wannacry | e58439a478f75ecb09bfcd633f738483e5e269129669288d8bde0f4cffbaa7ec

Analysis

max time kernel
76s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 15:53

Target
e58439a478f75ecb09bfcd633f738483e5e269129669288d8bde0f4cffbaa7ec.exe
Size 5.0MB
Sample221011-tbmrjsceb9
SHA256 e58439a478f75ecb09bfcd633f738483e5e269129669288d8bde0f4cffbaa7ec
MD5 b583e353ce412edcb4128c251901db5e
SHA1 482a398c3e8cd2e58f56a5830573b7022456c4d6
SHA512 57a1d8582495933d1914ef65bd907ec9fbb1680b212dca0197b5fd0c6aae094ddb350e4a918bfd2e5731ed18f1de7e7bbc4b7d47333c1d662bc80bd4d97a64de
SSDEEP 98304:yDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2:yDqPe1Cxcxk3ZAEUadzR8yc4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Executes dropped EXE 1 IoCs

pid	Process
1772	tasksche.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	e58439a478f75ecb09bfcd633f738483e5e269129669288d8bde0f4cffbaa7ec.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	e58439a478f75ecb09bfcd633f738483e5e269129669288d8bde0f4cffbaa7ec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	e58439a478f75ecb09bfcd633f738483e5e269129669288d8bde0f4cffbaa7ec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	e58439a478f75ecb09bfcd633f738483e5e269129669288d8bde0f4cffbaa7ec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	e58439a478f75ecb09bfcd633f738483e5e269129669288d8bde0f4cffbaa7ec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	e58439a478f75ecb09bfcd633f738483e5e269129669288d8bde0f4cffbaa7ec.exe

C:\Users\Admin\AppData\Local\Temp\e58439a478f75ecb09bfcd633f738483e5e269129669288d8bde0f4cffbaa7ec.exe
"C:\Users\Admin\AppData\Local\Temp\e58439a478f75ecb09bfcd633f738483e5e269129669288d8bde0f4cffbaa7ec.exe"
1⤵
- Drops file in Windows directory
PID:3460
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:1772

C:\Users\Admin\AppData\Local\Temp\e58439a478f75ecb09bfcd633f738483e5e269129669288d8bde0f4cffbaa7ec.exe
C:\Users\Admin\AppData\Local\Temp\e58439a478f75ecb09bfcd633f738483e5e269129669288d8bde0f4cffbaa7ec.exe -m security
1⤵
- Modifies data under HKEY_USERS
PID:3456

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 ccb1c3d7971200d05a6b9fe96fe3115dbc45bab51e430235ee52807f37d691ea
MD5 55ec4c240fc649319cca4fe874bada82
SHA1 6f8937b98317d8af75f1ffd7836d8fa53bfc371f
SHA512 a8197cf882f7150761ca8265402910d502ed0c2fb54797749d435bcc4d90f1d4df90353c2d3ac1c0d2fee2831bdd40081f0b735aeec1e90c3624d917d5a21cc0
SSDEEP 98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2:QqPe1Cxcxk3ZAEUadzR8yc4
MD5 SHA1 SHA512 SSDEEP

Submit Download