wannacry | ab5e9eef3cb5bdc64e0b9a76ec07a61dab97f3bea60a586cc0a47cf2a4bbabf1

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30-06-2024 11:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-30_57dc0af3c047a9a921d83bf9bd29db24_wannacry.exe
Size

5.0MB
MD5

57dc0af3c047a9a921d83bf9bd29db24
SHA1

99a1525142982223c94b6d31c73316066fd606a1
SHA256

ab5e9eef3cb5bdc64e0b9a76ec07a61dab97f3bea60a586cc0a47cf2a4bbabf1
SHA512

b1d8c98d6640d68b778eb4aaa65313b9c7ec9af0836a31831e1692fdd4149f4f2494b500b940c91fbc1f793d4ad68c9fce78b14d850b371558628d6bcef04692
SSDEEP

98304:psqPoBhzhaRxcSUDk36SAEdhvxWa9P593R8yAVp2H:psqPehCxcxk3ZAEUadzR8yc4H

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3357) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Executes dropped EXE 1 IoCs

Processes:

tasksche.exe

pid process

1252 tasksche.exe
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Drops file in Windows directory 1 IoCs

Processes:

2024-06-30_57dc0af3c047a9a921d83bf9bd29db24_wannacry.exe

description ioc process

File created C:\WINDOWS\tasksche.exe 2024-06-30_57dc0af3c047a9a921d83bf9bd29db24_wannacry.exe

pid	process
1252	tasksche.exe

description	ioc	process
File created	C:\WINDOWS\tasksche.exe	2024-06-30_57dc0af3c047a9a921d83bf9bd29db24_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2024-06-30_57dc0af3c047a9a921d83bf9bd29db24_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-30_57dc0af3c047a9a921d83bf9bd29db24_wannacry.exe"
1⤵
- Drops file in Windows directory
PID:4272

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
2⤵
- Executes dropped EXE
PID:1252

C:\Users\Admin\AppData\Local\Temp\2024-06-30_57dc0af3c047a9a921d83bf9bd29db24_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2024-06-30_57dc0af3c047a9a921d83bf9bd29db24_wannacry.exe -m security
1⤵
PID:4472

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe
Filesize
3.4MB

MD5
7d7daa1572af8f0743bbbf0d6c7b71e6

SHA1
c9483bdf24967ecf8c2179be785fdb3cef4c5e80

SHA256
cd52676f3d2dd8c5cf8c5ce7db95da0bb0a36af987ab1ad1c5446af832b1a5fb

SHA512
24f74f77656a296a23fd6100c96b3b2debf2a9617d79450f39c43448b116c5c8c03115874af29ec481499ec0a1ed00605f54c9a8c948a47b158a96f6c1154745

Download Submit
memory/4272-0-0x0000000000400000-0x0000000000A72000-memory.dmp

Filesize
6.4MB

Download
memory/4272-5-0x0000000000400000-0x0000000000A72000-memory.dmp

Filesize
6.4MB

Download
memory/4472-2-0x0000000000400000-0x0000000000A72000-memory.dmp

Filesize
6.4MB

Download
memory/4472-6-0x0000000000400000-0x0000000000A72000-memory.dmp

Filesize
6.4MB

Download