wannacry | 9b4a17bb43644b40651948c85c766625fc850789690a94a582f72594c44766d3

Analysis

max time kernel
191s
max time network
197s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2022 03:57

Target

9b4a17bb43644b40651948c85c766625fc850789690a94a582f72594c44766d3.exe
Size

5.0MB
MD5

2fca5b13e15f025de261853c65969e2e
SHA1

ba989508bb7621478aa835eb6222ab5cebf5419f
SHA256

9b4a17bb43644b40651948c85c766625fc850789690a94a582f72594c44766d3
SHA512

62a0cf391a8b76deb64572c51dc894ae9fbb67c88a19aa55f8bdef973c86dcba4fa626659f6b3597b17169ea1ac5dc227490c0f8ae5a5005b4d3fcb7a750f019
SSDEEP

6144:GE9l9yUqIYVTH5DgSg8ajldktM0XXrP2QhMV9qbB:GvbLgPlu+QhMb

Score

10^/10

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3187) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Executes dropped EXE 1 IoCs

Processes:

tasksche.exe

pid process

3584 tasksche.exe
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Drops file in Windows directory 1 IoCs

Processes:

9b4a17bb43644b40651948c85c766625fc850789690a94a582f72594c44766d3.exe

description ioc process

File created C:\WINDOWS\tasksche.exe 9b4a17bb43644b40651948c85c766625fc850789690a94a582f72594c44766d3.exe

pid	process
3584	tasksche.exe

description	ioc	process
File created	C:\WINDOWS\tasksche.exe	9b4a17bb43644b40651948c85c766625fc850789690a94a582f72594c44766d3.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

9b4a17bb43644b40651948c85c766625fc850789690a94a582f72594c44766d3.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	9b4a17bb43644b40651948c85c766625fc850789690a94a582f72594c44766d3.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	9b4a17bb43644b40651948c85c766625fc850789690a94a582f72594c44766d3.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	9b4a17bb43644b40651948c85c766625fc850789690a94a582f72594c44766d3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	9b4a17bb43644b40651948c85c766625fc850789690a94a582f72594c44766d3.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	9b4a17bb43644b40651948c85c766625fc850789690a94a582f72594c44766d3.exe

C:\Users\Admin\AppData\Local\Temp\9b4a17bb43644b40651948c85c766625fc850789690a94a582f72594c44766d3.exe
"C:\Users\Admin\AppData\Local\Temp\9b4a17bb43644b40651948c85c766625fc850789690a94a582f72594c44766d3.exe"
1⤵
- Drops file in Windows directory
PID:5044

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
2⤵
- Executes dropped EXE
PID:3584

C:\Users\Admin\AppData\Local\Temp\9b4a17bb43644b40651948c85c766625fc850789690a94a582f72594c44766d3.exe
C:\Users\Admin\AppData\Local\Temp\9b4a17bb43644b40651948c85c766625fc850789690a94a582f72594c44766d3.exe -m security
1⤵
- Modifies data under HKEY_USERS
PID:4928

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

C:\Windows\tasksche.exe
Filesize
3.4MB

MD5
74ef2414a12a4160bfc7632b01e073e5

SHA1
f9618fc409a0af309fe50dfa93d702a9357e42ef

SHA256
630d75fd88047e413c8cea30edbaf3a3b987a9cfebf298d4d0b01b1f11275fb5

SHA512
fc0f38abb326bec3b91de71a946540f9e8ff269d40f3379089af5e8f711d5320136c7f355e82a975a414f64e86e193e5acbaa0b31412cb46d8b5f7fd68b8249a

Download Submit