wannacry | 007e88fa9f380b15b3d4fd38a8682db9d1e4b986a7a2315fc98da1c973b403a3

General

Target

007e88fa9f380b15b3d4fd38a8682db9d1e4b986a7a2315fc98da1c973b403a3.exe
Size

3.6MB
MD5

852ed77122acf1b4f081e159f354bc2e
SHA1

e9d3b9c942bc579e2902df522c654e2946b1fcb5
SHA256

007e88fa9f380b15b3d4fd38a8682db9d1e4b986a7a2315fc98da1c973b403a3
SHA512

94d0688789f20ef0429cbee88577eab28cb5c7b91ba7e817a2be278264456198ed51419ccddabcf03afc74cd1f5389cc05c04beb04cbacbb0c8f59175153b338

Score

10^/10

wannacry ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Executes dropped EXE 1 IoCs

Processes:

tasksche.exe

pid process

1712 tasksche.exe

pid	process
1712	tasksche.exe

Drops file in System32 directory 1 IoCs

Processes:

007e88fa9f380b15b3d4fd38a8682db9d1e4b986a7a2315fc98da1c973b403a3.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	007e88fa9f380b15b3d4fd38a8682db9d1e4b986a7a2315fc98da1c973b403a3.exe

Drops file in Windows directory 1 IoCs

Processes:

007e88fa9f380b15b3d4fd38a8682db9d1e4b986a7a2315fc98da1c973b403a3.exe

description ioc process

File created C:\WINDOWS\tasksche.exe 007e88fa9f380b15b3d4fd38a8682db9d1e4b986a7a2315fc98da1c973b403a3.exe

description	ioc	process
File created	C:\WINDOWS\tasksche.exe	007e88fa9f380b15b3d4fd38a8682db9d1e4b986a7a2315fc98da1c973b403a3.exe

Modifies data under HKEY_USERS 24 IoCs

Processes:

007e88fa9f380b15b3d4fd38a8682db9d1e4b986a7a2315fc98da1c973b403a3.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	007e88fa9f380b15b3d4fd38a8682db9d1e4b986a7a2315fc98da1c973b403a3.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	007e88fa9f380b15b3d4fd38a8682db9d1e4b986a7a2315fc98da1c973b403a3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	007e88fa9f380b15b3d4fd38a8682db9d1e4b986a7a2315fc98da1c973b403a3.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecisionTime = 40f67aea2f49d701	007e88fa9f380b15b3d4fd38a8682db9d1e4b986a7a2315fc98da1c973b403a3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\32-e2-17-db-d2-77	007e88fa9f380b15b3d4fd38a8682db9d1e4b986a7a2315fc98da1c973b403a3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	007e88fa9f380b15b3d4fd38a8682db9d1e4b986a7a2315fc98da1c973b403a3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	007e88fa9f380b15b3d4fd38a8682db9d1e4b986a7a2315fc98da1c973b403a3.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	007e88fa9f380b15b3d4fd38a8682db9d1e4b986a7a2315fc98da1c973b403a3.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecisionReason = "1"	007e88fa9f380b15b3d4fd38a8682db9d1e4b986a7a2315fc98da1c973b403a3.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecision = "0"	007e88fa9f380b15b3d4fd38a8682db9d1e4b986a7a2315fc98da1c973b403a3.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionReason = "1"	007e88fa9f380b15b3d4fd38a8682db9d1e4b986a7a2315fc98da1c973b403a3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}	007e88fa9f380b15b3d4fd38a8682db9d1e4b986a7a2315fc98da1c973b403a3.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	007e88fa9f380b15b3d4fd38a8682db9d1e4b986a7a2315fc98da1c973b403a3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	007e88fa9f380b15b3d4fd38a8682db9d1e4b986a7a2315fc98da1c973b403a3.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	007e88fa9f380b15b3d4fd38a8682db9d1e4b986a7a2315fc98da1c973b403a3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	007e88fa9f380b15b3d4fd38a8682db9d1e4b986a7a2315fc98da1c973b403a3.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	007e88fa9f380b15b3d4fd38a8682db9d1e4b986a7a2315fc98da1c973b403a3.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	007e88fa9f380b15b3d4fd38a8682db9d1e4b986a7a2315fc98da1c973b403a3.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a07000d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	007e88fa9f380b15b3d4fd38a8682db9d1e4b986a7a2315fc98da1c973b403a3.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadNetworkName = "Network"	007e88fa9f380b15b3d4fd38a8682db9d1e4b986a7a2315fc98da1c973b403a3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77	007e88fa9f380b15b3d4fd38a8682db9d1e4b986a7a2315fc98da1c973b403a3.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecision = "0"	007e88fa9f380b15b3d4fd38a8682db9d1e4b986a7a2315fc98da1c973b403a3.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	007e88fa9f380b15b3d4fd38a8682db9d1e4b986a7a2315fc98da1c973b403a3.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionTime = 40f67aea2f49d701	007e88fa9f380b15b3d4fd38a8682db9d1e4b986a7a2315fc98da1c973b403a3.exe

C:\Users\Admin\AppData\Local\Temp\007e88fa9f380b15b3d4fd38a8682db9d1e4b986a7a2315fc98da1c973b403a3.exe
"C:\Users\Admin\AppData\Local\Temp\007e88fa9f380b15b3d4fd38a8682db9d1e4b986a7a2315fc98da1c973b403a3.exe"
1⤵
- Drops file in Windows directory
PID:1200

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
2⤵
- Executes dropped EXE
PID:1712

C:\Users\Admin\AppData\Local\Temp\007e88fa9f380b15b3d4fd38a8682db9d1e4b986a7a2315fc98da1c973b403a3.exe
C:\Users\Admin\AppData\Local\Temp\007e88fa9f380b15b3d4fd38a8682db9d1e4b986a7a2315fc98da1c973b403a3.exe -m security
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1152

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe
MD5
d8fbdee1915da082b2a0769811328dfa

SHA1
4d6cf3133139f95e0b810514d9654553f629f07d

SHA256
34bf1c161a782b129c25a606790ad63e24d8b215589245241f67d803bd91b58c

SHA512
0f30cac3872df98241418e07f3dcac2ce93b0fcd9fa8bec5a4e14fb26f99fc8004773691f68eb801511c14cc236995dc8b6e997c9ef983a23ea7214f5bf7b1ca

Download Submit
memory/1200-59-0x00000000768B1000-0x00000000768B3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing