wannacry | 6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf

General

Target

6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe
Size

3.6MB
MD5

115ca848f0c3d5208efa8608721d3743
SHA1

0b522d330814f13b954f58a77001e13b1b0d47e2
SHA256

6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf
SHA512

d246d65114b9de8d113c71c317df1947c0d5975d30811d8193d64985882998ddad698b49039549200ad1856a393465f78dfb48c57263609da9f4c4b3c1676173

Score

10^/10

wannacry ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Executes dropped EXE 1 IoCs

Processes:

tasksche.exe

pid process

1220 tasksche.exe

pid	process
1220	tasksche.exe

Drops file in System32 directory 2 IoCs

Processes:

6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe

Drops file in Windows directory 1 IoCs

Processes:

6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe

description ioc process

File created C:\WINDOWS\tasksche.exe 6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

296 1800 WerFault.exe 6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe

description	ioc	process
File created	C:\WINDOWS\tasksche.exe	6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe

pid	pid_target	process	target process
296	1800	WerFault.exe	6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe

Modifies data under HKEY_USERS 49 IoCs

Processes:

6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecisionTime = 10b3cfbe3c49d701	6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionTime = 10b3cfbe3c49d701	6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecisionReason = "1"	6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\32-e2-17-db-d2-77	6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionTime = f013a17f3c49d701	6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecision = "0"	6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a07000c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77	6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionReason = "1"	6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a07000c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionTime = f013a17f3c49d701	6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDetectedUrl	6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a07000c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadNetworkName = "Network"	6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}	6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecision = "0"	6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}	6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecision = "0"	6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77	6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionReason = "1"	6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\32-e2-17-db-d2-77	6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecision = "0"	6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecisionReason = "1"	6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecisionTime = f013a17f3c49d701	6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadNetworkName = "Network"	6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

296 WerFault.exe
296 WerFault.exe
296 WerFault.exe
296 WerFault.exe
296 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 296 WerFault.exe

pid	process
296	WerFault.exe
296	WerFault.exe
296	WerFault.exe
296	WerFault.exe
296	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	296	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe

description	pid	process	target process
PID 1800 wrote to memory of 296	1800	6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe	WerFault.exe
PID 1800 wrote to memory of 296	1800	6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe	WerFault.exe
PID 1800 wrote to memory of 296	1800	6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe	WerFault.exe
PID 1800 wrote to memory of 296	1800	6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe
"C:\Users\Admin\AppData\Local\Temp\6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe"
1⤵
- Drops file in Windows directory
PID:484

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
2⤵
- Executes dropped EXE
PID:1220

C:\Users\Admin\AppData\Local\Temp\6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe
C:\Users\Admin\AppData\Local\Temp\6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe -m security
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 1480
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:296

C:\Users\Admin\AppData\Local\Temp\6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe
C:\Users\Admin\AppData\Local\Temp\6c6a737e7257ef58331a83aa562d3b3d9cfc385c752bcb91dd0b216e82293faf.exe -m security
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1468

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe
MD5
4f924ae83006aeac7ba8af3f736cbf0c

SHA1
c11713220381694446a039dcf5e8b88bcde3113c

SHA256
c462425b6c3e7d1db101be6bb374af650902783a3b46d6cecda3488dedb4e621

SHA512
04fc3ed14be971e09c05da4ea16bf9df89621feb280fce020cc0c0b8497d2ee34f45f2001c5bfd1cd131bb157aaa5905a395c0f76dd7a2c78bb0d1ccaccfb1d0

Download Submit
memory/296-62-0x0000000000000000-mapping.dmp

Download
memory/484-59-0x0000000075551000-0x0000000075553000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads