wannacry | 49ea78f52cda72d0924460dd5f5b0f05f388d7d79d1689a6098814f035940256

Analysis

max time kernel
151s
max time network
154s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
10-10-2022 04:27

Target

49ea78f52cda72d0924460dd5f5b0f05f388d7d79d1689a6098814f035940256.exe
Size

3.6MB
MD5

faa1ac41e2e2b3f46c9f16ab2bfae63b
SHA1

5d61dfee5138dd0ca64a96f4ee445440be7e195c
SHA256

49ea78f52cda72d0924460dd5f5b0f05f388d7d79d1689a6098814f035940256
SHA512

b3efb9b9af6a0e5b39e2112ff2a54603edc18a35dfd2e60241e0c2977d71e8e50772b186d26d429deb5646acf2578e1f5ec7b4b1f07983d3fde337b82b4d6fc9
SSDEEP

12288:GwbLgPluxQhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+DHeQYSUjEXFO:VbLgdeQhfdmMSirYbcMNgef0QeQjG

Score

10^/10

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (1295) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Executes dropped EXE 1 IoCs

Processes:

tasksche.exe

pid process

628 tasksche.exe

pid	process
628	tasksche.exe

Drops file in System32 directory 1 IoCs

Processes:

49ea78f52cda72d0924460dd5f5b0f05f388d7d79d1689a6098814f035940256.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	49ea78f52cda72d0924460dd5f5b0f05f388d7d79d1689a6098814f035940256.exe

Drops file in Windows directory 1 IoCs

Processes:

49ea78f52cda72d0924460dd5f5b0f05f388d7d79d1689a6098814f035940256.exe

description ioc process

File created C:\WINDOWS\tasksche.exe 49ea78f52cda72d0924460dd5f5b0f05f388d7d79d1689a6098814f035940256.exe

description	ioc	process
File created	C:\WINDOWS\tasksche.exe	49ea78f52cda72d0924460dd5f5b0f05f388d7d79d1689a6098814f035940256.exe

Modifies data under HKEY_USERS 1 IoCs

Processes:

49ea78f52cda72d0924460dd5f5b0f05f388d7d79d1689a6098814f035940256.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	49ea78f52cda72d0924460dd5f5b0f05f388d7d79d1689a6098814f035940256.exe

C:\Users\Admin\AppData\Local\Temp\49ea78f52cda72d0924460dd5f5b0f05f388d7d79d1689a6098814f035940256.exe
"C:\Users\Admin\AppData\Local\Temp\49ea78f52cda72d0924460dd5f5b0f05f388d7d79d1689a6098814f035940256.exe"
1⤵
- Drops file in Windows directory
PID:1212

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
2⤵
- Executes dropped EXE
PID:628

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

C:\Windows\tasksche.exe
Filesize
3.4MB

MD5
9b7c37cceaeb8e7164d58498a0332921

SHA1
571ed27ad791e0a19ed4b99baac457910199ffe0

SHA256
fae12333479ed0b93dbf80f7fe73030260ad05af81b3122b96cc44ac1607cf29

SHA512
7bfbbee8bd9f5797b938d6a378521d69c8d9c01345644ee959217db2342e888d34b3bb1a8b8b55b5ede700b61043365ca1bec84e10521d2d212a2b830b1e6457

Download Submit
memory/1212-54-0x0000000075E11000-0x0000000075E13000-memory.dmp

Filesize
8KB

Download