Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
29/01/2025, 18:58 UTC
General
-
Target
2025-01-29_ffdb24a19ba16068554a476ca79685e1_wannacry.exe
-
Size
5.0MB
-
MD5
ffdb24a19ba16068554a476ca79685e1
-
SHA1
886907e280360b0d4b087dbd98a01312ab3a7301
-
SHA256
109eeda23927bed6900229137fb67d3f0563651a521c7632fa32e6d6b4140d1f
-
SHA512
410643abe2811c575257294a8416cc7f7b7f06c5ba1fb3381dd639a1ee2a598dd27b74ab60e9bddd99e3e2acd209c8f249fe54c6218ffd8c0783d4e79216cdd5
-
SSDEEP
49152:VnFQqMSPbcBVQej/hINRx+TSqTdX1HkQo6SAAH:ZeqPoBhzhaRxcSUDk36SAc
Score
10/10
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Wannacry family
-
Contacts a large (3246) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in System32 directory 5 IoCs
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies data under HKEY_USERS 24 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-29_ffdb24a19ba16068554a476ca79685e1_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-29_ffdb24a19ba16068554a476ca79685e1_wannacry.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2025-01-29_ffdb24a19ba16068554a476ca79685e1_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2025-01-29_ffdb24a19ba16068554a476ca79685e1_wannacry.exe -m security1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
Network
-
DNSwww.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comRemote address:8.8.8.8:53Requestwww.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comIN AResponsewww.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comIN A103.224.212.215 -
GEThttp://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/Remote address:103.224.212.215:80RequestGET / HTTP/1.1
Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com
Cache-Control: no-cache
ResponseHTTP/1.1 302 Found
date: Wed, 29 Jan 2025 18:58:36 GMT
server: Apache
set-cookie: __tad=1738177116.2890574; expires=Sat, 27-Jan-2035 18:58:36 GMT; Max-Age=315360000
location: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250130-0558-3643-b8ac-514d11d72bdd
content-length: 2
content-type: text/html; charset=UTF-8
connection: close
-
DNSww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comRemote address:8.8.8.8:53Requestww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comIN AResponseww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comIN CNAME77026.bodis.com77026.bodis.comIN A199.59.243.228
-
GEThttp://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250130-0558-3643-b8ac-514d11d72bddRemote address:199.59.243.228:80RequestGET /?subid1=20250130-0558-3643-b8ac-514d11d72bdd HTTP/1.1
Host: ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com
Cache-Control: no-cache
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
date: Wed, 29 Jan 2025 18:58:37 GMT
content-type: text/html; charset=utf-8
content-length: 1262
x-request-id: 01985921-f669-4a53-b67e-c752ad978cbe
cache-control: no-store, max-age=0
accept-ch: sec-ch-prefers-color-scheme
critical-ch: sec-ch-prefers-color-scheme
vary: sec-ch-prefers-color-scheme
x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_wlzb3kGkkCNwqjzdmG+j+3P2ITgemFGQg2AMKQ31hZtC8TkUaGnmlmr0zCd2ORlDvgDonSjykYEvWDovNww3Jw==
