wannacry | 0356be7cf465e56da370730e2d8707dab9dfb5c446f0eeb9605d2a05d8bca3ba

Analysis

max time kernel
155s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0356be7cf465e56da370730e2d8707dab9dfb5c446f0eeb9605d2a05d8bca3ba.exe
Size 2.2MB
Sample221011-pphbrsecbr
SHA256 0356be7cf465e56da370730e2d8707dab9dfb5c446f0eeb9605d2a05d8bca3ba
MD5 5c6b98475b9c14da9f64c0c3f7bd88f8
SHA1 917b925bd03cb35994d9ff0db50e81748d27b420
SHA512 614116c7ef0e00d9b307c034f7ec8f3607037248891096e88472b535f7ce6dd85bbcd7e92463c1cc22c4d24dccc480d9fce9d52f438c6a4ae56e6e10b65a633e
SSDEEP 49152:+n9MSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvn:q9PoBhz1aRxcSUDk36SAEdhvn
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (2148) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	0356be7cf465e56da370730e2d8707dab9dfb5c446f0eeb9605d2a05d8bca3ba.exe

Modifies data under HKEY_USERS 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History	0356be7cf465e56da370730e2d8707dab9dfb5c446f0eeb9605d2a05d8bca3ba.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	0356be7cf465e56da370730e2d8707dab9dfb5c446f0eeb9605d2a05d8bca3ba.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P	0356be7cf465e56da370730e2d8707dab9dfb5c446f0eeb9605d2a05d8bca3ba.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	0356be7cf465e56da370730e2d8707dab9dfb5c446f0eeb9605d2a05d8bca3ba.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	0356be7cf465e56da370730e2d8707dab9dfb5c446f0eeb9605d2a05d8bca3ba.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	0356be7cf465e56da370730e2d8707dab9dfb5c446f0eeb9605d2a05d8bca3ba.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	0356be7cf465e56da370730e2d8707dab9dfb5c446f0eeb9605d2a05d8bca3ba.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	0356be7cf465e56da370730e2d8707dab9dfb5c446f0eeb9605d2a05d8bca3ba.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	0356be7cf465e56da370730e2d8707dab9dfb5c446f0eeb9605d2a05d8bca3ba.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	0356be7cf465e56da370730e2d8707dab9dfb5c446f0eeb9605d2a05d8bca3ba.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	0356be7cf465e56da370730e2d8707dab9dfb5c446f0eeb9605d2a05d8bca3ba.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	0356be7cf465e56da370730e2d8707dab9dfb5c446f0eeb9605d2a05d8bca3ba.exe

C:\Users\Admin\AppData\Local\Temp\0356be7cf465e56da370730e2d8707dab9dfb5c446f0eeb9605d2a05d8bca3ba.exe
"C:\Users\Admin\AppData\Local\Temp\0356be7cf465e56da370730e2d8707dab9dfb5c446f0eeb9605d2a05d8bca3ba.exe"
1⤵
- Drops file in Windows directory
PID:2008

C:\Users\Admin\AppData\Local\Temp\0356be7cf465e56da370730e2d8707dab9dfb5c446f0eeb9605d2a05d8bca3ba.exe
C:\Users\Admin\AppData\Local\Temp\0356be7cf465e56da370730e2d8707dab9dfb5c446f0eeb9605d2a05d8bca3ba.exe -m security
1⤵
- Modifies data under HKEY_USERS
PID:4824

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads