wannacry | 3c0607e8cd03809a00c7abaf0d6da1627f2ceac552a84aa2198c7993300ca8d7

Resubmissions

21/02/2025, 12:48

250221-p2asfssmdj 10

21/02/2025, 09:11

250221-k53v7aymfm 10

21/02/2025, 06:19

250221-g3jgzsvmcx 10

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
21/02/2025, 06:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-02-21_aa65de92680a05ce79fa7e59dcbe4ebb_wannacry.exe
Size

5.0MB
MD5

aa65de92680a05ce79fa7e59dcbe4ebb
SHA1

799f1a0ece653b6ffd4b763db76932fff15572f4
SHA256

3c0607e8cd03809a00c7abaf0d6da1627f2ceac552a84aa2198c7993300ca8d7
SHA512

55465e062e81ddc39beda8a0e5a9daefa9775dedb45462af593f8633080010a796eaf2f4b07f6b84cb3ab31e40f95347c5520a183ef11fec6e963e6ce654d4ae
SSDEEP

49152:2nAQqMSPbcBVQejf6SAARdhnvxJM0H9PAMEcaEau3R8yAH1plAHw:yDqPoBhD6SAEdhvxWa9P593R8yAVp2Hw

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Wannacry family
wannacry
Contacts a large (3372) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 1 IoCs

pid	Process
772	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	2025-02-21_aa65de92680a05ce79fa7e59dcbe4ebb_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-02-21_aa65de92680a05ce79fa7e59dcbe4ebb_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-02-21_aa65de92680a05ce79fa7e59dcbe4ebb_wannacry.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	2025-02-21_aa65de92680a05ce79fa7e59dcbe4ebb_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	2025-02-21_aa65de92680a05ce79fa7e59dcbe4ebb_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	2025-02-21_aa65de92680a05ce79fa7e59dcbe4ebb_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	2025-02-21_aa65de92680a05ce79fa7e59dcbe4ebb_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	2025-02-21_aa65de92680a05ce79fa7e59dcbe4ebb_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2025-02-21_aa65de92680a05ce79fa7e59dcbe4ebb_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2025-02-21_aa65de92680a05ce79fa7e59dcbe4ebb_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1472
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:772

C:\Users\Admin\AppData\Local\Temp\2025-02-21_aa65de92680a05ce79fa7e59dcbe4ebb_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2025-02-21_aa65de92680a05ce79fa7e59dcbe4ebb_wannacry.exe -m security
1⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:3960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
ea37fb7de543ecb337eb3857d1faf210

SHA1
22741da869077bc8e898e985dcf5c6f4562d4023

SHA256
42a6d84ceaa424d193a9392a400f6c094011244284d44850a58ab5b918b11866

SHA512
30a3a80e67ddcc368be4437be737d21b3319198d97b22027e9c0c80b951502a0058c546e154a22dc972e526366c4e544f272e1cd0ccc8325d3bb6a5abb87ac57

Download Submit