set-cookie: parking_session=01985921-f669-4a53-b67e-c752ad978cbe; expires=Wed, 29 Jan 2025 19:13:37 GMT; path=/
-
GEThttp://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/Remote address:103.224.212.215:80RequestGET / HTTP/1.1
Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com
Cache-Control: no-cache
ResponseHTTP/1.1 302 Found
date: Wed, 29 Jan 2025 18:58:37 GMT
server: Apache
set-cookie: __tad=1738177117.3084774; expires=Sat, 27-Jan-2035 18:58:37 GMT; Max-Age=315360000
location: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250130-0558-3795-b8d1-18900c5e9ba9
content-length: 2
content-type: text/html; charset=UTF-8
connection: close
-
GEThttp://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250130-0558-3795-b8d1-18900c5e9ba9Remote address:199.59.243.228:80RequestGET /?subid1=20250130-0558-3795-b8d1-18900c5e9ba9 HTTP/1.1
Host: ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com
Cache-Control: no-cache
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
date: Wed, 29 Jan 2025 18:58:36 GMT
content-type: text/html; charset=utf-8
content-length: 1262
x-request-id: 05d01aaf-08ec-46f6-8a24-30bd1146d951
cache-control: no-store, max-age=0
accept-ch: sec-ch-prefers-color-scheme
critical-ch: sec-ch-prefers-color-scheme
vary: sec-ch-prefers-color-scheme
x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_Ea+jTVEUm6L5RDEgAtNbqvyQ1v30TTIpAz1dzQ+uqHAO47bp7rywAAP6cf7+CAO/g7/yB+Vr+ACFWeq3AEgObA==
set-cookie: parking_session=05d01aaf-08ec-46f6-8a24-30bd1146d951; expires=Wed, 29 Jan 2025 19:13:37 GMT; path=/
-
103.224.212.215:80http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/http
HTTP Request
GET http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/HTTP Response
302 -
199.59.243.228:80http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250130-0558-3643-b8ac-514d11d72bddhttp
HTTP Request
GET http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250130-0558-3643-b8ac-514d11d72bddHTTP Response
200 -
103.224.212.215:80http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/http
HTTP Request
GET http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/HTTP Response
302 -
199.59.243.228:80http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250130-0558-3795-b8d1-18900c5e9ba9http
HTTP Request
GET http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250130-0558-3795-b8d1-18900c5e9ba9HTTP Response
200 -
159.133.214.124:445
-
10.127.0.1:445 -
10.127.1.1:445
-
10.127.2.1:445
-
10.127.3.1:445
-
10.127.4.1:445
-
10.127.5.1:445
-
10.127.6.1:445
-
10.127.7.1:445
-
10.127.8.1:445
-
10.127.9.1:445
-
10.127.10.1:445
-
114.144.149.253:445 -
221.102.30.217:445
-
10.127.11.1:445
-
10.127.12.1:445
-
10.127.13.1:445
-
10.127.14.1:445
-
10.127.15.1:445
-
10.127.16.1:445
-
10.127.17.1:445
-
10.127.18.1:445
-
10.127.19.1:445
-
10.127.20.1:445
-
10.127.21.1:445
-
100.248.136.11:445
-
10.127.22.1:445
-
10.127.23.1:445
-
10.127.24.1:445
-
10.127.25.1:445
-
10.127.26.1:445
-
10.127.27.1:445
-
10.127.28.1:445
-
10.127.29.1:445
-
