wannacry | 011c24bce46c2ded7236482e0e36530dd27c937e31a0896e91659d9acd7ceb69

General

Target

011c24bce46c2ded7236482e0e36530dd27c937e31a0896e91659d9acd7ceb69.exe
Size

3.6MB
MD5

31510bd9b6f5c297c64492ab86aacaa1
SHA1

95f2b6d6fa1c48d71d2154270ba77aa3af74adc1
SHA256

011c24bce46c2ded7236482e0e36530dd27c937e31a0896e91659d9acd7ceb69
SHA512

7795c6e630e5ac91f96683ff64eff8550111f75ea76e992eb8be9c4bc70c5fdcc1daab34b035dde7b16fb658eb660c9b33e3822df47e89a39c63f446d30aad1c

Score

10^/10

wannacry ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Executes dropped EXE 1 IoCs

Processes:

tasksche.exe

pid process

1176 tasksche.exe

pid	process
1176	tasksche.exe

Drops file in System32 directory 5 IoCs

Processes:

011c24bce46c2ded7236482e0e36530dd27c937e31a0896e91659d9acd7ceb69.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	011c24bce46c2ded7236482e0e36530dd27c937e31a0896e91659d9acd7ceb69.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	011c24bce46c2ded7236482e0e36530dd27c937e31a0896e91659d9acd7ceb69.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	011c24bce46c2ded7236482e0e36530dd27c937e31a0896e91659d9acd7ceb69.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	011c24bce46c2ded7236482e0e36530dd27c937e31a0896e91659d9acd7ceb69.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	011c24bce46c2ded7236482e0e36530dd27c937e31a0896e91659d9acd7ceb69.exe

Drops file in Windows directory 1 IoCs

Processes:

011c24bce46c2ded7236482e0e36530dd27c937e31a0896e91659d9acd7ceb69.exe

description ioc process

File created C:\WINDOWS\tasksche.exe 011c24bce46c2ded7236482e0e36530dd27c937e31a0896e91659d9acd7ceb69.exe

description	ioc	process
File created	C:\WINDOWS\tasksche.exe	011c24bce46c2ded7236482e0e36530dd27c937e31a0896e91659d9acd7ceb69.exe

Modifies data under HKEY_USERS 8 IoCs

Processes:

011c24bce46c2ded7236482e0e36530dd27c937e31a0896e91659d9acd7ceb69.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	011c24bce46c2ded7236482e0e36530dd27c937e31a0896e91659d9acd7ceb69.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	011c24bce46c2ded7236482e0e36530dd27c937e31a0896e91659d9acd7ceb69.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	011c24bce46c2ded7236482e0e36530dd27c937e31a0896e91659d9acd7ceb69.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	011c24bce46c2ded7236482e0e36530dd27c937e31a0896e91659d9acd7ceb69.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	011c24bce46c2ded7236482e0e36530dd27c937e31a0896e91659d9acd7ceb69.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	011c24bce46c2ded7236482e0e36530dd27c937e31a0896e91659d9acd7ceb69.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	011c24bce46c2ded7236482e0e36530dd27c937e31a0896e91659d9acd7ceb69.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	011c24bce46c2ded7236482e0e36530dd27c937e31a0896e91659d9acd7ceb69.exe

C:\Users\Admin\AppData\Local\Temp\011c24bce46c2ded7236482e0e36530dd27c937e31a0896e91659d9acd7ceb69.exe
"C:\Users\Admin\AppData\Local\Temp\011c24bce46c2ded7236482e0e36530dd27c937e31a0896e91659d9acd7ceb69.exe"
1⤵
- Drops file in Windows directory
PID:1824

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
2⤵
- Executes dropped EXE
PID:1176

C:\Users\Admin\AppData\Local\Temp\011c24bce46c2ded7236482e0e36530dd27c937e31a0896e91659d9acd7ceb69.exe
C:\Users\Admin\AppData\Local\Temp\011c24bce46c2ded7236482e0e36530dd27c937e31a0896e91659d9acd7ceb69.exe -m security
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:592

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe
MD5
7f7ccaa16fb15eb1c7399d422f8363e8

SHA1
bd44d0ab543bf814d93b719c24e90d8dd7111234

SHA256
2584e1521065e45ec3c17767c065429038fc6291c091097ea8b22c8a502c41dd

SHA512
83e334b80de08903cfa9891a3fa349c1ece7e19f8e62b74a017512fa9a7989a0fd31929bf1fc13847bee04f2da3dacf6bc3f5ee58f0e4b9d495f4b9af12ed2b7

Download Submit

Analysis

Sharing