wannacry | 89f4e4f4701c205476928eb8c7251a5165d9720957198ee85ad3f91a32e0fb6c

Analysis

Target

07c44729e2c570b37db695323249474831f5861d45318bf49ccf5d2f5c8ea1cd.exe
Size

3.6MB
MD5

d724d8cc6420f06e8a48752f0da11c66
SHA1

3b669778698972c402f7c149fc844d0ddb3a00e8
SHA256

07c44729e2c570b37db695323249474831f5861d45318bf49ccf5d2f5c8ea1cd
SHA512

d771d74894e72402bbd016787fb102053678424205644bceec17ee3e7598e3f4aeb59b0f3272b5dbe1d26289f659024520653f57fc1bfe18054ffae4f188aef9

Score

10^/10

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Executes dropped EXE 1 IoCs

Processes:

tasksche.exe

pid process

2036 tasksche.exe

pid	process
2036	tasksche.exe

Drops file in System32 directory 1 IoCs

Processes:

07c44729e2c570b37db695323249474831f5861d45318bf49ccf5d2f5c8ea1cd.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	07c44729e2c570b37db695323249474831f5861d45318bf49ccf5d2f5c8ea1cd.exe

Drops file in Windows directory 1 IoCs

Processes:

07c44729e2c570b37db695323249474831f5861d45318bf49ccf5d2f5c8ea1cd.exe

description ioc process

File created C:\WINDOWS\tasksche.exe 07c44729e2c570b37db695323249474831f5861d45318bf49ccf5d2f5c8ea1cd.exe

description	ioc	process
File created	C:\WINDOWS\tasksche.exe	07c44729e2c570b37db695323249474831f5861d45318bf49ccf5d2f5c8ea1cd.exe

Modifies data under HKEY_USERS 1 IoCs

Processes:

07c44729e2c570b37db695323249474831f5861d45318bf49ccf5d2f5c8ea1cd.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	07c44729e2c570b37db695323249474831f5861d45318bf49ccf5d2f5c8ea1cd.exe

C:\Users\Admin\AppData\Local\Temp\07c44729e2c570b37db695323249474831f5861d45318bf49ccf5d2f5c8ea1cd.exe
"C:\Users\Admin\AppData\Local\Temp\07c44729e2c570b37db695323249474831f5861d45318bf49ccf5d2f5c8ea1cd.exe"
1⤵
- Drops file in Windows directory
PID:1308

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
2⤵
- Executes dropped EXE
PID:2036

C:\Windows\tasksche.exe
MD5
7f7ccaa16fb15eb1c7399d422f8363e8

SHA1
bd44d0ab543bf814d93b719c24e90d8dd7111234

SHA256
2584e1521065e45ec3c17767c065429038fc6291c091097ea8b22c8a502c41dd

SHA512
83e334b80de08903cfa9891a3fa349c1ece7e19f8e62b74a017512fa9a7989a0fd31929bf1fc13847bee04f2da3dacf6bc3f5ee58f0e4b9d495f4b9af12ed2b7

Download Submit
memory/1308-60-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download