wannacry | 57b29058a1e87d599285cf0a07dd82e65a58dbdaae0f2cf77c6999e49bb4be4b

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26/10/2022, 12:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

57b29058a1e87d599285cf0a07dd82e65a58dbdaae0f2cf77c6999e49bb4be4b.exe
Size

3.6MB
MD5

f863dc33ad476c34dfd139230acebbde
SHA1

126698d59579a0c020b8ec140a0009b0aeb8fc4c
SHA256

57b29058a1e87d599285cf0a07dd82e65a58dbdaae0f2cf77c6999e49bb4be4b
SHA512

f4bab399ada745adf26411984357226a874dcf0b3b611d237d132814ee2b325e1da7e553da9edef35f0251ae8251eeeedbb01b167471f98f938cb0337623c03c
SSDEEP

98304:Z8rPoBhz6aRxcSUDk36SAEdhvxWa9v5y3R8yAdR:Z8rPe6Cxcxk3ZAEUatuR8yA

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry

Detects WannaCry Ransomware 1 IoCs

resource	yara_rule
behavioral1/files/0x0008000000014544-56.dat	WannaCry_Ransomware

Contacts a large (1290) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Executes dropped EXE 1 IoCs

pid	Process
1760	tasksche.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	57b29058a1e87d599285cf0a07dd82e65a58dbdaae0f2cf77c6999e49bb4be4b.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	57b29058a1e87d599285cf0a07dd82e65a58dbdaae0f2cf77c6999e49bb4be4b.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	57b29058a1e87d599285cf0a07dd82e65a58dbdaae0f2cf77c6999e49bb4be4b.exe

C:\Users\Admin\AppData\Local\Temp\57b29058a1e87d599285cf0a07dd82e65a58dbdaae0f2cf77c6999e49bb4be4b.exe
"C:\Users\Admin\AppData\Local\Temp\57b29058a1e87d599285cf0a07dd82e65a58dbdaae0f2cf77c6999e49bb4be4b.exe"
1⤵
- Drops file in Windows directory
PID:1048
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:1760

C:\Users\Admin\AppData\Local\Temp\57b29058a1e87d599285cf0a07dd82e65a58dbdaae0f2cf77c6999e49bb4be4b.exe
C:\Users\Admin\AppData\Local\Temp\57b29058a1e87d599285cf0a07dd82e65a58dbdaae0f2cf77c6999e49bb4be4b.exe -m security
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:960

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
36894136c411d876af4b2b06056826c9

SHA1
2d949657e2bc0fa932f106a47eece4ea589e8a6b

SHA256
a60453c65fdb211bf2a0c45b73977fbd6ed1bfd46de262e76e4d56a5027e0209

SHA512
f614ee19874b17448da9fb677a9b2f8b73e5498d8d20a7a2769baa4354c1c99be5f75d1a55265d2b0a923c5c6a559f41eb02bd799c07fe9338af312f5dc48952

Download Submit
memory/1048-54-0x0000000076171000-0x0000000076173000-memory.dmp

Filesize
8KB

Download