Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20250211-en -
resource tags
arch:x64arch:x86image:win10v2004-20250211-enlocale:en-usos:windows10-2004-x64system -
submitted
13-02-2025 23:09
Static task
static1
Behavioral task
behavioral1
Sample
2025-02-13_18b02124f0a5cd0ca578a31375259b7a_wannacry.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2025-02-13_18b02124f0a5cd0ca578a31375259b7a_wannacry.exe
Resource
win10v2004-20250211-en
General
-
Target
2025-02-13_18b02124f0a5cd0ca578a31375259b7a_wannacry.exe
-
Size
5.0MB
-
MD5
18b02124f0a5cd0ca578a31375259b7a
-
SHA1
37cbe3bf7375c6a16c7a92f42ebf77b5c294cef8
-
SHA256
bd89156f78af8eea359d60174492655f259b9bfdaf4eccaf08015c694f7fd141
-
SHA512
c550f74aa8bde248dd489af13681fea8adbe92a864326c81ec4207626fd61c9f38846f31d7bb94f44b5a4392ed16f25709c2f0644e1b554391c7305a23d4145c
-
SSDEEP
98304:XDqPoBhz1aRxcSUDk36SAEdhvxWa9P5Or:XDqPe1Cxcxk3ZAEUadIr
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Wannacry family
-
Contacts a large (3346) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Downloads MZ/PE file 1 IoCs
flow pid Process 2527 3140 Process not Found -
Executes dropped EXE 1 IoCs
pid Process 4844 tasksche.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\WINDOWS\tasksche.exe 2025-02-13_18b02124f0a5cd0ca578a31375259b7a_wannacry.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-02-13_18b02124f0a5cd0ca578a31375259b7a_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-02-13_18b02124f0a5cd0ca578a31375259b7a_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 1692 MicrosoftEdgeUpdate.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 2025-02-13_18b02124f0a5cd0ca578a31375259b7a_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 2025-02-13_18b02124f0a5cd0ca578a31375259b7a_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 2025-02-13_18b02124f0a5cd0ca578a31375259b7a_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 2025-02-13_18b02124f0a5cd0ca578a31375259b7a_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 2025-02-13_18b02124f0a5cd0ca578a31375259b7a_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-02-13_18b02124f0a5cd0ca578a31375259b7a_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2025-02-13_18b02124f0a5cd0ca578a31375259b7a_wannacry.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1432 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i2⤵
- Executes dropped EXE
PID:4844
-
-
C:\Users\Admin\AppData\Local\Temp\2025-02-13_18b02124f0a5cd0ca578a31375259b7a_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2025-02-13_18b02124f0a5cd0ca578a31375259b7a_wannacry.exe -m security1⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2636
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QjhEMTFDOEQtMTdBRC00RkM1LThGRkEtQzlBREU0NzNBM0QxfSIgdXNlcmlkPSJ7NzBGRkRGMjgtN0MyNC00MTM1LTlCQ0ItRDU5N0ZEMTM4NTIyfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7QTBGNDc4OUEtQjFDQy00RTMwLTlGREYtQ0EyRjcyRDhDNjREfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIyIiBpbnN0YWxsZGF0ZXRpbWU9IjE3MzkyODM0MTAiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4Mzc1NTUzNjg2NzAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0OTU1NjU3MDI0Ii8-PC9hcHA-PC9yZXF1ZXN0Pg1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:1692
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.4MB
MD5b00efce31dd598031eac941155e8f994
SHA198d39b6241efee70579ce9fc193fe44d2c39f9c4
SHA2565bbbc42020a34e029371f549ce9a94a2e83290688468414699c70ca26c4e382a
SHA512f33a4b5965988b449ff3f58d281b482a08a6f26636d18f8134f64210011fd7b7e35061348ed6551e14b5ca2e4a0fab799075d3163069ec41eaeb9d685838b3d5