wannacry | 077bbb0a91bcd1236aa85c5d6fcbd42f711bf8f2a305f9ae64cb30d242c8fb8a

Analysis

max time kernel
156s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2022, 16:00

Target

077bbb0a91bcd1236aa85c5d6fcbd42f711bf8f2a305f9ae64cb30d242c8fb8a.exe
Size

2.2MB
MD5

f180d23ede98f53a8dffd109ed624e85
SHA1

7755fe529f6c4ff88d3955269c9a1d49235f5a56
SHA256

077bbb0a91bcd1236aa85c5d6fcbd42f711bf8f2a305f9ae64cb30d242c8fb8a
SHA512

8f4df958e1122e5f344e8d82342f83cf3cdd65084d2fbc4209823527440a8d0e65167fb57b891e92fb1d1824160b6d0953b44533f49f1f111426bce595679859
SSDEEP

24576:QbLgdriBSmMSirYbcMNgef0QeQjG/D8kIqRYEz6626M+vbOSSqTPVXmiH:QnPMSPbcBVQej/16x+TSqTdX1H

Score

10^/10

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (2336) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	077bbb0a91bcd1236aa85c5d6fcbd42f711bf8f2a305f9ae64cb30d242c8fb8a.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	077bbb0a91bcd1236aa85c5d6fcbd42f711bf8f2a305f9ae64cb30d242c8fb8a.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	077bbb0a91bcd1236aa85c5d6fcbd42f711bf8f2a305f9ae64cb30d242c8fb8a.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	077bbb0a91bcd1236aa85c5d6fcbd42f711bf8f2a305f9ae64cb30d242c8fb8a.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	077bbb0a91bcd1236aa85c5d6fcbd42f711bf8f2a305f9ae64cb30d242c8fb8a.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	077bbb0a91bcd1236aa85c5d6fcbd42f711bf8f2a305f9ae64cb30d242c8fb8a.exe

C:\Users\Admin\AppData\Local\Temp\077bbb0a91bcd1236aa85c5d6fcbd42f711bf8f2a305f9ae64cb30d242c8fb8a.exe
"C:\Users\Admin\AppData\Local\Temp\077bbb0a91bcd1236aa85c5d6fcbd42f711bf8f2a305f9ae64cb30d242c8fb8a.exe"
1⤵
- Drops file in Windows directory
PID:1428

C:\Users\Admin\AppData\Local\Temp\077bbb0a91bcd1236aa85c5d6fcbd42f711bf8f2a305f9ae64cb30d242c8fb8a.exe
C:\Users\Admin\AppData\Local\Temp\077bbb0a91bcd1236aa85c5d6fcbd42f711bf8f2a305f9ae64cb30d242c8fb8a.exe -m security
1⤵
- Modifies data under HKEY_USERS
PID:4916

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

Lateral Movement

Collection

Command and Control

Exfiltration

Impact