wannacry | e3091bc1b0af2c94c4873fb4204fcd39234952edd4cb1e82f1053e66663e3a4e

Analysis

max time kernel
183s
max time network
217s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2022, 04:22

Target
e3091bc1b0af2c94c4873fb4204fcd39234952edd4cb1e82f1053e66663e3a4e.exe
Size 6.4MB
Sample221012-ey8j7scdc6
SHA256 e3091bc1b0af2c94c4873fb4204fcd39234952edd4cb1e82f1053e66663e3a4e
MD5 2eda905ddece5a601ce82ad106707697
SHA1 73f8b1f266cc7bd575261290a9b01537d11d41b3
SHA512 f43918bc515448a3ee972c7e7a723b463e5421f5b79b6f5020f4e347f552b05dbaef3d8a4db53441a5643d54a9355873341fea883ac0257474ca94f230c77f15
SSDEEP 49152:QnkQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAA:QHqPoBhz1aRxcSUDk36SA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Executes dropped EXE 1 IoCs

pid	Process
1736	tasksche.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	e3091bc1b0af2c94c4873fb4204fcd39234952edd4cb1e82f1053e66663e3a4e.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	e3091bc1b0af2c94c4873fb4204fcd39234952edd4cb1e82f1053e66663e3a4e.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	e3091bc1b0af2c94c4873fb4204fcd39234952edd4cb1e82f1053e66663e3a4e.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	e3091bc1b0af2c94c4873fb4204fcd39234952edd4cb1e82f1053e66663e3a4e.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	e3091bc1b0af2c94c4873fb4204fcd39234952edd4cb1e82f1053e66663e3a4e.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	e3091bc1b0af2c94c4873fb4204fcd39234952edd4cb1e82f1053e66663e3a4e.exe

C:\Users\Admin\AppData\Local\Temp\e3091bc1b0af2c94c4873fb4204fcd39234952edd4cb1e82f1053e66663e3a4e.exe
"C:\Users\Admin\AppData\Local\Temp\e3091bc1b0af2c94c4873fb4204fcd39234952edd4cb1e82f1053e66663e3a4e.exe"
1⤵
- Drops file in Windows directory
PID:932
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:1736

C:\Users\Admin\AppData\Local\Temp\e3091bc1b0af2c94c4873fb4204fcd39234952edd4cb1e82f1053e66663e3a4e.exe
C:\Users\Admin\AppData\Local\Temp\e3091bc1b0af2c94c4873fb4204fcd39234952edd4cb1e82f1053e66663e3a4e.exe -m security
1⤵
- Modifies data under HKEY_USERS
PID:388

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 60e2e5ea3fb4c34e69571aa68c80ace8a365721954320765bae955744fe9e2d7
MD5 dda19d185d24135d056385eddde66112
SHA1 5df4808a0486b77967524922649e418453eb28dc
SHA512 ce0202f8f074d4b024e8963f5766ad60be509ac4ea2cb17697b620e551b1375d942554537a272a5c91687e3a19a3e6d8d94e483a61e9e7446b86d04214cd7ec2
SSDEEP 49152:nQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAA:QqPoBhz1aRxcSUDk36SA
MD5 SHA1 SHA512 SSDEEP

Submit Download