wannacry | c75746cd94a393cee3ad01a000e53cac2965cc7a70889a325dadc62a2018fdc1

Analysis

max time kernel
151s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-08-2022 19:34

Target

1200de7b4adf66300ea22172fad7ed9a.exe
Size

3.6MB
MD5

1200de7b4adf66300ea22172fad7ed9a
SHA1

f4a8b2e179251f5b0912150610a215879f16051e
SHA256

c75746cd94a393cee3ad01a000e53cac2965cc7a70889a325dadc62a2018fdc1
SHA512

d2e9e576604667690b0c7eb2a27a8e8b84c37e84ff42d79b40235c7c021218f5578a9955c7f7e8ef722e748949dd1c65a179ef578b0145e3f3c5375c783420bd
SSDEEP

49152:2nAQqMSPbcBVkAMEcaEau3R8yAH1plAHI:yDqPoB2593R8yAVp2HI

Score

10^/10

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (2577) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Executes dropped EXE 1 IoCs

Processes:

tasksche.exe

pid process

4244 tasksche.exe
Drops file in Windows directory 1 IoCs

Processes:

1200de7b4adf66300ea22172fad7ed9a.exe

description ioc process

File created C:\WINDOWS\tasksche.exe 1200de7b4adf66300ea22172fad7ed9a.exe

pid	process
4244	tasksche.exe

description	ioc	process
File created	C:\WINDOWS\tasksche.exe	1200de7b4adf66300ea22172fad7ed9a.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

1200de7b4adf66300ea22172fad7ed9a.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	1200de7b4adf66300ea22172fad7ed9a.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	1200de7b4adf66300ea22172fad7ed9a.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	1200de7b4adf66300ea22172fad7ed9a.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	1200de7b4adf66300ea22172fad7ed9a.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	1200de7b4adf66300ea22172fad7ed9a.exe

C:\Users\Admin\AppData\Local\Temp\1200de7b4adf66300ea22172fad7ed9a.exe
"C:\Users\Admin\AppData\Local\Temp\1200de7b4adf66300ea22172fad7ed9a.exe"
1⤵
- Drops file in Windows directory
PID:4736

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
2⤵
- Executes dropped EXE
PID:4244

C:\Users\Admin\AppData\Local\Temp\1200de7b4adf66300ea22172fad7ed9a.exe
C:\Users\Admin\AppData\Local\Temp\1200de7b4adf66300ea22172fad7ed9a.exe -m security
1⤵
- Modifies data under HKEY_USERS
PID:4984

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

C:\Windows\tasksche.exe
Filesize
3.4MB

MD5
834b15021ab9952db7463a885d4930ab

SHA1
07c7425edc3686f97c1f36fc62297b5ad97f3180

SHA256
5e9a3ae53eae149171c1bf241cdf1144642c8c177f1b08db4de1ffabffdb040a

SHA512
8c8949be18f1f85e3cd79e5706557bc9107a6031d412c3dda280694a0e7477c0d18e41399c7a0e873f11b82174eaaf3a8c72188543e69fd3bc4c66daf527a998

Download Submit