wannacry | 662382cbab998a97ac2dd7f06ade095ec0a6d484f4265f5824816e0c4d86f874

Analysis

max time kernel
152s
max time network
161s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/11/2022, 06:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

662382cbab998a97ac2dd7f06ade095ec0a6d484f4265f5824816e0c4d86f874.exe
Size

3.6MB
MD5

bc18e8c27142dcf420699175dda2c6a8
SHA1

596b77c461e0ec8c72087ade6482f8565767bca5
SHA256

662382cbab998a97ac2dd7f06ade095ec0a6d484f4265f5824816e0c4d86f874
SHA512

93db7a8e455535f6cf45f0e34aa193759fa298b23276e2f87f08fc7731f22fa6e8b9a6a4c817be6ac977dfb423e951a7881876e3f452f000e396335f68ce896f
SSDEEP

98304:Z8qPoBhz18k36SAEdhvxWa9P593R8yAVp2HI:Z8qPe18k3ZAEUadzR8yc4HI

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (1193) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Executes dropped EXE 1 IoCs

pid	Process
1216	tasksche.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	662382cbab998a97ac2dd7f06ade095ec0a6d484f4265f5824816e0c4d86f874.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	662382cbab998a97ac2dd7f06ade095ec0a6d484f4265f5824816e0c4d86f874.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	662382cbab998a97ac2dd7f06ade095ec0a6d484f4265f5824816e0c4d86f874.exe

C:\Users\Admin\AppData\Local\Temp\662382cbab998a97ac2dd7f06ade095ec0a6d484f4265f5824816e0c4d86f874.exe
"C:\Users\Admin\AppData\Local\Temp\662382cbab998a97ac2dd7f06ade095ec0a6d484f4265f5824816e0c4d86f874.exe"
1⤵
- Drops file in Windows directory
PID:1108
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:1216

C:\Users\Admin\AppData\Local\Temp\662382cbab998a97ac2dd7f06ade095ec0a6d484f4265f5824816e0c4d86f874.exe
C:\Users\Admin\AppData\Local\Temp\662382cbab998a97ac2dd7f06ade095ec0a6d484f4265f5824816e0c4d86f874.exe -m security
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:960

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
616cfad9907f72f1366157a27e274167

SHA1
f5a2af045457cf853499c47e4c7647fbb70ce08f

SHA256
837f668fd4f29e2080229547fe08aeac369ba64baf0d803652fae9e794c4096f

SHA512
5dc19e05b4c11e652d89e34a4f560a829c614af027e86645c0ed6b1c4cb66021b5dcc72b4b711e4cc25fb0fd7b166cb395a8b19e777d76d62ff6a33bb22fa9f2

Download Submit
memory/1108-54-0x0000000075771000-0x0000000075773000-memory.dmp

Filesize
8KB

Download