wannacry | cb11ca7f0afe82833d91792dc891a81088f1605c6cc029edecc21b4f433c0756

General

Target

05894899.exe
Size

3.6MB
MD5

f8db667580cdaa9e33bdd5de9d766153
SHA1

0c4a662548618bb027191803c93d2bb828d390be
SHA256

cb11ca7f0afe82833d91792dc891a81088f1605c6cc029edecc21b4f433c0756
SHA512

5d0ad490ea07b347729136a73633f22c7cf0afc157866eb1cdd2ec7d0c7b10a14ea4255958d7549ce7ac73a88d3d4099f707f0e2beac300e31340e5227d1c60b
SSDEEP

98304:yDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2HI:yDqPe1Cxcxk3ZAEUadzR8yc4HI

Score

10^/10

wannacry ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Executes dropped EXE 1 IoCs

Processes:

tasksche.exe

pid process

1640 tasksche.exe

pid	process
1640	tasksche.exe

Drops file in System32 directory 1 IoCs

Processes:

05894899.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	05894899.exe

Drops file in Windows directory 1 IoCs

Processes:

05894899.exe

description ioc process

File created C:\WINDOWS\tasksche.exe 05894899.exe

description	ioc	process
File created	C:\WINDOWS\tasksche.exe	05894899.exe

Modifies data under HKEY_USERS 24 IoCs

Processes:

05894899.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	05894899.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6733897A-154A-458A-9164-17EE4BA4C964}	05894899.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6733897A-154A-458A-9164-17EE4BA4C964}\WpadNetworkName = "Network 3"	05894899.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-44-b1-32-a8-e8	05894899.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	05894899.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	05894899.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	05894899.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6733897A-154A-458A-9164-17EE4BA4C964}\WpadDecision = "0"	05894899.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-44-b1-32-a8-e8\WpadDecision = "0"	05894899.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	05894899.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	05894899.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6733897A-154A-458A-9164-17EE4BA4C964}\WpadDecisionTime = e07e770a9e91d901	05894899.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6733897A-154A-458A-9164-17EE4BA4C964}\WpadDecisionReason = "1"	05894899.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6733897A-154A-458A-9164-17EE4BA4C964}\ca-44-b1-32-a8-e8	05894899.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-44-b1-32-a8-e8\WpadDecisionTime = e07e770a9e91d901	05894899.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	05894899.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	05894899.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	05894899.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	05894899.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0049000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	05894899.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-44-b1-32-a8-e8\WpadDecisionReason = "1"	05894899.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	05894899.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	05894899.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	05894899.exe

C:\Users\Admin\AppData\Local\Temp\05894899.exe
"C:\Users\Admin\AppData\Local\Temp\05894899.exe"
1⤵
- Drops file in Windows directory
PID:1712

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
2⤵
- Executes dropped EXE
PID:1640

C:\Users\Admin\AppData\Local\Temp\05894899.exe
C:\Users\Admin\AppData\Local\Temp\05894899.exe -m security
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:568

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe
Filesize
3.4MB

MD5
7d4b3e8d346bf22cb82da150791e19f3

SHA1
660f9eeb7fa31a66778963de86069a9f4b9a689c

SHA256
12049e97ab7e5577347c7e1893181c3cab2ed8aef6be3a1fe5891b3e81865c9e

SHA512
b4beab80c46a0abeaa9be674d376a5d1f8233eac77a7d0ad0b21f9a2037e070fef2fafbe95230ee20caaf39002e97cff498ce4d96ef2e9f8fe980773941c0618

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads