Overview

overview

10

Static

static

3

WannaCry.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    68s
  • max time network
    68s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/03/2025, 20:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    WannaCry.exe

  • Size

    224KB

  • MD5

    5c7fb0927db37372da25f270708103a2

  • SHA1

    120ed9279d85cbfa56e5b7779ffa7162074f7a29

  • SHA256

    be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844

  • SHA512

    a15f97fad744ccf5f620e5aabb81f48507327b898a9aa4287051464019e0f89224c484e9691812e166471af9beaddcfc3deb2ba878658761f4800663beef7206

  • SSDEEP

    3072:Y059femWRwTs/dbelj0X8/j84pcRXPlU3Upt3or4H84lK8PtpLzLsR/EfcZ:+5RwTs/dSXj84mRXPemxdBlPvLzLeZ

Score
10/10
wannacrydefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealerworm

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\!Please Read Me!.txt

Family

wannacry

Ransom Note
Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �
Wallets

15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry
  • Wannacry family
    wannacry
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Drops startup file 2 IoCs
  • Executes dropped EXE 6 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 3 IoCs
    ransomware
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 54 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\WannaCry.exe
    "C:\Users\Admin\AppData\Local\Temp\WannaCry.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2060
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 152141743021777.bat
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5600
      • C:\Windows\SysWOW64\cscript.exe
        cscript //nologo c.vbs
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3156
    • C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
      !WannaDecryptor!.exe f
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4192
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im MSExchange*
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1836
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Microsoft.Exchange.*
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:876
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im sqlserver.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:5268
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im sqlwriter.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1808
    • C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
      !WannaDecryptor!.exe c
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:5504
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c start /b !WannaDecryptor!.exe v
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5636
      • C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
        !WannaDecryptor!.exe v
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:992
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5468
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            wmic shadowcopy delete
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:1840
    • C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
      !WannaDecryptor!.exe
      2⤵
      • Executes dropped EXE
      • Sets desktop wallpaper using registry
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:5332
    • C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
      !WannaDecryptor!.exe
      2⤵
      • Executes dropped EXE
      • Sets desktop wallpaper using registry
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:876
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2916
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
      PID:3560
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:5028
    • C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
      "C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe"
      1⤵
      • Executes dropped EXE
      • Sets desktop wallpaper using registry
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:5956

    Network

    MITRE ATT&CK Enterprise v15

    Reconnaissance

    Resource Development

    Initial Access

    Execution

    Windows Management Instrumentation

    1
    T1047

    Persistence

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Privilege Escalation

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Defense Evasion

    Indicator Removal

    1
    T1070

    File Deletion

    1
    T1070.004

    Modify Registry

    2
    T1112

    Credential Access

    Credentials from Password Stores

    1
    T1555

    Credentials from Web Browsers

    1
    T1555.003

    Unsecured Credentials

    1
    T1552

    Credentials In Files

    1
    T1552.001

    Discovery

    Peripheral Device Discovery

    1
    T1120

    Query Registry

    1
    T1012

    System Information Discovery

    2
    T1082

    System Location Discovery

    1
    T1614

    System Language Discovery

    1
    T1614.001

    Lateral Movement

    Collection

    Data from Local System

    1
    T1005

    Command and Control

    Exfiltration

    Impact

    Defacement

    1
    T1491

    Inhibit System Recovery

    1
    T1490

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\!Please Read Me!.txt
      Filesize

      797B

      MD5

      afa18cf4aa2660392111763fb93a8c3d

      SHA1

      c219a3654a5f41ce535a09f2a188a464c3f5baf5

      SHA256

      227082c719fd4394c1f2311a0877d8a302c5b092bcc49f853a5cf3d2945f42b0

      SHA512

      4161f250d59b7d4d4a6c4f16639d66d21b2a9606de956d22ec00bedb006643fedbbb8e4cde9f6c0c977285918648314883ca91f3442d1125593bf2605f2d5c6b

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe.lnk
      Filesize

      1KB

      MD5

      8f6b4b5a2410f76477b4c0deefe00242

      SHA1

      ff8e9dd22334922316f78dcff0b31c93564aa68a

      SHA256

      8c9a91a89806bb5fa23bab0b258f7f00d86d8c1a16d7c8ad55b2b57156e4b8a0

      SHA512

      802bd38ebb325c1b29f8d7136e92f2836bb00e79ddb749b5b1e2d26bad10f3693f6609adb927df68084ff9d357fc1163fcacb2788647ac2fc0a3336b2dd636e4

