wannacry | 1c7f69530d4986ede246d01254cc1435c1a7e183c09a7f73a57c103fec7b9857

General

Target

2023-05-01_e421a1413a11f5750aa178d9945d4158_wannacry.exe
Size

5.0MB
MD5

e421a1413a11f5750aa178d9945d4158
SHA1

ae081a93e399217ffca63e678715f7c6766cb29b
SHA256

1c7f69530d4986ede246d01254cc1435c1a7e183c09a7f73a57c103fec7b9857
SHA512

6b9a5be4ca97e91cbb11a5482085423269db43fe0c980a1508af5853979f936ec866c07f5bf11c556f0de61f348af56cb1e2389871f426d9fc6ebf32844471bb
SSDEEP

49152:2nAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdh:yDqPoBhz1aRxcSUDk36SAEdh

Score

10^/10

wannacry ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry

Executes dropped EXE 1 IoCs

pid	Process
1812	tasksche.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	2023-05-01_e421a1413a11f5750aa178d9945d4158_wannacry.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	2023-05-01_e421a1413a11f5750aa178d9945d4158_wannacry.exe

Modifies data under HKEY_USERS 24 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	2023-05-01_e421a1413a11f5750aa178d9945d4158_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E6C3D164-0D91-45DC-89DA-4DC3CAAE0E7C}\WpadDecision = "0"	2023-05-01_e421a1413a11f5750aa178d9945d4158_wannacry.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E6C3D164-0D91-45DC-89DA-4DC3CAAE0E7C}\ce-37-84-d7-57-aa	2023-05-01_e421a1413a11f5750aa178d9945d4158_wannacry.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ce-37-84-d7-57-aa\WpadDecisionTime = e02c8b217f7dd901	2023-05-01_e421a1413a11f5750aa178d9945d4158_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ce-37-84-d7-57-aa\WpadDecision = "0"	2023-05-01_e421a1413a11f5750aa178d9945d4158_wannacry.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	2023-05-01_e421a1413a11f5750aa178d9945d4158_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	2023-05-01_e421a1413a11f5750aa178d9945d4158_wannacry.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	2023-05-01_e421a1413a11f5750aa178d9945d4158_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	2023-05-01_e421a1413a11f5750aa178d9945d4158_wannacry.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	2023-05-01_e421a1413a11f5750aa178d9945d4158_wannacry.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E6C3D164-0D91-45DC-89DA-4DC3CAAE0E7C}\WpadDecisionTime = e02c8b217f7dd901	2023-05-01_e421a1413a11f5750aa178d9945d4158_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E6C3D164-0D91-45DC-89DA-4DC3CAAE0E7C}\WpadDecisionReason = "1"	2023-05-01_e421a1413a11f5750aa178d9945d4158_wannacry.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E6C3D164-0D91-45DC-89DA-4DC3CAAE0E7C}\WpadNetworkName = "Network 3"	2023-05-01_e421a1413a11f5750aa178d9945d4158_wannacry.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ce-37-84-d7-57-aa	2023-05-01_e421a1413a11f5750aa178d9945d4158_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ce-37-84-d7-57-aa\WpadDecisionReason = "1"	2023-05-01_e421a1413a11f5750aa178d9945d4158_wannacry.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	2023-05-01_e421a1413a11f5750aa178d9945d4158_wannacry.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	2023-05-01_e421a1413a11f5750aa178d9945d4158_wannacry.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f006f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	2023-05-01_e421a1413a11f5750aa178d9945d4158_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	2023-05-01_e421a1413a11f5750aa178d9945d4158_wannacry.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	2023-05-01_e421a1413a11f5750aa178d9945d4158_wannacry.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E6C3D164-0D91-45DC-89DA-4DC3CAAE0E7C}	2023-05-01_e421a1413a11f5750aa178d9945d4158_wannacry.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	2023-05-01_e421a1413a11f5750aa178d9945d4158_wannacry.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	2023-05-01_e421a1413a11f5750aa178d9945d4158_wannacry.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	2023-05-01_e421a1413a11f5750aa178d9945d4158_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2023-05-01_e421a1413a11f5750aa178d9945d4158_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2023-05-01_e421a1413a11f5750aa178d9945d4158_wannacry.exe"
1⤵
- Drops file in Windows directory
PID:1584
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:1812

C:\Users\Admin\AppData\Local\Temp\2023-05-01_e421a1413a11f5750aa178d9945d4158_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2023-05-01_e421a1413a11f5750aa178d9945d4158_wannacry.exe -m security
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1168

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
5abe0aa95b8bd2c4e72cefb4fa309e6f

SHA1
a3965c6add1e7d436c24d74189692163212345c9

SHA256
e5bc13c336b5f705259aa6495243ad7016866864238b2fca10fa6af8db1cf1ea

SHA512
dbb2edebf9fd5773e318fd56e586b441e8cb31a4f02a94407da474ec767c40d8932094962e637bfd8150efa0b19ad1cc14d03a64d59d4766d607e1ffabe76aca

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads