wannacry | 67bfe3dffaa83f835b6ca8dd49d0c990a89cd518700830e7263cc7351329a13c

Analysis

max time kernel
153s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2022, 19:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2f6cfb7f48e804959628066fb7469617.exe
Size 3.6MB
Sample221004-x4tmcacbb9
SHA256 67bfe3dffaa83f835b6ca8dd49d0c990a89cd518700830e7263cc7351329a13c
MD5 2f6cfb7f48e804959628066fb7469617
SHA1 cde854383d4d04560c2696f61672f24f111511ee
SHA512 03430666f1c2e10738e9df781674a657a2c059f426e640bb02ad3dea10e5bc1104f5af79c4762a71f7760ba617d94bf931a4fedab4a2bb0270c6685707f18a29
SSDEEP 98304:oDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2HVO:oDqPe1Cxcxk3ZAEUadzR8yc4HVO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (2108) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Executes dropped EXE 1 IoCs

pid	Process
4212	tasksche.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	2f6cfb7f48e804959628066fb7469617.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	2f6cfb7f48e804959628066fb7469617.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	2f6cfb7f48e804959628066fb7469617.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	2f6cfb7f48e804959628066fb7469617.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	2f6cfb7f48e804959628066fb7469617.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	2f6cfb7f48e804959628066fb7469617.exe

C:\Users\Admin\AppData\Local\Temp\2f6cfb7f48e804959628066fb7469617.exe
"C:\Users\Admin\AppData\Local\Temp\2f6cfb7f48e804959628066fb7469617.exe"
1⤵
- Drops file in Windows directory
PID:2024
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:4212

C:\Users\Admin\AppData\Local\Temp\2f6cfb7f48e804959628066fb7469617.exe
C:\Users\Admin\AppData\Local\Temp\2f6cfb7f48e804959628066fb7469617.exe -m security
1⤵
- Modifies data under HKEY_USERS
PID:3600

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 2584e1521065e45ec3c17767c065429038fc6291c091097ea8b22c8a502c41dd
MD5 7f7ccaa16fb15eb1c7399d422f8363e8
SHA1 bd44d0ab543bf814d93b719c24e90d8dd7111234
SHA512 83e334b80de08903cfa9891a3fa349c1ece7e19f8e62b74a017512fa9a7989a0fd31929bf1fc13847bee04f2da3dacf6bc3f5ee58f0e4b9d495f4b9af12ed2b7
SSDEEP 98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2Hj:QqPe1Cxcxk3ZAEUadzR8yc4Hj
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2024-132-0x0000000000400000-0x0000000000A72000-memory.dmp

Download

memory/2024-135-0x0000000000400000-0x0000000000A72000-memory.dmp

Download

memory/3600-133-0x0000000000400000-0x0000000000A72000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads