wannacry | af116c6a6bbda54c5e488e6530829e1d6f61ed0e71aa0b424f0ab42e52f4cd74

Analysis

max time kernel
151s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2022, 19:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3fcb1d7200eda4dcdf2178c9c78e4f5d.exe
Size 3.6MB
Sample220825-ya2xashhdk
SHA256 af116c6a6bbda54c5e488e6530829e1d6f61ed0e71aa0b424f0ab42e52f4cd74
MD5 3fcb1d7200eda4dcdf2178c9c78e4f5d
SHA1 22daa8b47db8c5436be7acc7dda675e724d6c1e5
SHA512 23f534d3efc849c40aef28ca747904838e506c9ef584f98a28e5c536d79b091b9354434f844facf5471777dc5c4531e32aa4f529a41177fb6a85f27be1df7bc0
SSDEEP 24576:2bLgddQhfdmMSirYbcMNgef0QeQjG/D8kIqRYDLAE6fm8f5Qjn0kQm3yJJkzswor:2nAQqMSPbcBVQej/1gLAEHTnQJJzw
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (2109) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Executes dropped EXE 1 IoCs

pid	Process
1864	tasksche.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	3fcb1d7200eda4dcdf2178c9c78e4f5d.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	3fcb1d7200eda4dcdf2178c9c78e4f5d.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	3fcb1d7200eda4dcdf2178c9c78e4f5d.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	3fcb1d7200eda4dcdf2178c9c78e4f5d.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	3fcb1d7200eda4dcdf2178c9c78e4f5d.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	3fcb1d7200eda4dcdf2178c9c78e4f5d.exe

C:\Users\Admin\AppData\Local\Temp\3fcb1d7200eda4dcdf2178c9c78e4f5d.exe
"C:\Users\Admin\AppData\Local\Temp\3fcb1d7200eda4dcdf2178c9c78e4f5d.exe"
1⤵
- Drops file in Windows directory
PID:1248
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:1864

C:\Users\Admin\AppData\Local\Temp\3fcb1d7200eda4dcdf2178c9c78e4f5d.exe
C:\Users\Admin\AppData\Local\Temp\3fcb1d7200eda4dcdf2178c9c78e4f5d.exe -m security
1⤵
- Modifies data under HKEY_USERS
PID:3424

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 a8b6ae1583b3eb7a96782358f2f819aab77484fc232aea4bb698e5397c2fbf77
MD5 60c5e86d01b51438713c110bfb8b05ad
SHA1 818b0d2daed96962b5857c9a856b2494743fba4e
SHA512 23c033aa48cd0c90038b3e912f2b4228e3d0fc74b89d623b84f03e4dfee580185b24d5cc5346269ffbb100a413faa0486e28e88a4ae23a0ccd7100305d16efd9
SSDEEP 24576:nQhfdmMSirYbcMNgef0QeQjG/D8kIqRYDLAE6fm8f5Qjn0kQm3yJJkzswor:nQqMSPbcBVQej/1gLAEHTnQJJzw
MD5 SHA1 SHA512 SSDEEP

Submit Download