wannacry | 9678763f65e207dde99f4f8723ddfc44bc2d3f9b490aa3d3d4676c661474d59f

Analysis

max time kernel
104s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2022, 04:21

Target
9678763f65e207dde99f4f8723ddfc44bc2d3f9b490aa3d3d4676c661474d59f.exe
Size 6.4MB
Sample221012-ey3nyscdc5
SHA256 9678763f65e207dde99f4f8723ddfc44bc2d3f9b490aa3d3d4676c661474d59f
MD5 1d38638153085a0a0f0a4f7174e52a9b
SHA1 f0bb8179052451ac327e6fff048bc27c73bf7310
SHA512 ff7c5b94ffff6e6d877e18b3fb543235d3bcb3e27b5d27a5fdc60005b4095a1ba21a4365a7a41bf6ed1e42fe547d6ddf0d05ed78442cd7ec42668b80a0a0d8f6
SSDEEP 98304:5iqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2HI:5iqPe1Cxcxk3ZAEUadzR8yc4HI
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Executes dropped EXE 1 IoCs

pid	Process
4880	tasksche.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	9678763f65e207dde99f4f8723ddfc44bc2d3f9b490aa3d3d4676c661474d59f.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	9678763f65e207dde99f4f8723ddfc44bc2d3f9b490aa3d3d4676c661474d59f.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	9678763f65e207dde99f4f8723ddfc44bc2d3f9b490aa3d3d4676c661474d59f.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	9678763f65e207dde99f4f8723ddfc44bc2d3f9b490aa3d3d4676c661474d59f.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	9678763f65e207dde99f4f8723ddfc44bc2d3f9b490aa3d3d4676c661474d59f.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	9678763f65e207dde99f4f8723ddfc44bc2d3f9b490aa3d3d4676c661474d59f.exe

C:\Users\Admin\AppData\Local\Temp\9678763f65e207dde99f4f8723ddfc44bc2d3f9b490aa3d3d4676c661474d59f.exe
"C:\Users\Admin\AppData\Local\Temp\9678763f65e207dde99f4f8723ddfc44bc2d3f9b490aa3d3d4676c661474d59f.exe"
1⤵
- Drops file in Windows directory
PID:4904
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:4880

C:\Users\Admin\AppData\Local\Temp\9678763f65e207dde99f4f8723ddfc44bc2d3f9b490aa3d3d4676c661474d59f.exe
C:\Users\Admin\AppData\Local\Temp\9678763f65e207dde99f4f8723ddfc44bc2d3f9b490aa3d3d4676c661474d59f.exe -m security
1⤵
- Modifies data under HKEY_USERS
PID:3620

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3868

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 2584e1521065e45ec3c17767c065429038fc6291c091097ea8b22c8a502c41dd
MD5 7f7ccaa16fb15eb1c7399d422f8363e8
SHA1 bd44d0ab543bf814d93b719c24e90d8dd7111234
SHA512 83e334b80de08903cfa9891a3fa349c1ece7e19f8e62b74a017512fa9a7989a0fd31929bf1fc13847bee04f2da3dacf6bc3f5ee58f0e4b9d495f4b9af12ed2b7
SSDEEP 98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2Hj:QqPe1Cxcxk3ZAEUadzR8yc4Hj
MD5 SHA1 SHA512 SSDEEP

Submit Download