wannacry | 38de3753e722f27b4293ec6bb7b8543687c1e36b0066919d3f537bbd4409f4b7

Analysis

max time kernel
160s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2022 14:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

38de3753e722f27b4293ec6bb7b8543687c1e36b0066919d3f537bbd4409f4b7.exe
Size

3.6MB
MD5

86c032a003fd34beaffa2573a0e58d0c
SHA1

7e179f298b360b429d9755ca37e50743676a497c
SHA256

38de3753e722f27b4293ec6bb7b8543687c1e36b0066919d3f537bbd4409f4b7
SHA512

cb612ea0cd9b3c44380362bac0bfaf0a42931b3ea40578ba94b3424749dd7bb508e3068478370abcbd40726c28e5225c896d7747b5bc850dba63436703feeb2e
SSDEEP

49152:XnHqMSPbcBVQej/hINRx+TSqTdX1HkQo6SAARdhnv:XHqPoBhzhaRxcSUDk36SAEdhv

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3190) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Drops file in Windows directory 1 IoCs

Processes:

38de3753e722f27b4293ec6bb7b8543687c1e36b0066919d3f537bbd4409f4b7.exe

description ioc process

File created C:\WINDOWS\tasksche.exe 38de3753e722f27b4293ec6bb7b8543687c1e36b0066919d3f537bbd4409f4b7.exe

description	ioc	process
File created	C:\WINDOWS\tasksche.exe	38de3753e722f27b4293ec6bb7b8543687c1e36b0066919d3f537bbd4409f4b7.exe

Modifies data under HKEY_USERS 12 IoCs

Processes:

38de3753e722f27b4293ec6bb7b8543687c1e36b0066919d3f537bbd4409f4b7.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	38de3753e722f27b4293ec6bb7b8543687c1e36b0066919d3f537bbd4409f4b7.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	38de3753e722f27b4293ec6bb7b8543687c1e36b0066919d3f537bbd4409f4b7.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	38de3753e722f27b4293ec6bb7b8543687c1e36b0066919d3f537bbd4409f4b7.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	38de3753e722f27b4293ec6bb7b8543687c1e36b0066919d3f537bbd4409f4b7.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	38de3753e722f27b4293ec6bb7b8543687c1e36b0066919d3f537bbd4409f4b7.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P	38de3753e722f27b4293ec6bb7b8543687c1e36b0066919d3f537bbd4409f4b7.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	38de3753e722f27b4293ec6bb7b8543687c1e36b0066919d3f537bbd4409f4b7.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	38de3753e722f27b4293ec6bb7b8543687c1e36b0066919d3f537bbd4409f4b7.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	38de3753e722f27b4293ec6bb7b8543687c1e36b0066919d3f537bbd4409f4b7.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History	38de3753e722f27b4293ec6bb7b8543687c1e36b0066919d3f537bbd4409f4b7.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	38de3753e722f27b4293ec6bb7b8543687c1e36b0066919d3f537bbd4409f4b7.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	38de3753e722f27b4293ec6bb7b8543687c1e36b0066919d3f537bbd4409f4b7.exe

C:\Users\Admin\AppData\Local\Temp\38de3753e722f27b4293ec6bb7b8543687c1e36b0066919d3f537bbd4409f4b7.exe
"C:\Users\Admin\AppData\Local\Temp\38de3753e722f27b4293ec6bb7b8543687c1e36b0066919d3f537bbd4409f4b7.exe"
1⤵
- Drops file in Windows directory
PID:4856

C:\Users\Admin\AppData\Local\Temp\38de3753e722f27b4293ec6bb7b8543687c1e36b0066919d3f537bbd4409f4b7.exe
C:\Users\Admin\AppData\Local\Temp\38de3753e722f27b4293ec6bb7b8543687c1e36b0066919d3f537bbd4409f4b7.exe -m security
1⤵
- Modifies data under HKEY_USERS
PID:3428

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads