wannacry | 50864f4e4f20010e4066d74bebb4fb95d178ac965b2d1a04766a935d7f4b18ba

Analysis

max time kernel
154s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2022, 19:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1457da48cd8b51b54792cf4d13175eb8.exe
Size 3.6MB
Sample221004-x4lazacbb4
SHA256 50864f4e4f20010e4066d74bebb4fb95d178ac965b2d1a04766a935d7f4b18ba
MD5 1457da48cd8b51b54792cf4d13175eb8
SHA1 0061904369080aa7bd20b87fde01cc940ec0935a
SHA512 1874aee2b626473b3729c6b71c70b62e836adc81a9848e140c478971f47991b90f40c4cc866fc1ef4c57d5d7a7e422514c9bcd82e1c0e2a66d1bc9cb4089151c
SSDEEP 12288:GvbLgPlu+QhMbaIMu7L5NVErCA4z2g6rTcbckPUy2chP:2bLgddQhfdmMSirYbcC2chP
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (2865) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Executes dropped EXE 1 IoCs

pid	Process
1452	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	1457da48cd8b51b54792cf4d13175eb8.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	1457da48cd8b51b54792cf4d13175eb8.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	1457da48cd8b51b54792cf4d13175eb8.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	1457da48cd8b51b54792cf4d13175eb8.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	1457da48cd8b51b54792cf4d13175eb8.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	1457da48cd8b51b54792cf4d13175eb8.exe

C:\Users\Admin\AppData\Local\Temp\1457da48cd8b51b54792cf4d13175eb8.exe
"C:\Users\Admin\AppData\Local\Temp\1457da48cd8b51b54792cf4d13175eb8.exe"
1⤵
- Drops file in Windows directory
PID:4344
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:1452

C:\Users\Admin\AppData\Local\Temp\1457da48cd8b51b54792cf4d13175eb8.exe
C:\Users\Admin\AppData\Local\Temp\1457da48cd8b51b54792cf4d13175eb8.exe -m security
1⤵
- Modifies data under HKEY_USERS
PID:4776

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 de40bfcff0ced61f5e4b639672d6dee42ddf178b792ab228ba8ec5c3990bd301
MD5 812ea5f274980e1738065fa7c3074a14
SHA1 ab5b7761dcf81fc858a216e715c091a2f2ce6081
SHA512 b2c40a93e9ba917be1d0ffbc25f5120e7939400de7f22de054edd2b8d9e44b9120b05a23953f978556c06a5c03a92c6efef583473fe2156aeb894052cf1026eb
SSDEEP 12288:nQhMbaIMu7L5NVErCA4z2g6rTcbckPUy2chP:nQhfdmMSirYbcC2chP
MD5 SHA1 SHA512 SSDEEP

Submit Download