10.127.30.1:445
-
10.127.31.1:445
-
66.229.162.83:445
-
27.48.218.21:445 -
148.141.186.117:445
-
10.127.32.1:445
-
10.127.33.1:445
-
10.127.34.1:445
-
10.127.35.1:445
-
10.127.36.1:445
-
10.127.37.1:445
-
10.127.38.1:445
-
10.127.39.1:445
-
10.127.40.1:445
-
10.127.41.1:445
-
10.127.42.1:445
-
10.127.43.1:445
-
145.201.14.42:445 -
211.185.41.124:445 -
10.127.44.1:445
-
10.127.45.1:445
-
10.127.46.1:445
-
10.127.47.1:445
-
10.127.48.1:445
-
10.127.49.1:445
-
145.127.16.3:445
-
13.167.215.137:445
-
56.96.223.95:445 -
101.98.166.61:445 -
10.127.50.1:445
-
10.127.51.1:445
-
10.127.52.1:445
-
10.127.53.1:445
-
10.127.54.1:445
-
10.127.55.1:445
-
10.127.56.1:445
-
10.127.57.1:445
-
10.127.58.1:445
-
10.127.59.1:445
-
10.127.60.1:445
-
10.127.61.1:445
-
10.127.62.1:445
-
10.127.63.1:445
-
10.127.64.1:445
-
10.127.65.1:445
-
79.214.106.185:445 -
99.115.68.127:445
-
217.123.191.246:445
-
10.127.66.1:445
-
10.127.67.1:445
-
64.72.204.73:445
-
136.197.33.168:445
-
221.100.160.131:445
-
24.19.251.18:445
-
74.101.3.211:445
-
10.127.68.1:445
-
10.127.69.1:445
-
10.127.70.1:445
-
10.127.71.1:445
-
10.127.72.1:445
-
10.127.73.1:445
-
10.127.74.1:445
-
10.127.75.1:445
-
10.127.76.1:445
-
10.127.77.1:445
-
10.127.78.1:445
-
10.127.79.1:445
-
10.127.80.1:445
-
10.127.81.1:445
-
10.127.82.1:445
-
10.127.83.1:445
-
113.81.36.135:445 -
10.127.84.1:445
-
10.127.85.1:445
-
10.127.86.1:445
-
10.127.87.1:445
-
88.66.5.48:445
-
72.243.158.241:445
-
28.60.61.243:445
-
31.214.17.171:445 -
20.211.92.244:445
-
118.52.89.211:445
-
37.206.173.190:445 -
152.153.111.72:445
-
10.127.88.1:445
-
10.127.89.1:445
-
10.127.90.1:445
-
10.127.91.1:445
-
10.127.92.1:445
-
10.127.93.1:445
-
10.127.94.1:445
-
10.127.95.1:445
-
10.127.96.1:445
-
10.127.97.1:445
-
10.127.98.1:445
-
10.127.99.1:445
-
10.127.100.1:445
-
10.127.101.1:445
-
189.229.87.231:445 -
10.127.102.1:445
-
10.127.103.1:445
-
10.127.104.1:445
-
10.127.105.1:445
-
176.182.34.239:445 -
10.127.106.1:445
-
10.127.107.1:445
-
10.127.108.1:445
-
10.127.109.1:445
-
153.8.36.78:445
-
191.123.35.240:445 -
144.221.132.118:445
-
136.156.76.207:445
-
135.99.105.2:445
-
74.176.9.85:445
-
135.173.119.9:445
-
58.29.18.224:445
-
173.129.15.72:445
-
200.207.106.200:445
-
10.127.110.1:445
-
10.127.111.1:445
-
10.127.112.1:445
-
10.127.113.1:445
-
10.127.114.1:445
-
10.127.115.1:445
-
10.127.116.1:445
-
10.127.117.1:445
-
10.127.118.1:445
-
10.127.119.1:445
-
10.127.120.1:445
-
10.127.121.1:445
-
85.168.29.30:445
-
10.127.122.1:445
-
10.127.123.1:445
-
122.51.144.191:445
-
10.127.124.1:445
-
10.127.125.1:445
-
10.127.126.1:445
-
10.127.127.1:445
-
151.145.164.31:445
-
10.127.128.1:445
-
103.169.183.133:445 -
104.159.94.60:445 -
125.76.56.70:445
-
219.45.107.182:445
-
143.194.245.84:445
-
164.199.52.131:445
-
90.168.13.199:445 -
115.26.206.168:445
-
210.104.112.123:445
-
21.242.208.157:445
-
168.56.77.235:445
-
10.127.129.1:445
-
10.127.130.1:445
-
10.127.131.1:445
-
10.127.132.1:445
-
10.127.133.1:445
-
10.127.134.1:445
-
10.127.135.1:445
-
10.127.136.1:445
-
10.127.137.1:445
-
10.127.138.1:445
-
10.127.139.1:445
-
