wannacry | 10c46f318b13dac0d8b3f7a44053432d7c01b8efeea9385dadb011a273cee1ee

General

Target

f09f4be000296548d71b82d326115fff.exe
Size

2.2MB
MD5

f09f4be000296548d71b82d326115fff
SHA1

ee85f8d32e9cca9baee629a49676973f293f5c66
SHA256

10c46f318b13dac0d8b3f7a44053432d7c01b8efeea9385dadb011a273cee1ee
SHA512

c6972807e481cebc259f1d95b4397f51d50a42d7776df3b196f6d133d1435f4ccc49a0d9ece158b05ddff753d0af477b7d71e3100a26f38139ff7aa96d208f13
SSDEEP

49152:wnpEKUv9wC7+VQej/1INRx+TSqTdX1HkQo6SA:wpyv+Fhz1aRxcSUDk36SA

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (1051) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Executes dropped EXE 1 IoCs

Processes:

tasksche.exe

pid process

852 tasksche.exe

pid	process
852	tasksche.exe

Drops file in System32 directory 1 IoCs

Processes:

f09f4be000296548d71b82d326115fff.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	f09f4be000296548d71b82d326115fff.exe

Drops file in Windows directory 3 IoCs

Processes:

tasksche.exef09f4be000296548d71b82d326115fff.exe

description	ioc	process
File created	C:\Windows\eee.exe	tasksche.exe
File created	C:\WINDOWS\tasksche.exe	f09f4be000296548d71b82d326115fff.exe
File created	C:\Windows\__tmp_rar_sfx_access_check_7146140	tasksche.exe

Modifies data under HKEY_USERS 24 IoCs

Processes:

f09f4be000296548d71b82d326115fff.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	f09f4be000296548d71b82d326115fff.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4917772D-CF6C-4CF6-A6D7-8946A8878649}\WpadDecision = "0"	f09f4be000296548d71b82d326115fff.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7e-b2-ad-6b-7a-8c\WpadDecision = "0"	f09f4be000296548d71b82d326115fff.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	f09f4be000296548d71b82d326115fff.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	f09f4be000296548d71b82d326115fff.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	f09f4be000296548d71b82d326115fff.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	f09f4be000296548d71b82d326115fff.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4917772D-CF6C-4CF6-A6D7-8946A8878649}	f09f4be000296548d71b82d326115fff.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4917772D-CF6C-4CF6-A6D7-8946A8878649}\WpadNetworkName = "Network 2"	f09f4be000296548d71b82d326115fff.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	f09f4be000296548d71b82d326115fff.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	f09f4be000296548d71b82d326115fff.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	f09f4be000296548d71b82d326115fff.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	f09f4be000296548d71b82d326115fff.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0014000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	f09f4be000296548d71b82d326115fff.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4917772D-CF6C-4CF6-A6D7-8946A8878649}\WpadDecisionReason = "1"	f09f4be000296548d71b82d326115fff.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	f09f4be000296548d71b82d326115fff.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	f09f4be000296548d71b82d326115fff.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4917772D-CF6C-4CF6-A6D7-8946A8878649}\WpadDecisionTime = a045c32fcbb8d801	f09f4be000296548d71b82d326115fff.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7e-b2-ad-6b-7a-8c	f09f4be000296548d71b82d326115fff.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4917772D-CF6C-4CF6-A6D7-8946A8878649}\7e-b2-ad-6b-7a-8c	f09f4be000296548d71b82d326115fff.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7e-b2-ad-6b-7a-8c\WpadDecisionReason = "1"	f09f4be000296548d71b82d326115fff.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7e-b2-ad-6b-7a-8c\WpadDecisionTime = a045c32fcbb8d801	f09f4be000296548d71b82d326115fff.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	f09f4be000296548d71b82d326115fff.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	f09f4be000296548d71b82d326115fff.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

f09f4be000296548d71b82d326115fff.exe

description	pid	process	target process
PID 384 wrote to memory of 852	384	f09f4be000296548d71b82d326115fff.exe	tasksche.exe
PID 384 wrote to memory of 852	384	f09f4be000296548d71b82d326115fff.exe	tasksche.exe
PID 384 wrote to memory of 852	384	f09f4be000296548d71b82d326115fff.exe	tasksche.exe
PID 384 wrote to memory of 852	384	f09f4be000296548d71b82d326115fff.exe	tasksche.exe
PID 384 wrote to memory of 852	384	f09f4be000296548d71b82d326115fff.exe	tasksche.exe
PID 384 wrote to memory of 852	384	f09f4be000296548d71b82d326115fff.exe	tasksche.exe
PID 384 wrote to memory of 852	384	f09f4be000296548d71b82d326115fff.exe	tasksche.exe

C:\Users\Admin\AppData\Local\Temp\f09f4be000296548d71b82d326115fff.exe
"C:\Users\Admin\AppData\Local\Temp\f09f4be000296548d71b82d326115fff.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:384

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
2⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:852

C:\Users\Admin\AppData\Local\Temp\f09f4be000296548d71b82d326115fff.exe
C:\Users\Admin\AppData\Local\Temp\f09f4be000296548d71b82d326115fff.exe -m security
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1712

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

1

T1046

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\tasksche.exe
Filesize
2.0MB

MD5
1829f1d34da98a4ee90cf5ff9bc0b197

SHA1
86e55f10f89a9bdbbb02baf3a24ea731b3b8e806

SHA256
784df66b932f45f29f80a4115a02890e56d2d29701a7099a49d6b3e081f9ddc3

SHA512
2d86533fca4171d88a419a9aa3f50f6f63da315381c5d8fc26a24dbaa8603b79adc543dc6d1d12b9130b80f9ee4fd01bceb5d449065f89c2e2084dc138dd6cf9

Download Submit
C:\Windows\tasksche.exe
Filesize
2.0MB

MD5
1829f1d34da98a4ee90cf5ff9bc0b197

SHA1
86e55f10f89a9bdbbb02baf3a24ea731b3b8e806

SHA256
784df66b932f45f29f80a4115a02890e56d2d29701a7099a49d6b3e081f9ddc3

SHA512
2d86533fca4171d88a419a9aa3f50f6f63da315381c5d8fc26a24dbaa8603b79adc543dc6d1d12b9130b80f9ee4fd01bceb5d449065f89c2e2084dc138dd6cf9

Download Submit
memory/384-54-0x0000000074C91000-0x0000000074C93000-memory.dmp

Filesize
8KB

Download
memory/852-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads