wannacry | 9b4a17bb43644b40651948c85c766625fc850789690a94a582f72594c44766d3

Analysis

max time kernel
191s
max time network
197s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 03:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9b4a17bb43644b40651948c85c766625fc850789690a94a582f72594c44766d3.exe
Size 5.0MB
Sample221011-eh2fysdfgp
SHA256 9b4a17bb43644b40651948c85c766625fc850789690a94a582f72594c44766d3
MD5 2fca5b13e15f025de261853c65969e2e
SHA1 ba989508bb7621478aa835eb6222ab5cebf5419f
SHA512 62a0cf391a8b76deb64572c51dc894ae9fbb67c88a19aa55f8bdef973c86dcba4fa626659f6b3597b17169ea1ac5dc227490c0f8ae5a5005b4d3fcb7a750f019
SSDEEP 6144:GE9l9yUqIYVTH5DgSg8ajldktM0XXrP2QhMV9qbB:GvbLgPlu+QhMb
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3187) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Executes dropped EXE 1 IoCs

pid	Process
3584	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	9b4a17bb43644b40651948c85c766625fc850789690a94a582f72594c44766d3.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	9b4a17bb43644b40651948c85c766625fc850789690a94a582f72594c44766d3.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	9b4a17bb43644b40651948c85c766625fc850789690a94a582f72594c44766d3.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	9b4a17bb43644b40651948c85c766625fc850789690a94a582f72594c44766d3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	9b4a17bb43644b40651948c85c766625fc850789690a94a582f72594c44766d3.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	9b4a17bb43644b40651948c85c766625fc850789690a94a582f72594c44766d3.exe

C:\Users\Admin\AppData\Local\Temp\9b4a17bb43644b40651948c85c766625fc850789690a94a582f72594c44766d3.exe
"C:\Users\Admin\AppData\Local\Temp\9b4a17bb43644b40651948c85c766625fc850789690a94a582f72594c44766d3.exe"
1⤵
- Drops file in Windows directory
PID:5044
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:3584

C:\Users\Admin\AppData\Local\Temp\9b4a17bb43644b40651948c85c766625fc850789690a94a582f72594c44766d3.exe
C:\Users\Admin\AppData\Local\Temp\9b4a17bb43644b40651948c85c766625fc850789690a94a582f72594c44766d3.exe -m security
1⤵
- Modifies data under HKEY_USERS
PID:4928

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 630d75fd88047e413c8cea30edbaf3a3b987a9cfebf298d4d0b01b1f11275fb5
MD5 74ef2414a12a4160bfc7632b01e073e5
SHA1 f9618fc409a0af309fe50dfa93d702a9357e42ef
SHA512 fc0f38abb326bec3b91de71a946540f9e8ff269d40f3379089af5e8f711d5320136c7f355e82a975a414f64e86e193e5acbaa0b31412cb46d8b5f7fd68b8249a
SSDEEP 1536:Bo1Jfsh3MKNQugai++N9S4A3v9q/j9GwJ12f:BozecK+7hMV9qbUw
MD5 SHA1 SHA512 SSDEEP

Submit Download