wannacry | 8131785432fc57c25d29b6c9e04a7f2f0379c123ad89ce1e6d50af7e5cd3e394

General

Target
8131785432fc57c25d29b6c9e04a7f2f0379c123ad89ce1e6d50af7e5cd3e394.exe
Size 5.0MB
Sample221012-d9b5pscce8
SHA256 8131785432fc57c25d29b6c9e04a7f2f0379c123ad89ce1e6d50af7e5cd3e394
MD5 8a6b804142e22265de773a3abf0bd047
SHA1 10ff8adbc4d1a8302e31cee6913c8f14d0a78387
SHA512 6561f9dbc736bdafb992bf24d28d2bce8d103468e75db3eaeb8df255e5cf763378c79d20938a573b2b0c65bfb59c342d04149267bbc06381cb3a1d0ae6a909af
SSDEEP 12288:M1bLgmluCti62lIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+DHeQYSUjEXFh:qbLguripdmMSirYbcMNgef0QeQjG
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (943) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	8131785432fc57c25d29b6c9e04a7f2f0379c123ad89ce1e6d50af7e5cd3e394.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\UTOBIEPI.txt	8131785432fc57c25d29b6c9e04a7f2f0379c123ad89ce1e6d50af7e5cd3e394.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\UTOBIEPI.txt	8131785432fc57c25d29b6c9e04a7f2f0379c123ad89ce1e6d50af7e5cd3e394.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	8131785432fc57c25d29b6c9e04a7f2f0379c123ad89ce1e6d50af7e5cd3e394.exe

Modifies data under HKEY_USERS 24 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	8131785432fc57c25d29b6c9e04a7f2f0379c123ad89ce1e6d50af7e5cd3e394.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	8131785432fc57c25d29b6c9e04a7f2f0379c123ad89ce1e6d50af7e5cd3e394.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	8131785432fc57c25d29b6c9e04a7f2f0379c123ad89ce1e6d50af7e5cd3e394.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{88F09546-BC80-4A32-B63B-56012F0F12A2}\WpadDecisionTime = 100ddabdecddd801	8131785432fc57c25d29b6c9e04a7f2f0379c123ad89ce1e6d50af7e5cd3e394.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{88F09546-BC80-4A32-B63B-56012F0F12A2}\WpadNetworkName = "Network 2"	8131785432fc57c25d29b6c9e04a7f2f0379c123ad89ce1e6d50af7e5cd3e394.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	8131785432fc57c25d29b6c9e04a7f2f0379c123ad89ce1e6d50af7e5cd3e394.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	8131785432fc57c25d29b6c9e04a7f2f0379c123ad89ce1e6d50af7e5cd3e394.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	8131785432fc57c25d29b6c9e04a7f2f0379c123ad89ce1e6d50af7e5cd3e394.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\f2-d6-ca-b5-d7-a5\WpadDecisionReason = "1"	8131785432fc57c25d29b6c9e04a7f2f0379c123ad89ce1e6d50af7e5cd3e394.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{88F09546-BC80-4A32-B63B-56012F0F12A2}\WpadDecisionReason = "1"	8131785432fc57c25d29b6c9e04a7f2f0379c123ad89ce1e6d50af7e5cd3e394.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\f2-d6-ca-b5-d7-a5	8131785432fc57c25d29b6c9e04a7f2f0379c123ad89ce1e6d50af7e5cd3e394.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\f2-d6-ca-b5-d7-a5\WpadDecision = "0"	8131785432fc57c25d29b6c9e04a7f2f0379c123ad89ce1e6d50af7e5cd3e394.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	8131785432fc57c25d29b6c9e04a7f2f0379c123ad89ce1e6d50af7e5cd3e394.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	8131785432fc57c25d29b6c9e04a7f2f0379c123ad89ce1e6d50af7e5cd3e394.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	8131785432fc57c25d29b6c9e04a7f2f0379c123ad89ce1e6d50af7e5cd3e394.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{88F09546-BC80-4A32-B63B-56012F0F12A2}	8131785432fc57c25d29b6c9e04a7f2f0379c123ad89ce1e6d50af7e5cd3e394.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{88F09546-BC80-4A32-B63B-56012F0F12A2}\WpadDecision = "0"	8131785432fc57c25d29b6c9e04a7f2f0379c123ad89ce1e6d50af7e5cd3e394.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\f2-d6-ca-b5-d7-a5\WpadDecisionTime = 100ddabdecddd801	8131785432fc57c25d29b6c9e04a7f2f0379c123ad89ce1e6d50af7e5cd3e394.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	8131785432fc57c25d29b6c9e04a7f2f0379c123ad89ce1e6d50af7e5cd3e394.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	8131785432fc57c25d29b6c9e04a7f2f0379c123ad89ce1e6d50af7e5cd3e394.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	8131785432fc57c25d29b6c9e04a7f2f0379c123ad89ce1e6d50af7e5cd3e394.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	8131785432fc57c25d29b6c9e04a7f2f0379c123ad89ce1e6d50af7e5cd3e394.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0005000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	8131785432fc57c25d29b6c9e04a7f2f0379c123ad89ce1e6d50af7e5cd3e394.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{88F09546-BC80-4A32-B63B-56012F0F12A2}\f2-d6-ca-b5-d7-a5	8131785432fc57c25d29b6c9e04a7f2f0379c123ad89ce1e6d50af7e5cd3e394.exe

C:\Users\Admin\AppData\Local\Temp\8131785432fc57c25d29b6c9e04a7f2f0379c123ad89ce1e6d50af7e5cd3e394.exe
"C:\Users\Admin\AppData\Local\Temp\8131785432fc57c25d29b6c9e04a7f2f0379c123ad89ce1e6d50af7e5cd3e394.exe"
1⤵
- Drops file in Windows directory
PID:956

C:\Users\Admin\AppData\Local\Temp\8131785432fc57c25d29b6c9e04a7f2f0379c123ad89ce1e6d50af7e5cd3e394.exe
C:\Users\Admin\AppData\Local\Temp\8131785432fc57c25d29b6c9e04a7f2f0379c123ad89ce1e6d50af7e5cd3e394.exe -m security
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:940

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

1

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/940-57-0x0000000000400000-0x0000000000A72000-memory.dmp

Download

memory/956-54-0x0000000000400000-0x0000000000A72000-memory.dmp

Download

memory/956-55-0x00000000757A1000-0x00000000757A3000-memory.dmp

Download

memory/956-58-0x0000000000400000-0x0000000000A72000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads