wannacry | e097ebca7eac1ea885504f038ad768a1fa440557ae45d3f23b8e92673b9688bb

General

Target

e097ebca7eac1ea885504f038ad768a1fa440557ae45d3f23b8e92673b9688bb.exe
Size

3.6MB
MD5

cb5e2cdf03ff2c2603bd01d661a993fe
SHA1

0b82f726736b02320c94a9f662f5333b73223b3c
SHA256

e097ebca7eac1ea885504f038ad768a1fa440557ae45d3f23b8e92673b9688bb
SHA512

1d9c16db5c8c01f5c17b57db9291ba5e0176ff3a1f2b02223f5be481a435e21f88b86fcba8adb3e1fa7efe023f7ac5979af0cf3a3692888ad488c1b3e357d7e6
SSDEEP

98304:yDqPoBhz1aRxcSUDk36SAEdhvX593R8yAVp2HI:yDqPe1Cxcxk3ZAErzR8yc4HI

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (954) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Executes dropped EXE 1 IoCs

Processes:

tasksche.exe

pid process

1756 tasksche.exe

pid	process
1756	tasksche.exe

Drops file in System32 directory 1 IoCs

Processes:

e097ebca7eac1ea885504f038ad768a1fa440557ae45d3f23b8e92673b9688bb.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	e097ebca7eac1ea885504f038ad768a1fa440557ae45d3f23b8e92673b9688bb.exe

Drops file in Windows directory 1 IoCs

Processes:

e097ebca7eac1ea885504f038ad768a1fa440557ae45d3f23b8e92673b9688bb.exe

description ioc process

File created C:\WINDOWS\tasksche.exe e097ebca7eac1ea885504f038ad768a1fa440557ae45d3f23b8e92673b9688bb.exe

description	ioc	process
File created	C:\WINDOWS\tasksche.exe	e097ebca7eac1ea885504f038ad768a1fa440557ae45d3f23b8e92673b9688bb.exe

Modifies data under HKEY_USERS 24 IoCs

Processes:

e097ebca7eac1ea885504f038ad768a1fa440557ae45d3f23b8e92673b9688bb.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	e097ebca7eac1ea885504f038ad768a1fa440557ae45d3f23b8e92673b9688bb.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	e097ebca7eac1ea885504f038ad768a1fa440557ae45d3f23b8e92673b9688bb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	e097ebca7eac1ea885504f038ad768a1fa440557ae45d3f23b8e92673b9688bb.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f008c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	e097ebca7eac1ea885504f038ad768a1fa440557ae45d3f23b8e92673b9688bb.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B74E3F78-3F41-4059-ABFF-286826253297}	e097ebca7eac1ea885504f038ad768a1fa440557ae45d3f23b8e92673b9688bb.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7a-9f-50-f6-be-fe	e097ebca7eac1ea885504f038ad768a1fa440557ae45d3f23b8e92673b9688bb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7a-9f-50-f6-be-fe\WpadDecision = "0"	e097ebca7eac1ea885504f038ad768a1fa440557ae45d3f23b8e92673b9688bb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	e097ebca7eac1ea885504f038ad768a1fa440557ae45d3f23b8e92673b9688bb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	e097ebca7eac1ea885504f038ad768a1fa440557ae45d3f23b8e92673b9688bb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B74E3F78-3F41-4059-ABFF-286826253297}\WpadDecisionReason = "1"	e097ebca7eac1ea885504f038ad768a1fa440557ae45d3f23b8e92673b9688bb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B74E3F78-3F41-4059-ABFF-286826253297}\WpadDecision = "0"	e097ebca7eac1ea885504f038ad768a1fa440557ae45d3f23b8e92673b9688bb.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B74E3F78-3F41-4059-ABFF-286826253297}\WpadDecisionTime = 70fdda8736ddd801	e097ebca7eac1ea885504f038ad768a1fa440557ae45d3f23b8e92673b9688bb.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	e097ebca7eac1ea885504f038ad768a1fa440557ae45d3f23b8e92673b9688bb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	e097ebca7eac1ea885504f038ad768a1fa440557ae45d3f23b8e92673b9688bb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	e097ebca7eac1ea885504f038ad768a1fa440557ae45d3f23b8e92673b9688bb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	e097ebca7eac1ea885504f038ad768a1fa440557ae45d3f23b8e92673b9688bb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	e097ebca7eac1ea885504f038ad768a1fa440557ae45d3f23b8e92673b9688bb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	e097ebca7eac1ea885504f038ad768a1fa440557ae45d3f23b8e92673b9688bb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	e097ebca7eac1ea885504f038ad768a1fa440557ae45d3f23b8e92673b9688bb.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	e097ebca7eac1ea885504f038ad768a1fa440557ae45d3f23b8e92673b9688bb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B74E3F78-3F41-4059-ABFF-286826253297}\WpadNetworkName = "Network 3"	e097ebca7eac1ea885504f038ad768a1fa440557ae45d3f23b8e92673b9688bb.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B74E3F78-3F41-4059-ABFF-286826253297}\7a-9f-50-f6-be-fe	e097ebca7eac1ea885504f038ad768a1fa440557ae45d3f23b8e92673b9688bb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7a-9f-50-f6-be-fe\WpadDecisionReason = "1"	e097ebca7eac1ea885504f038ad768a1fa440557ae45d3f23b8e92673b9688bb.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7a-9f-50-f6-be-fe\WpadDecisionTime = 70fdda8736ddd801	e097ebca7eac1ea885504f038ad768a1fa440557ae45d3f23b8e92673b9688bb.exe

C:\Users\Admin\AppData\Local\Temp\e097ebca7eac1ea885504f038ad768a1fa440557ae45d3f23b8e92673b9688bb.exe
"C:\Users\Admin\AppData\Local\Temp\e097ebca7eac1ea885504f038ad768a1fa440557ae45d3f23b8e92673b9688bb.exe"
1⤵
- Drops file in Windows directory
PID:364

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
2⤵
- Executes dropped EXE
PID:1756

C:\Users\Admin\AppData\Local\Temp\e097ebca7eac1ea885504f038ad768a1fa440557ae45d3f23b8e92673b9688bb.exe
C:\Users\Admin\AppData\Local\Temp\e097ebca7eac1ea885504f038ad768a1fa440557ae45d3f23b8e92673b9688bb.exe -m security
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1132

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

1

T1046

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe
Filesize
3.4MB

MD5
cc5d020e8b62e7270fe9a144634215b3

SHA1
c7a7317df6c7a5656d0935f88c7da319ca59103c

SHA256
3dd24cb0c8eda1e40a44ac92de5e1fed2977774a75462c2bbb1f89590f45e7c2

SHA512
ef228ac84cbea7509af94450059ea67102d3a6ba13ed96ed6b9a900f4738044f5ea888893283e0f4550661762442f7ae0a63e2f81b666771eeed1f45ac8760f2

Download Submit
memory/364-54-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing