wannacry | 995fc47f5a93290bfb55d81aa2ef7ab8cdc318fede83ad870c1bafceb28e3ea1

General

Target

9664768f5ad1faexeexeexeex.exe
Size

5.0MB
MD5

9664768f5ad1fa15c107ec79a8dc797a
SHA1

0dbb80e9eb16654dd57bf01f8112e15aafea54c5
SHA256

995fc47f5a93290bfb55d81aa2ef7ab8cdc318fede83ad870c1bafceb28e3ea1
SHA512

9cced82693b2e52bce9f478aa29eee2a21be43cf4a974c184f37d097f2ce3c4d96b94c6f3bb5ef3a5953c932c6ebca22976954c9a149c490ac3f9fd72d3b3835
SSDEEP

98304:yDqPoBhz1aRxcSUDk36SAEdhvxWa9P5AR8yAVp2:yDqPe1Cxcxk3ZAEUadiR8yc4

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (1562) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Executes dropped EXE 1 IoCs

pid	Process
2268	tasksche.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	9664768f5ad1faexeexeexeex.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	9664768f5ad1faexeexeexeex.exe

Modifies data under HKEY_USERS 24 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	9664768f5ad1faexeexeexeex.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	9664768f5ad1faexeexeexeex.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	9664768f5ad1faexeexeexeex.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C1A56613-29F8-42C5-9EED-5C876AD893D8}\WpadNetworkName = "Network 3"	9664768f5ad1faexeexeexeex.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	9664768f5ad1faexeexeexeex.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	9664768f5ad1faexeexeexeex.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	9664768f5ad1faexeexeexeex.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C1A56613-29F8-42C5-9EED-5C876AD893D8}\WpadDecisionReason = "1"	9664768f5ad1faexeexeexeex.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C1A56613-29F8-42C5-9EED-5C876AD893D8}	9664768f5ad1faexeexeexeex.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b2-84-96-cf-73-61\WpadDecisionTime = b0bf08c656b2d901	9664768f5ad1faexeexeexeex.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	9664768f5ad1faexeexeexeex.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	9664768f5ad1faexeexeexeex.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	9664768f5ad1faexeexeexeex.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	9664768f5ad1faexeexeexeex.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00df000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	9664768f5ad1faexeexeexeex.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b2-84-96-cf-73-61	9664768f5ad1faexeexeexeex.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C1A56613-29F8-42C5-9EED-5C876AD893D8}\b2-84-96-cf-73-61	9664768f5ad1faexeexeexeex.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b2-84-96-cf-73-61\WpadDecisionReason = "1"	9664768f5ad1faexeexeexeex.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	9664768f5ad1faexeexeexeex.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	9664768f5ad1faexeexeexeex.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	9664768f5ad1faexeexeexeex.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C1A56613-29F8-42C5-9EED-5C876AD893D8}\WpadDecisionTime = b0bf08c656b2d901	9664768f5ad1faexeexeexeex.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C1A56613-29F8-42C5-9EED-5C876AD893D8}\WpadDecision = "0"	9664768f5ad1faexeexeexeex.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b2-84-96-cf-73-61\WpadDecision = "0"	9664768f5ad1faexeexeexeex.exe

C:\Users\Admin\AppData\Local\Temp\9664768f5ad1faexeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\9664768f5ad1faexeexeexeex.exe"
1⤵
- Drops file in Windows directory
PID:2424
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:2268

C:\Users\Admin\AppData\Local\Temp\9664768f5ad1faexeexeexeex.exe
C:\Users\Admin\AppData\Local\Temp\9664768f5ad1faexeexeexeex.exe -m security
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2392

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

1

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
b6b4a7192b64c3ff5db94c5a92cc2ecc

SHA1
96644ddd07d959934c1bfd7be656ab3ece931954

SHA256
c67c2b56bdce5f3839d7eb2f84c715e5b7709e08faef23481d9a01f0920f6bd5

SHA512
7a4151589997f1e8abc2dd0bdc0837b2713555999a5844289920191e1f7c3dc251c8749d7b88cb69e6c78f1972d6daaf860f7c69c63980c5605a07f3f770fbf3

Download Submit

Analysis

Sharing