Resubmissions

15/05/2025, 10:20

250515-mc32latly3 10

15/05/2025, 10:15

250515-maeafstlv3 10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250508-en
  • resource tags

    arch:x64arch:x86image:win11-20250508-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    15/05/2025, 10:15

General

  • Target

    2025-05-15_b56899e87106caef87f8eeb5a6a0f667_elex_wannacry.exe

  • Size

    3.6MB

  • MD5

    b56899e87106caef87f8eeb5a6a0f667

  • SHA1

    f065ff7770d2adc99c65e66daf5be8c27d9e94b1

  • SHA256

    5de1ca24661c2854de6d7f308375a9c4b0d96e683b175fcd2fe38dcc48365393

  • SHA512

    225cfb7d2eb32e3fd4305fbbca8dc19d02e012c5fe9dfea54096bd780782b25f1c03167d078695dffd8f593b25d26b784f0dc59b5daaf9956ce98e705f89949c

  • SSDEEP

    49152:2nAQqMSPbcBVQej/1INRx+TSqTdX1HkQLA:yDqPoBhz1aRxcSUDkm

Malware Config

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

  • Wannacry family
  • Contacts a large (3050) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Executes dropped EXE 1 IoCs
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-05-15_b56899e87106caef87f8eeb5a6a0f667_elex_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-05-15_b56899e87106caef87f8eeb5a6a0f667_elex_wannacry.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    PID:6012
    • C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      2⤵
      • Executes dropped EXE
      PID:8
  • C:\Users\Admin\AppData\Local\Temp\2025-05-15_b56899e87106caef87f8eeb5a6a0f667_elex_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp\2025-05-15_b56899e87106caef87f8eeb5a6a0f667_elex_wannacry.exe -m security
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    PID:4324

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\tasksche.exe

          Filesize

          3.4MB

          MD5

          3e2f08d99b8203d1b7918c38b5de0d02

          SHA1

          003a478cfefe2f9dd32be5a1db834ed31ca18c0e

          SHA256

          0dd462b0c1c675f843561412f045181201679cf827c67ce116545e583f371e8a

          SHA512

          e58d5bf23248bd65f64b29c84465141321312fe9433efe2a7cbce905848f54d366afb416a4459bdad66b60f15c7cd5f0ffb604cf3b3cc20d6d5143761bf9b2ab