10.127.140.1:445
-
10.127.141.1:445
-
10.127.142.1:445
-
10.127.143.1:445
-
89.35.168.11:445
-
10.127.144.1:445
-
109.228.214.233:445 -
10.127.145.1:445
-
10.127.146.1:445
-
140.245.123.73:445 -
7.168.226.36:445
-
34.130.99.32:445
-
212.32.139.210:445 -
48.26.1.223:445
-
134.242.115.122:445
-
117.167.90.87:445
-
166.251.54.26:445
-
95.32.106.6:445 -
28.45.253.238:445
-
186.252.139.230:445
-
218.148.132.228:445
-
25.104.139.121:445 -
10.127.147.1:445
-
10.127.148.1:445
-
10.127.149.1:445
-
10.127.150.1:445
-
10.127.151.1:445
-
10.127.152.1:445
-
10.127.153.1:445
-
10.127.154.1:445
-
10.127.155.1:445
-
10.127.156.1:445
-
10.127.157.1:445
-
10.127.158.1:445
-
10.127.159.1:445
-
10.127.160.1:445
-
10.127.161.1:445
-
10.127.162.1:445
-
10.127.163.1:445
-
10.127.164.1:445
-
202.113.66.21:445
-
179.89.94.228:445
-
10.127.165.1:445
-
72.140.97.159:445
-
10.127.166.1:445
-
21.164.188.102:445
-
80.7.191.89:445
-
170.136.105.120:445
-
99.132.106.142:445
-
68.149.51.6:445
-
114.107.33.160:445
-
166.219.226.82:445
-
106.41.4.68:445
-
207.203.195.205:445
-
67.231.64.38:445
-
123.218.84.232:445
-
105.211.135.158:445 -
205.170.108.108:445
-
54.127.226.73:445
-
10.127.167.1:445
-
10.127.168.1:445
-
10.127.169.1:445
-
10.127.170.1:445
-
10.127.171.1:445
-
10.127.172.1:445
-
10.127.173.1:445
-
10.127.174.1:445
-
10.127.175.1:445
-
10.127.176.1:445
-
10.127.177.1:445
-
10.127.178.1:445
-
10.127.179.1:445
-
10.127.180.1:445
-
10.127.181.1:445
-
10.127.182.1:445
-
10.127.183.1:445
-
10.127.184.1:445
-
10.127.185.1:445
-
217.0.69.31:445
-
10.127.186.1:445
-
125.126.178.45:445
-
146.217.164.167:445
-
153.144.251.93:445
-
131.61.125.231:445
-
84.254.96.102:445 -
115.49.215.68:445
-
40.65.183.78:445
-
223.217.61.110:445
-
148.101.135.248:445 -
67.81.124.199:445
-
194.20.153.171:445
-
45.144.64.7:445
-
87.202.183.172:445 -
12.222.213.244:445
-
16.70.121.71:445
-
143.225.16.164:445
-
222.154.157.52:445
-
125.130.196.230:445
-
10.127.187.1:445
-
10.127.188.1:445
-
10.127.189.1:445
-
10.127.190.1:445
-
10.127.191.1:445
-
10.127.192.1:445
-
10.127.193.1:445
-
10.127.194.1:445
-
10.127.195.1:445
-
10.127.196.1:445
-
10.127.197.1:445
-
10.127.198.1:445
-
10.127.199.1:445
-
10.127.200.1:445
-
10.127.201.1:445
-
10.127.202.1:445
-
10.127.203.1:445
-
116.169.207.64:445
-
10.127.204.1:445
-
83.43.110.236:445
-
10.127.205.1:445
-
10.127.206.1:445
-
10.127.207.1:445
-
131.10.113.161:445
-
42.45.240.182:445
-
20.90.211.122:445
-
129.178.70.20:445
-
29.241.29.80:445
-
34.221.52.129:445
-
221.198.209.213:445
-
8.206.105.185:445
-
178.71.101.71:445
-
176.105.230.212:445
-
121.53.232.233:445
-
46.165.142.3:445
-
76.76.250.114:445
-
136.51.234.20:445
-
185.20.138.170:445 -
115.90.190.81:445
-
193.98.238.117:445
-
189.66.78.138:445
-
31.88.68.195:445 -
10.127.208.1:445
-
10.127.209.1:445
-
10.127.210.1:445
-
10.127.211.1:445
-
10.127.212.1:445
-
10.127.213.1:445
-
10.127.214.1:445
-
10.127.215.1:445
-
10.127.216.1:445
-
10.127.217.1:445
-
10.127.218.1:445
-
10.127.219.1:445
-
10.127.220.1:445
-
10.127.221.1:445
-
10.127.222.1:445
-
10.127.223.1:445
-
