Analysis
-
max time kernel
72s -
max time network
73s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25/03/2025, 13:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2025-03-25_dab6ae86fedf641b0555c86abef1f751_wannacry.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2025-03-25_dab6ae86fedf641b0555c86abef1f751_wannacry.exe
Resource
win10v2004-20250313-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
2025-03-25_dab6ae86fedf641b0555c86abef1f751_wannacry.exe
-
Size
2.2MB
-
MD5
dab6ae86fedf641b0555c86abef1f751
-
SHA1
7acfccdbc1dc785868e62d29cdd97de55f72b288
-
SHA256
0207c6119e663d4157427528e8aa55f1a09b4920aeabf8f2c37ccf4075ae2008
-
SHA512
4a97f0529a0059ea9601e72251dc098798f6914d4e658ddcb2daf0274f012531cdd8009c44ce0317753b651443365b9b93182387a31ee74523ea2dbea7070ad5
-
SSDEEP
49152:QnHMSPbcBVQe4NRx+TSqTdX1HkQo6SAARdhnvn:QHPoBhqRxcSUDk36SAEdhvn
Score
10/10
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Wannacry family
-
Contacts a large (782) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat 2025-03-25_dab6ae86fedf641b0555c86abef1f751_wannacry.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\WINDOWS\tasksche.exe 2025-03-25_dab6ae86fedf641b0555c86abef1f751_wannacry.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-03-25_dab6ae86fedf641b0555c86abef1f751_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-03-25_dab6ae86fedf641b0555c86abef1f751_wannacry.exe -
Modifies data under HKEY_USERS 24 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E7DB5659-E4C4-4470-8D10-BFD6F829B65B}\WpadDecisionTime = b0f461da8a9ddb01 2025-03-25_dab6ae86fedf641b0555c86abef1f751_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E7DB5659-E4C4-4470-8D10-BFD6F829B65B}\WpadDecision = "0" 2025-03-25_dab6ae86fedf641b0555c86abef1f751_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E7DB5659-E4C4-4470-8D10-BFD6F829B65B}\92-3b-07-0d-6f-cf 2025-03-25_dab6ae86fedf641b0555c86abef1f751_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections 2025-03-25_dab6ae86fedf641b0555c86abef1f751_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings 2025-03-25_dab6ae86fedf641b0555c86abef1f751_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" 2025-03-25_dab6ae86fedf641b0555c86abef1f751_wannacry.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 2025-03-25_dab6ae86fedf641b0555c86abef1f751_wannacry.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0165000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 2025-03-25_dab6ae86fedf641b0555c86abef1f751_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\92-3b-07-0d-6f-cf 2025-03-25_dab6ae86fedf641b0555c86abef1f751_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 2025-03-25_dab6ae86fedf641b0555c86abef1f751_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" 2025-03-25_dab6ae86fedf641b0555c86abef1f751_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\92-3b-07-0d-6f-cf\WpadDecisionReason = "1" 2025-03-25_dab6ae86fedf641b0555c86abef1f751_wannacry.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\92-3b-07-0d-6f-cf\WpadDecisionTime = b0f461da8a9ddb01 2025-03-25_dab6ae86fedf641b0555c86abef1f751_wannacry.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 2025-03-25_dab6ae86fedf641b0555c86abef1f751_wannacry.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 2025-03-25_dab6ae86fedf641b0555c86abef1f751_wannacry.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 2025-03-25_dab6ae86fedf641b0555c86abef1f751_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E7DB5659-E4C4-4470-8D10-BFD6F829B65B} 2025-03-25_dab6ae86fedf641b0555c86abef1f751_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E7DB5659-E4C4-4470-8D10-BFD6F829B65B}\WpadDecisionReason = "1" 2025-03-25_dab6ae86fedf641b0555c86abef1f751_wannacry.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E7DB5659-E4C4-4470-8D10-BFD6F829B65B}\WpadNetworkName = "Network 3" 2025-03-25_dab6ae86fedf641b0555c86abef1f751_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\92-3b-07-0d-6f-cf\WpadDecision = "0" 2025-03-25_dab6ae86fedf641b0555c86abef1f751_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings 2025-03-25_dab6ae86fedf641b0555c86abef1f751_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" 2025-03-25_dab6ae86fedf641b0555c86abef1f751_wannacry.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 2025-03-25_dab6ae86fedf641b0555c86abef1f751_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad 2025-03-25_dab6ae86fedf641b0555c86abef1f751_wannacry.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2624 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2624 taskmgr.exe -
Suspicious use of FindShellTrayWindow 48 IoCs
pid Process 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe -
Suspicious use of SendNotifyMessage 48 IoCs
pid Process 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-03-25_dab6ae86fedf641b0555c86abef1f751_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2025-03-25_dab6ae86fedf641b0555c86abef1f751_wannacry.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2896
-
C:\Users\Admin\AppData\Local\Temp\2025-03-25_dab6ae86fedf641b0555c86abef1f751_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2025-03-25_dab6ae86fedf641b0555c86abef1f751_wannacry.exe -m security1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2260
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2624