wannacry | 09ba59540b90eebf1e468503d9057b65c4d3f7b3ad229d2b144d8ea2ccd0a1e0

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2023, 17:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
02353699.exe
Size 3.6MB
Sample230528-wfp4ksge3s
SHA256 09ba59540b90eebf1e468503d9057b65c4d3f7b3ad229d2b144d8ea2ccd0a1e0
MD5 ec1255400b92ed7409929f0d89e1f992
SHA1 b9802163ae4dbb85e50143a51fbb4f2337ee2466
SHA512 2aa825c4e85e39202903e10b38171c56505271ca7b1fc465730fc037c26590b67d48db24a1da38f167719653fe999276e1308f52d588d7b1ada34afa68dfd736
SSDEEP 24576:2bLgddQhfdmMSirYbcMNgef0QeQjG/ZtnfFpoMuS82h54kDDb346n04a8/74/t1G:2nAQqMSPbcBVQej1poMr/5r3yM
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3309) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Executes dropped EXE 1 IoCs

pid	Process
5052	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	02353699.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	02353699.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	02353699.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	02353699.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	02353699.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	02353699.exe

C:\Users\Admin\AppData\Local\Temp\02353699.exe
"C:\Users\Admin\AppData\Local\Temp\02353699.exe"
1⤵
- Drops file in Windows directory
PID:4804
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:5052

C:\Users\Admin\AppData\Local\Temp\02353699.exe
C:\Users\Admin\AppData\Local\Temp\02353699.exe -m security
1⤵
- Modifies data under HKEY_USERS
PID:972

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 565774a3e66c69718627e9437f6cad48b9c6dc09a1ea21e1f9b942f1ad4b6fb5
MD5 bcccb5e7cbd5ebc22f2dc2f274c5c812
SHA1 6cce08b12a157266e054bd52b5b346abaad13b98
SHA512 12e2cfb34c7297a91c416d6686076a32438de988682577d01c7d2e139a908143d947a3f0caaaa2933666c9592e9d3f3bbc91d5ddcf3e1215e1f74852268200ba
SSDEEP 24576:nQhfdmMSirYbcMNgef0QeQjG/ZtnfFpoMuS82h54kDDb346n04a8/74/t1n9Jhi8:nQqMSPbcBVQej1poMr/5r3yL
MD5 SHA1 SHA512 SSDEEP

Submit Download