40.253.85.198:445
-
131.177.57.242:445
-
10.127.224.1:445
-
10.127.225.1:445
-
188.248.174.180:445 -
143.168.16.56:445
-
38.129.222.116:445
-
146.206.201.94:445
-
17.92.102.147:445
-
52.212.42.191:445
-
6.86.10.114:445
-
32.244.238.2:445
-
33.17.83.175:445
-
95.93.204.157:445 -
31.114.18.238:445
-
21.188.163.93:445
-
63.128.225.174:445
-
202.189.138.131:445 -
23.111.221.20:445
-
167.133.75.45:445
-
75.240.214.52:445
-
89.17.75.173:445
-
190.138.7.154:445 -
113.22.7.222:445
-
10.127.226.1:445
-
10.127.227.1:445
-
10.127.228.1:445
-
10.127.229.1:445
-
10.127.230.1:445
-
10.127.231.1:445
-
10.127.232.1:445
-
10.127.233.1:445
-
10.127.234.1:445
-
10.127.235.1:445
-
10.127.236.1:445
-
10.127.237.1:445
-
10.127.238.1:445
-
10.127.239.1:445
-
10.127.240.1:445
-
10.127.241.1:445
-
10.127.242.1:445
-
108.10.241.209:445
-
41.138.68.69:445
-
10.127.243.1:445
-
145.62.81.12:445
-
10.127.244.1:445
-
113.22.7.1:445
-
10.127.245.1:445
-
163.130.214.227:445
-
202.156.238.21:445
-
93.145.34.254:445
-
49.2.197.229:445
-
116.164.143.222:445
-
146.82.121.26:445
-
200.159.37.208:445
-
59.38.170.220:445
-
122.206.38.36:445
-
149.220.99.48:445
-
70.32.1.168:445
-
113.22.7.2:445
-
16.75.253.179:445
-
108.195.187.69:445
-
72.10.43.128:445
-
163.24.173.125:445 -
61.157.72.71:445
-
20.64.186.213:445
-
81.195.254.163:445
-
2.114.235.31:445
-
84.54.200.65:445
-
28.1.16.190:445
-
10.127.246.1:445
-
10.127.247.1:445
-
10.127.248.1:445
-
10.127.249.1:445
-
10.127.250.1:445
-
10.127.251.1:445
-
10.127.252.1:445
-
10.127.253.1:445
-
10.127.254.1:445
-
10.127.255.1:445
-
10.127.0.2:445
-
10.127.1.2:445
-
10.127.2.2:445
-
10.127.3.2:445
-
10.127.4.2:445
-
10.127.5.2:445
-
10.127.6.2:445
-
10.127.7.2:445
-
148.101.119.64:445
-
10.127.8.2:445
-
10.127.9.2:445
-
61.38.234.201:445
-
113.22.7.3:445
-
116.62.127.229:445
-
137.210.16.231:445
-
204.135.50.31:445
-
175.38.13.192:445
-
25.192.157.138:445
-
198.234.112.86:445
-
72.56.147.22:445
-
129.224.249.83:445
-
170.144.208.45:445
-
81.116.129.198:445
-
155.53.185.175:445
-
40.208.107.228:445
-
113.22.7.4:445
-
113.62.252.65:445
-
7.82.79.214:445
-
121.66.199.157:445
-
208.80.55.182:445
-
220.46.207.13:445
-
112.85.6.238:445
-
70.238.8.214:445
-
56.61.198.239:445
-
1.150.222.223:445
-
188.57.97.115:445
-
213.217.147.113:445
-
10.127.10.2:445
-
10.127.11.2:445
-
10.127.12.2:445
-
10.127.13.2:445
-
10.127.14.2:445
-
10.127.15.2:445
-
10.127.16.2:445
-
10.127.17.2:445
-
10.127.18.2:445
-
10.127.19.2:445
-
10.127.20.2:445
-
10.127.21.2:445
-
10.127.22.2:445
-
10.127.23.2:445
-
10.127.24.2:445
-
10.127.25.2:445
-
10.127.26.2:445
-
10.127.27.2:445
-
10.127.28.2:445
-
10.127.29.2:445
-
68.217.244.72:445
-
207.191.190.170:445
-
122.254.108.146:445
-
113.22.7.5:445
-
82.208.215.55:445
-
8.8.8.8:53www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comdns
DNS Request
www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com
DNS Response
103.224.212.215
-
8.8.8.8:53ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comdns
DNS Request
ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com
DNS Response
199.59.243.228