wannacry | b6e0541f88b2f91f92b7bcb4928db794f406e822802b1516b804fb1e2933e75e

Resubmissions

24-01-2025 18:33

250124-w7km6stkgn 10

16-12-2024 12:21

241216-pjry1szpay 10

16-12-2024 12:18

241216-pg2qfaznf1 10

16-12-2024 12:06

241216-n93b1a1kcr 10

Analysis

max time kernel
39s
max time network
44s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
24-01-2025 18:33

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

2024-12-16_ca4ce7114be6f14792cc77f2997fc7e6_wannacry.exe
Size

5.0MB
MD5

ca4ce7114be6f14792cc77f2997fc7e6
SHA1

f4ca2bdcaed8ccaf20536cdfce85b338b74ebf19
SHA256

b6e0541f88b2f91f92b7bcb4928db794f406e822802b1516b804fb1e2933e75e
SHA512

d92e534f9ca67397fc17b9b67dd7e3fcca3d8be81d8e4d6f6da5ccc2dd6bb47ac5aef3f78ab274b1a08ca70e2db0dff8944e0e9a0e85eb657b09bfeac3f1864c
SSDEEP

12288:GwbLgPluxQhMbaIMu7L5NVErCA4z2g6rTcbckP:VbLgdeQhfdmMSirYbc

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Wannacry family
wannacry

Executes dropped EXE 1 IoCs

pid	Process
2904	tasksche.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	2024-12-16_ca4ce7114be6f14792cc77f2997fc7e6_wannacry.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	2024-12-16_ca4ce7114be6f14792cc77f2997fc7e6_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-12-16_ca4ce7114be6f14792cc77f2997fc7e6_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-12-16_ca4ce7114be6f14792cc77f2997fc7e6_wannacry.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	2024-12-16_ca4ce7114be6f14792cc77f2997fc7e6_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2024-12-16_ca4ce7114be6f14792cc77f2997fc7e6_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2024-12-16_ca4ce7114be6f14792cc77f2997fc7e6_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2776
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:2904

C:\Users\Admin\AppData\Local\Temp\2024-12-16_ca4ce7114be6f14792cc77f2997fc7e6_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2024-12-16_ca4ce7114be6f14792cc77f2997fc7e6_wannacry.exe -m security
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2676

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2884

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:552

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:2116

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:2240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
d7eb5e5aab394f614ec0288046e790d0

SHA1
0dbb29a44164554d592fb699d77feeda780bec0c

SHA256
ec0bfa7cc2780afbf1138d9d3c0dd9dd789f61ba6823acfee46de77b31f5202e

SHA512
d912195f0f64a83216c4932f5f72219b55abbffa83c29d7a005b0305fc48dbbc17b2da773bbfcbdf0364196aa4655a4b599c7670448cfce551e48186bc91733b

Download Submit