wannacry | e1c3744967613b18b6766b83f4b45be7f0ecfd0515573440b7d31430ccc92919

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
10-10-2022 04:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e1c3744967613b18b6766b83f4b45be7f0ecfd0515573440b7d31430ccc92919.exe
Size

3.6MB
MD5

0e0cdad186b2f9fc46c2b90762ccf69c
SHA1

92771a67bbee538a74a8a54380e4f5c947a34991
SHA256

e1c3744967613b18b6766b83f4b45be7f0ecfd0515573440b7d31430ccc92919
SHA512

a2bfdff6b0711843c9f1254ee2f29db2ad6475b7adb659e82c190d6204f7bb99c464e02a8f2c12be94e2643c5fb05798f013520658069c4244a1e07d500a1f18
SSDEEP

49152:4naMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9:oaPoBhz1aRxcSUDk36SAEdhvxWa9

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3274) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Drops file in Windows directory 1 IoCs

Processes:

e1c3744967613b18b6766b83f4b45be7f0ecfd0515573440b7d31430ccc92919.exe

description ioc process

File created C:\WINDOWS\tasksche.exe e1c3744967613b18b6766b83f4b45be7f0ecfd0515573440b7d31430ccc92919.exe

description	ioc	process
File created	C:\WINDOWS\tasksche.exe	e1c3744967613b18b6766b83f4b45be7f0ecfd0515573440b7d31430ccc92919.exe

Modifies data under HKEY_USERS 12 IoCs

Processes:

e1c3744967613b18b6766b83f4b45be7f0ecfd0515573440b7d31430ccc92919.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	e1c3744967613b18b6766b83f4b45be7f0ecfd0515573440b7d31430ccc92919.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	e1c3744967613b18b6766b83f4b45be7f0ecfd0515573440b7d31430ccc92919.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	e1c3744967613b18b6766b83f4b45be7f0ecfd0515573440b7d31430ccc92919.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	e1c3744967613b18b6766b83f4b45be7f0ecfd0515573440b7d31430ccc92919.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	e1c3744967613b18b6766b83f4b45be7f0ecfd0515573440b7d31430ccc92919.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History	e1c3744967613b18b6766b83f4b45be7f0ecfd0515573440b7d31430ccc92919.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	e1c3744967613b18b6766b83f4b45be7f0ecfd0515573440b7d31430ccc92919.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	e1c3744967613b18b6766b83f4b45be7f0ecfd0515573440b7d31430ccc92919.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P	e1c3744967613b18b6766b83f4b45be7f0ecfd0515573440b7d31430ccc92919.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	e1c3744967613b18b6766b83f4b45be7f0ecfd0515573440b7d31430ccc92919.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	e1c3744967613b18b6766b83f4b45be7f0ecfd0515573440b7d31430ccc92919.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	e1c3744967613b18b6766b83f4b45be7f0ecfd0515573440b7d31430ccc92919.exe

C:\Users\Admin\AppData\Local\Temp\e1c3744967613b18b6766b83f4b45be7f0ecfd0515573440b7d31430ccc92919.exe
"C:\Users\Admin\AppData\Local\Temp\e1c3744967613b18b6766b83f4b45be7f0ecfd0515573440b7d31430ccc92919.exe"
1⤵
- Drops file in Windows directory
PID:2268

C:\Users\Admin\AppData\Local\Temp\e1c3744967613b18b6766b83f4b45be7f0ecfd0515573440b7d31430ccc92919.exe
C:\Users\Admin\AppData\Local\Temp\e1c3744967613b18b6766b83f4b45be7f0ecfd0515573440b7d31430ccc92919.exe -m security
1⤵
- Modifies data under HKEY_USERS
PID:1920

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads