Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    25/01/2025, 03:59

General

  • Target

    2025-01-25_2b059f602ca74a631265800904c6bc7f_wannacry.exe

  • Size

    3.6MB

  • MD5

    2b059f602ca74a631265800904c6bc7f

  • SHA1

    53e70add0d508cc2b12065d33a5c6491efae7081

  • SHA256

    fcb189cf76f7f22456d490f8724ad5558ca7db93378d2b6a4e3a183482440657

  • SHA512

    2f8c20a92c15e20dcbb4ca3c322c2a79b2264d52fad5e3dd2951ad7e8ace3362e5264eb2a7ffe7935a5c75b2bdbed737b7749f6d7aa87d44290021f445b1c6e7

  • SSDEEP

    98304:p8qPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2Hs:p8qPe1Cxcxk3ZAEUadzR8yc4Hs

Malware Config

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

  • Wannacry family
  • Contacts a large (3264) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Executes dropped EXE 1 IoCs
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-01-25_2b059f602ca74a631265800904c6bc7f_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-01-25_2b059f602ca74a631265800904c6bc7f_wannacry.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    PID:2312
    • C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      2⤵
      • Executes dropped EXE
      PID:2840
  • C:\Users\Admin\AppData\Local\Temp\2025-01-25_2b059f602ca74a631265800904c6bc7f_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp\2025-01-25_2b059f602ca74a631265800904c6bc7f_wannacry.exe -m security
    1⤵
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    PID:2188

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\tasksche.exe

    Filesize

    3.4MB

    MD5

    7f7ccaa16fb15eb1c7399d422f8363e8

    SHA1

    bd44d0ab543bf814d93b719c24e90d8dd7111234

    SHA256

    2584e1521065e45ec3c17767c065429038fc6291c091097ea8b22c8a502c41dd

    SHA512

    83e334b80de08903cfa9891a3fa349c1ece7e19f8e62b74a017512fa9a7989a0fd31929bf1fc13847bee04f2da3dacf6bc3f5ee58f0e4b9d495f4b9af12ed2b7

  • memory/2188-6-0x0000000000400000-0x0000000000A71000-memory.dmp

    Filesize

    6.4MB

  • memory/2312-0-0x0000000000400000-0x0000000000A71000-memory.dmp

    Filesize

    6.4MB

  • memory/2312-5-0x0000000000400000-0x0000000000A71000-memory.dmp

    Filesize

    6.4MB