wannacry | eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7

General

Target

eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe
Size

5.0MB
MD5

52b9761a0fb6f9bf4d62d60e512d63cc
SHA1

08d125e7c0d547654de44956bdb9d006348069e8
SHA256

eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7
SHA512

735aedf16fc681a01300543c8a5c13cb8cedbbdb7af85cf79d9dcaf2c559105fb8cf7454807fc3e6fa3ac54481532ab8c76667e6c383603db5da7659a5e589c9
SSDEEP

49152:3nwMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvw:3wPoBhz1aRxcSUDk36SAEdhvw

Score

10^/10

wannacry ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Drops file in Windows directory 1 IoCs

Processes:

eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe

description ioc process

File created C:\WINDOWS\tasksche.exe eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe

description	ioc	process
File created	C:\WINDOWS\tasksche.exe	eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe

Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
3684	4664	WerFault.exe	eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe
2452	3104	WerFault.exe	eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe
3724	3316	WerFault.exe	eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe

Modifies data under HKEY_USERS 24 IoCs

Processes:

eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exeeafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exeeafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P	eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History	eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History	eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History	eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe

C:\Users\Admin\AppData\Local\Temp\eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe
"C:\Users\Admin\AppData\Local\Temp\eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe"
1⤵
- Drops file in Windows directory
PID:4140

C:\Users\Admin\AppData\Local\Temp\eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe
C:\Users\Admin\AppData\Local\Temp\eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe -m security
1⤵
- Modifies data under HKEY_USERS
PID:4664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4664 -s 1088
2⤵
- Program crash
PID:3684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4664 -ip 4664
1⤵
PID:4428

C:\Users\Admin\AppData\Local\Temp\eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe
C:\Users\Admin\AppData\Local\Temp\eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe -m security
1⤵
- Modifies data under HKEY_USERS
PID:3104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3104 -s 1088
2⤵
- Program crash
PID:2452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3104 -ip 3104
1⤵
PID:4420

C:\Users\Admin\AppData\Local\Temp\eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe
C:\Users\Admin\AppData\Local\Temp\eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7.exe -m security
1⤵
- Modifies data under HKEY_USERS
PID:3316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3316 -s 1104
2⤵
- Program crash
PID:3724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3316 -ip 3316
1⤵
PID:3736

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads