wannacry | 1cb50db0322692be5612fed491a58fc79e87a0434603db2f108ddd1153a61bdc

Analysis

max time kernel
151s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
10/10/2022, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1cb50db0322692be5612fed491a58fc79e87a0434603db2f108ddd1153a61bdc.exe
Size 3.6MB
Sample221010-sdbxdscebj
SHA256 1cb50db0322692be5612fed491a58fc79e87a0434603db2f108ddd1153a61bdc
MD5 be1958914284592f775bc245b5bf0b3f
SHA1 c9fa74053e26ff5902e9ba459703820d0a03e540
SHA512 c0ec0373bf670f99968368d1cc582bb74c103f21c3b347102e08910e0b673a36bf1f1e8c24b2f3f6583ab8d2faa2803a7f62d14c510512c5aec245c4211058d6
SSDEEP 24576:XbLgddQhfdmMSirYbYagd/2D6O5RTHo12gv5kC:XnAQqMSPbYz+DW1Jv5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3325) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Executes dropped EXE 1 IoCs

pid	Process
4784	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	1cb50db0322692be5612fed491a58fc79e87a0434603db2f108ddd1153a61bdc.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	1cb50db0322692be5612fed491a58fc79e87a0434603db2f108ddd1153a61bdc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	1cb50db0322692be5612fed491a58fc79e87a0434603db2f108ddd1153a61bdc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	1cb50db0322692be5612fed491a58fc79e87a0434603db2f108ddd1153a61bdc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	1cb50db0322692be5612fed491a58fc79e87a0434603db2f108ddd1153a61bdc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	1cb50db0322692be5612fed491a58fc79e87a0434603db2f108ddd1153a61bdc.exe

C:\Users\Admin\AppData\Local\Temp\1cb50db0322692be5612fed491a58fc79e87a0434603db2f108ddd1153a61bdc.exe
"C:\Users\Admin\AppData\Local\Temp\1cb50db0322692be5612fed491a58fc79e87a0434603db2f108ddd1153a61bdc.exe"
1⤵
- Drops file in Windows directory
PID:2864
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:4784

C:\Users\Admin\AppData\Local\Temp\1cb50db0322692be5612fed491a58fc79e87a0434603db2f108ddd1153a61bdc.exe
C:\Users\Admin\AppData\Local\Temp\1cb50db0322692be5612fed491a58fc79e87a0434603db2f108ddd1153a61bdc.exe -m security
1⤵
- Modifies data under HKEY_USERS
PID:388

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 73c6cb0af26ca9226dae2f301a2adc691e99d672f1dbc809a9cdb2153866e994
MD5 a9564ee26ea4cb298740f3e32536f9e8
SHA1 9971e15ec99ba8da68602ce008bdaac9388d2af4
SHA512 a6c1603436db8a2bd4b66c66e05db544b6b0b94c3d8addae871d0bfb05f270f3dcff7651611202dcd9a2f99623ffe1bb486e0fdab18a289af3d84739cae8b176
SSDEEP 24576:nQhfdmMSirYbYagd/2D6O5RTHo12gv5kC:nQqMSPbYz+DW1Jv5
MD5 SHA1 SHA512 SSDEEP

Submit Download