵PID:4648
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.4MB
MD5cbf971479629e15c4157b1146dbff5e7
SHA155d28d58980ff4ff40d5464009b27e680bf00ec4
SHA256c16a27ffd09bf186399309224528d71aace81d556d41cf3db0bac5b015a332ed
SHA51222e5bee46052878202f2f6df07379e3c80a4f3cda46971e539c13212ff0f6adc0c9a73c8c54bcb73fab80b55aff77fb461369709881714b16a2c2a82c8875a1b