wannacry | 26eebe4267523f0fd8e6ab6a857be45909cc88240e93549b6089921313dedf8e

Analysis

max time kernel
151s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
10/10/2022, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
26eebe4267523f0fd8e6ab6a857be45909cc88240e93549b6089921313dedf8e.exe
Size 3.6MB
Sample221010-sdaz4accb8
SHA256 26eebe4267523f0fd8e6ab6a857be45909cc88240e93549b6089921313dedf8e
MD5 b6aeab8b14c4279100d7f14b78dc4ec5
SHA1 887fc185484327153b63d5d356fe3a5eaebf105c
SHA512 02f032620b17637a584bc8b4e2e2f5ec584588f123ea24d53dbceaecf7665e996e9b658bdd6bf5eac0159de20299ee04922104d4fb9ac8eefd35bc364424aad0
SSDEEP 98304:yDqPoBU1aRxcSUDk36SAEdhvxWa9P593R8yAVp2HI:yDqPT1Cxcxk3ZAEUadzR8yc4HI
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (2611) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Executes dropped EXE 1 IoCs

pid	Process
2200	tasksche.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	26eebe4267523f0fd8e6ab6a857be45909cc88240e93549b6089921313dedf8e.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	26eebe4267523f0fd8e6ab6a857be45909cc88240e93549b6089921313dedf8e.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	26eebe4267523f0fd8e6ab6a857be45909cc88240e93549b6089921313dedf8e.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	26eebe4267523f0fd8e6ab6a857be45909cc88240e93549b6089921313dedf8e.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	26eebe4267523f0fd8e6ab6a857be45909cc88240e93549b6089921313dedf8e.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	26eebe4267523f0fd8e6ab6a857be45909cc88240e93549b6089921313dedf8e.exe

C:\Users\Admin\AppData\Local\Temp\26eebe4267523f0fd8e6ab6a857be45909cc88240e93549b6089921313dedf8e.exe
"C:\Users\Admin\AppData\Local\Temp\26eebe4267523f0fd8e6ab6a857be45909cc88240e93549b6089921313dedf8e.exe"
1⤵
- Drops file in Windows directory
PID:5044
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:2200

C:\Users\Admin\AppData\Local\Temp\26eebe4267523f0fd8e6ab6a857be45909cc88240e93549b6089921313dedf8e.exe
C:\Users\Admin\AppData\Local\Temp\26eebe4267523f0fd8e6ab6a857be45909cc88240e93549b6089921313dedf8e.exe -m security
1⤵
- Modifies data under HKEY_USERS
PID:4396

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 adf176fbc103224e03665925264d7388d8bcd406a3f61981e43b4732304957cf
MD5 753b5844028fbc529c56adce1f2ff2c1
SHA1 3ef1b35bc5ec02adb7f87fbc4abdf1146f578b7c
SHA512 7893bb596552724151c578a67ba852998e9ca33e1f812506ae0163e479591865d245060c7d6ca1a6ddae0de049a3e91803599b9f9268a11f4105c4843b7f7fe1
SSDEEP 98304:QqPoBU1aRxcSUDk36SAEdhvxWa9P593R8yAVp2Hj:QqPT1Cxcxk3ZAEUadzR8yc4Hj
MD5 SHA1 SHA512 SSDEEP

Submit Download