wannacry | 995fc47f5a93290bfb55d81aa2ef7ab8cdc318fede83ad870c1bafceb28e3ea1

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
09-07-2023 11:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9664768f5ad1faexeexeexeex.exe
Size

5.0MB
MD5

9664768f5ad1fa15c107ec79a8dc797a
SHA1

0dbb80e9eb16654dd57bf01f8112e15aafea54c5
SHA256

995fc47f5a93290bfb55d81aa2ef7ab8cdc318fede83ad870c1bafceb28e3ea1
SHA512

9cced82693b2e52bce9f478aa29eee2a21be43cf4a974c184f37d097f2ce3c4d96b94c6f3bb5ef3a5953c932c6ebca22976954c9a149c490ac3f9fd72d3b3835
SSDEEP

98304:yDqPoBhz1aRxcSUDk36SAEdhvxWa9P5AR8yAVp2:yDqPe1Cxcxk3ZAEUadiR8yc4

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3234) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Executes dropped EXE 1 IoCs

pid	Process
3852	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	9664768f5ad1faexeexeexeex.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	9664768f5ad1faexeexeexeex.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	9664768f5ad1faexeexeexeex.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	9664768f5ad1faexeexeexeex.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	9664768f5ad1faexeexeexeex.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	9664768f5ad1faexeexeexeex.exe

C:\Users\Admin\AppData\Local\Temp\9664768f5ad1faexeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\9664768f5ad1faexeexeexeex.exe"
1⤵
- Drops file in Windows directory
PID:4764
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:3852

C:\Users\Admin\AppData\Local\Temp\9664768f5ad1faexeexeexeex.exe
C:\Users\Admin\AppData\Local\Temp\9664768f5ad1faexeexeexeex.exe -m security
1⤵
- Modifies data under HKEY_USERS
PID:4132

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
b6b4a7192b64c3ff5db94c5a92cc2ecc

SHA1
96644ddd07d959934c1bfd7be656ab3ece931954

SHA256
c67c2b56bdce5f3839d7eb2f84c715e5b7709e08faef23481d9a01f0920f6bd5

SHA512
7a4151589997f1e8abc2dd0bdc0837b2713555999a5844289920191e1f7c3dc251c8749d7b88cb69e6c78f1972d6daaf860f7c69c63980c5605a07f3f770fbf3

Download Submit