wannacry | a651d6ef33fac753cd65b088cd33c6be78f8e12db977bd257634cead19131f6f

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2023, 15:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8f6c2059cf5957exeexeexeex.exe
Size

3.6MB
MD5

8f6c2059cf5957bb40360e6731141eef
SHA1

ca23edd9afc15bb0c6b3eb863455b5979797d64d
SHA256

a651d6ef33fac753cd65b088cd33c6be78f8e12db977bd257634cead19131f6f
SHA512

be6df2aae64fe565c073f34fccf36c6ea72c99549c4d815d55c62e950860833a0d393df9e76ea405c4cd14251ff30372ac6a1da45e344df53edef6467eb1b9cd
SSDEEP

98304:XDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8y:XDqPe1Cxcxk3ZAEUadzR8y

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3315) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Executes dropped EXE 1 IoCs

pid	Process
3036	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	8f6c2059cf5957exeexeexeex.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	8f6c2059cf5957exeexeexeex.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	8f6c2059cf5957exeexeexeex.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	8f6c2059cf5957exeexeexeex.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	8f6c2059cf5957exeexeexeex.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	8f6c2059cf5957exeexeexeex.exe

C:\Users\Admin\AppData\Local\Temp\8f6c2059cf5957exeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\8f6c2059cf5957exeexeexeex.exe"
1⤵
- Drops file in Windows directory
PID:3116
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:3036

C:\Users\Admin\AppData\Local\Temp\8f6c2059cf5957exeexeexeex.exe
C:\Users\Admin\AppData\Local\Temp\8f6c2059cf5957exeexeexeex.exe -m security
1⤵
- Modifies data under HKEY_USERS
PID:3800

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
f0d46641cb2ce784834647247a0fddc6

SHA1
24439b322dac441a252356df1bed552469a376ea

SHA256
ce4547b73eee357af32965aafa75e71cdb5f912329573ea093f8e4becd1e17b4

SHA512
bc0a44710603e4eea19e0611c8cb4cb74865fa4d1b7f035c5a21d0e64fe361e5140172fe135bb4f8c3833f29042648e8c8f93caafdc496d6d4a2c1d8a102deb0

Download Submit