wannacry | 8768b31d4eaf26ef7aaa392bd0ccce890ba62b7ff08fa68fda7e6cd0eb80e41e

Analysis

max time kernel
91s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2022, 08:25

Target
8768b31d4eaf26ef7aaa392bd0ccce890ba62b7ff08fa68fda7e6cd0eb80e41e.exe
Size 6.4MB
Sample221013-kbabsabchr
SHA256 8768b31d4eaf26ef7aaa392bd0ccce890ba62b7ff08fa68fda7e6cd0eb80e41e
MD5 a54bd76e5f4e72c14a8919e0e0da50f6
SHA1 26c37e34c52e90c13fcc4cc00e53966ca253d65e
SHA512 8a481bed2ce386c2b55652474d9d1c98b5c1e18cc137099304e6a97fe2ae11ce90c3dcafda6058c42cda4851c7dcc1246101d8abb5a469e71393bd2b8ada0400
SSDEEP 49152:rnuQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM:7ZqPoBhz1aRxcSUDk36SAEdhvxW
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Executes dropped EXE 1 IoCs

pid	Process
2260	tasksche.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	8768b31d4eaf26ef7aaa392bd0ccce890ba62b7ff08fa68fda7e6cd0eb80e41e.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	8768b31d4eaf26ef7aaa392bd0ccce890ba62b7ff08fa68fda7e6cd0eb80e41e.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	8768b31d4eaf26ef7aaa392bd0ccce890ba62b7ff08fa68fda7e6cd0eb80e41e.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	8768b31d4eaf26ef7aaa392bd0ccce890ba62b7ff08fa68fda7e6cd0eb80e41e.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	8768b31d4eaf26ef7aaa392bd0ccce890ba62b7ff08fa68fda7e6cd0eb80e41e.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	8768b31d4eaf26ef7aaa392bd0ccce890ba62b7ff08fa68fda7e6cd0eb80e41e.exe

C:\Users\Admin\AppData\Local\Temp\8768b31d4eaf26ef7aaa392bd0ccce890ba62b7ff08fa68fda7e6cd0eb80e41e.exe
"C:\Users\Admin\AppData\Local\Temp\8768b31d4eaf26ef7aaa392bd0ccce890ba62b7ff08fa68fda7e6cd0eb80e41e.exe"
1⤵
- Drops file in Windows directory
PID:1968
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:2260

C:\Users\Admin\AppData\Local\Temp\8768b31d4eaf26ef7aaa392bd0ccce890ba62b7ff08fa68fda7e6cd0eb80e41e.exe
C:\Users\Admin\AppData\Local\Temp\8768b31d4eaf26ef7aaa392bd0ccce890ba62b7ff08fa68fda7e6cd0eb80e41e.exe -m security
1⤵
- Modifies data under HKEY_USERS
PID:2976

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 17a55a87b9504eb0bd586d019c47aeca8991c1c3040cadb53bb47d9b77c7f726
MD5 8e7a7637f4d80eb3d6a4984f682745a0
SHA1 6b63b72196782c8b295c426d4e0d4455c33383ad
SHA512 90a9d0bc148f92632b6a855856b547c25583ab5794304c99efcad02d6d0f0b88cb31f4deab3912803fb5d074a531a5f8afdde3d5ce5fce5d076deab608e1fca1
SSDEEP 49152:nQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM:QqPoBhz1aRxcSUDk36SAEdhvxW
MD5 SHA1 SHA512 SSDEEP

Submit Download