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\00000000.res
      Filesize

      136B

      MD5

      38fccee7eb4bae0355aa2f1ce89c95a2

      SHA1

      b0959c5b58174e901f7a84794ca8a52be9ad0a1e

      SHA256

      58ecc090d05dc6544e44e300e0a99563d87369e7dd4a20e645dfa5bfcd31c996

      SHA512

      bc7a532fc29b07a39a30290c589493929f7f442d2084ac488cc42d78eebb06c710b976733eb2f0c3132e4803474744ba4c92c12c093ba501c5446cb5cd262782

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\00000000.res
      Filesize

      136B

      MD5

      8a265e38eb7fcb7447b312d9adcb35ae

      SHA1

      a4b2b3927bdccae2aa17644c5edc954022b52cb6

      SHA256

      8a3886599f0262cb653abd4b2624091608aff5e223ce3ff894793fa5ab16a076

      SHA512

      c1f8b88a39456ea0eb46bb9869abf22933830c770b4601b49e67a147f2ab888863270febd8ed1ea95ccace8ee290d0f8ecde078ddfa810fd507c1ee31b8a5eb0

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\152141743021777.bat
      Filesize

      336B

      MD5

      3540e056349c6972905dc9706cd49418

      SHA1

      492c20442d34d45a6d6790c720349b11ec591cde

      SHA256

      73872a89440a2cba9d22bf4961c3d499ea2c72979c30c455f942374292fedadc

      SHA512

      c949d147100aef59e382c03abf7b162ae62a4d43456eebd730fbedcf5f95f5e1a24f6e349690d52d75331878a6ee8f6b88a7162ee9cf2a49e142196b12d0133c

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\c.vbs
      Filesize

      219B

      MD5

      5f6d40ca3c34b470113ed04d06a88ff4

      SHA1

      50629e7211ae43e32060686d6be17ebd492fd7aa

      SHA256

      0fb5039a2fe7e90cdf3f22140d7f2103f94689b15609efe0edcc8430dd772fc1

      SHA512

      4d4aa1abd2c9183202fd3f0a65b37f07ee0166ba6561f094c13c8ea59752c7bdd960e37c49583746d4464bc3b1dc0b63a1fe36a37ce7e5709cd76ed433befe35

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\c.wry
      Filesize

      628B

      MD5

      86cd620d8176580aeebccd08f4c986bb

      SHA1

      2f07c196a5637fb628d74eddcacffa666b3e56ac

      SHA256

      7c81269405effbfdc4e8ff2acc6029d45422fa6cdcdcdfbef5a3b2ecd1c1cff0

      SHA512

      bb3bfeb8f1c9a17fe8c28c09f5eb4d1052dca3f079bab4cf15c6b60fdd86ab4fe3ae89b4d15342dedb960696657592357929fe2d452644488209682f7a9c74a7

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\m.wry
      Filesize

      42KB

      MD5

      980b08bac152aff3f9b0136b616affa5

      SHA1

      2a9c9601ea038f790cc29379c79407356a3d25a3

      SHA256

      402046ada270528c9ac38bbfa0152836fe30fb8e12192354e53b8397421430d9

      SHA512

      100cda1f795781042b012498afd783fd6ff03b0068dbd07b2c2e163cd95e6c6e00755ce16b02b017693c9febc149ed02df9df9b607e2b9cca4b07e5bd420f496

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\u.wry
      Filesize

      236KB

      MD5

      cf1416074cd7791ab80a18f9e7e219d9

      SHA1

      276d2ec82c518d887a8a3608e51c56fa28716ded

      SHA256

      78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df

      SHA512

      0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

      Download Submit

    • memory/2060-6-0x0000000010000000-0x0000000010012000-memory.dmp

      Filesize

      72KB

      Download

    • memory/2916-1361-0x000001429D440000-0x000001429D441000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2916-1376-0x000001429D440000-0x000001429D441000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2916-1375-0x000001429D440000-0x000001429D441000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2916-1374-0x000001429D440000-0x000001429D441000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2916-1373-0x000001429D440000-0x000001429D441000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2916-1372-0x000001429D440000-0x000001429D441000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2916-1371-0x000001429D440000-0x000001429D441000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2916-1370-0x000001429D440000-0x000001429D441000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2916-1362-0x000001429D440000-0x000001429D441000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2916-1363-0x000001429D440000-0x000001429D441000-memory.dmp

      Filesize

      4KB

      Download