Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26/01/2025, 07:24
Static task
static1
Behavioral task
behavioral1
Sample
2025-01-26_0c6f18c1cb336e0e59adc8d88e2c616d_wannacry.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
2025-01-26_0c6f18c1cb336e0e59adc8d88e2c616d_wannacry.exe
Resource
win10v2004-20241007-en
General
-
Target
2025-01-26_0c6f18c1cb336e0e59adc8d88e2c616d_wannacry.exe
-
Size
3.6MB
-
MD5
0c6f18c1cb336e0e59adc8d88e2c616d
-
SHA1
9b34a972c2ffa7da640296954a8ba85edd491add
-
SHA256
487f9118d89a988513c8217807e5b90a5e9ffd5d88a90eab567ec31e488808c2
-
SHA512
77747a7b9e8148a95fda4676d1f6bca537d9b0e7a4e515c9a3a436936ed1d09701d7ae36fd83ae90bee0eccc1982a48bede6136bd0692721c7feb2a8693b471e
-
SSDEEP
12288:GwbLgPluxQhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+DHeQYSU:VbLgdeQhfdmMSirYbcMNgef0QeQ
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Wannacry family
-
Contacts a large (3334) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 1 IoCs
pid Process 468 tasksche.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\WINDOWS\tasksche.exe 2025-01-26_0c6f18c1cb336e0e59adc8d88e2c616d_wannacry.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-01-26_0c6f18c1cb336e0e59adc8d88e2c616d_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-01-26_0c6f18c1cb336e0e59adc8d88e2c616d_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-26_0c6f18c1cb336e0e59adc8d88e2c616d_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-26_0c6f18c1cb336e0e59adc8d88e2c616d_wannacry.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1276 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i2⤵
- Executes dropped EXE
PID:468
-
-
C:\Users\Admin\AppData\Local\Temp\2025-01-26_0c6f18c1cb336e0e59adc8d88e2c616d_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2025-01-26_0c6f18c1cb336e0e59adc8d88e2c616d_wannacry.exe -m security1⤵
- System Location Discovery: System Language Discovery
PID:2260
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.4MB
MD5e27101913e1a2fd32c9398ae7420a2b4
SHA1528f651e1fb69306bba47b2256b91b4ec9444762
SHA25685d832ac558ea3ce9454a8dd42c24801c73ab35307f2feeef5b259fe0415c8c5
SHA512da95882d6fe094981089eca8eda47ff2b0e642ac714bbf5005e73d47ff5ab11e26165f5475065a1b4722c024fb78ee08bd48fd98d96bef0730142a6d5be122f4