Behavioral Report

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
20-09-2022 17:00

Sharing

Copy URL

Twitter E-mail

Report Files Registry Network Processes Mutex Misc

General

Target

ca9a7b4335e93fcd9c860cbd66d7c296.exe
Size

4MB
MD5

ca9a7b4335e93fcd9c860cbd66d7c296
SHA1

87d4fd830bf34628dd5d6eae34f5fdfa75f05cb7
SHA256

c81d368bfdb47c4f9f48ee4617c506dbf56a3a1b6806bad8f4ef353bcf863cc5
SHA512

b8e111d4454e544e6f195285259818faa9595c32c6670c952191a102c21dfd08970dd11290f624cdbf354942a272592de9ff2a75c0e74b854189967457627433
SSDEEP

24576:QbLgurgDdmMSirYbcMNgef0QeQjG/D8kIqRYoAdNLKz6626M+vbOSSqTPVXmiHkO:QnsEMSPbcBVQej/1INRx+TSqTdX1HkQ

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3330) amount of remote hosts ⋅ 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

TTPs:

Network Service Scanning
Creates a large amount of network flows ⋅ 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

TTPs:

Network Service Scanning
Drops file in Windows directory ⋅ 1 IoCs

Processes:

ca9a7b4335e93fcd9c860cbd66d7c296.exe

description ioc process

File created C:\WINDOWS\tasksche.exe ca9a7b4335e93fcd9c860cbd66d7c296.exe

description	ioc	process
File created	C:\WINDOWS\tasksche.exe	ca9a7b4335e93fcd9c860cbd66d7c296.exe

Modifies data under HKEY_USERS ⋅ 12 IoCs

Processes:

ca9a7b4335e93fcd9c860cbd66d7c296.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ca9a7b4335e93fcd9c860cbd66d7c296.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ca9a7b4335e93fcd9c860cbd66d7c296.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History	ca9a7b4335e93fcd9c860cbd66d7c296.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	ca9a7b4335e93fcd9c860cbd66d7c296.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P	ca9a7b4335e93fcd9c860cbd66d7c296.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	ca9a7b4335e93fcd9c860cbd66d7c296.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	ca9a7b4335e93fcd9c860cbd66d7c296.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ca9a7b4335e93fcd9c860cbd66d7c296.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ca9a7b4335e93fcd9c860cbd66d7c296.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ca9a7b4335e93fcd9c860cbd66d7c296.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	ca9a7b4335e93fcd9c860cbd66d7c296.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	ca9a7b4335e93fcd9c860cbd66d7c296.exe

C:\Users\Admin\AppData\Local\Temp\ca9a7b4335e93fcd9c860cbd66d7c296.exe

"C:\Users\Admin\AppData\Local\Temp\ca9a7b4335e93fcd9c860cbd66d7c296.exe"

Drops file in Windows directory

PID:4452

C:\Users\Admin\AppData\Local\Temp\ca9a7b4335e93fcd9c860cbd66d7c296.exe

C:\Users\Admin\AppData\Local\Temp\ca9a7b4335e93fcd9c860cbd66d7c296.exe -m security

Modifies data under HKEY_USERS

PID:4688

Network

MITRE ATT&CK Matrix

Collection

Command and Control

Credential Access

Defense Evasion

Discovery

Network Service Scanning

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Privilege Escalation

Replay Monitor

00:00 00:00