Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-01-2025 17:47

General

  • Target

    2025-01-22_6e7e6e6b5d5c9d84b97e1607a3538fee_wannacry.exe

  • Size

    5.0MB

  • MD5

    6e7e6e6b5d5c9d84b97e1607a3538fee

  • SHA1

    253c9bb8ad99993c99567609b95e7381b766d4a1

  • SHA256

    45dca2d8966dbc9d9fa25e54af63ab1b4be58ed990bf7123812f1ec21c922b20

  • SHA512

    94af356aa26597cb2c16ba8df05139496b0c5c6a82d9c2a5ef394af5b7c3c3afb3437f0afce2a54a36e51ac73994ebef9d169eb7ea1a96a7140cc2ccffff0abb

  • SSDEEP

    24576:VbLgddQhfdmMSirYbcMNgef0BMgHFPmpJLSfTPyt5m/DDqCwP8av:VnAQqMSPbcBVB7FNym7w3

Malware Config

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

  • Wannacry family
  • Contacts a large (3376) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Executes dropped EXE 1 IoCs
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-01-22_6e7e6e6b5d5c9d84b97e1607a3538fee_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-01-22_6e7e6e6b5d5c9d84b97e1607a3538fee_wannacry.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    PID:3116
    • C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      2⤵
      • Executes dropped EXE
      PID:1068
  • C:\Users\Admin\AppData\Local\Temp\2025-01-22_6e7e6e6b5d5c9d84b97e1607a3538fee_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp\2025-01-22_6e7e6e6b5d5c9d84b97e1607a3538fee_wannacry.exe -m security
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    PID:2836

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\tasksche.exe

    Filesize

    3.4MB

    MD5

    0571888736cf52d04dfc822bce3ba4ac

    SHA1

    cee3f4193b5f13914dace8d8fe78e19596698e87

    SHA256

    f95e53a07e6c5e6e774687bbd8946ba1ff82b68434b34e6caf698d7c0ce99315

    SHA512

    aba93a37ce185af6b40d46e5b3e483feb6f7cff0ee4ca0f86c8f21316e58063ecbcfb1f6616bace0022e5c4a3f1fb13492528f351920c3fd0fc601b9332cfa23