wannacry | beb0f88eb902a6ca235c2e83a60e65212b40bf9a36df64a89e0a3ba041767d29

Analysis

max time kernel
151s
max time network
153s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
10/10/2022, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
beb0f88eb902a6ca235c2e83a60e65212b40bf9a36df64a89e0a3ba041767d29.exe
Size 3.6MB
Sample221010-e3nqlaagfm
SHA256 beb0f88eb902a6ca235c2e83a60e65212b40bf9a36df64a89e0a3ba041767d29
MD5 f23f3e4b07b9d87f2991e8451850f473
SHA1 3ccd165d37d5a42099351134d284f9c754166765
SHA512 540275a62226de56cab7f3a48b07258985f523d4bb57afca43c5e3dc5f54f4f8c69f885e39267a6f1d0b0e4d2b1b61b19bb813ccfcb71064ba71e9950a373cd7
SSDEEP 49152:VnjQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdJZkeYkjkUqc:Z8qPoBhz1aRxcSUDk36SAEdJu
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (1272) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Executes dropped EXE 1 IoCs

pid	Process
1364	tasksche.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	beb0f88eb902a6ca235c2e83a60e65212b40bf9a36df64a89e0a3ba041767d29.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	beb0f88eb902a6ca235c2e83a60e65212b40bf9a36df64a89e0a3ba041767d29.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	beb0f88eb902a6ca235c2e83a60e65212b40bf9a36df64a89e0a3ba041767d29.exe

C:\Users\Admin\AppData\Local\Temp\beb0f88eb902a6ca235c2e83a60e65212b40bf9a36df64a89e0a3ba041767d29.exe
"C:\Users\Admin\AppData\Local\Temp\beb0f88eb902a6ca235c2e83a60e65212b40bf9a36df64a89e0a3ba041767d29.exe"
1⤵
- Drops file in Windows directory
PID:864
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:1364

C:\Users\Admin\AppData\Local\Temp\beb0f88eb902a6ca235c2e83a60e65212b40bf9a36df64a89e0a3ba041767d29.exe
C:\Users\Admin\AppData\Local\Temp\beb0f88eb902a6ca235c2e83a60e65212b40bf9a36df64a89e0a3ba041767d29.exe -m security
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:948

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 b71337223f48994b575098a7dd56d6306bbfba360559ace0c0328a2e6d91cf83
MD5 9aefb15aa2dc9882c341a9f40aa10583
SHA1 e721e8f7e4912ed7f98da128822829e41fca7fc8
SHA512 768a6ce940e659a45f3fdec7ab981a30f23392f21a4c94ac3e04fa7ce40700edc0d05de3e099775415e87b3019017c0d431db1067e613df85e5fa8ac49c274f1
SSDEEP 49152:nQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdJZkeYkjkUqc:QqPoBhz1aRxcSUDk36SAEdJu
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/864-54-0x0000000075141000-0x0000000075143000-memory.dmp

Download