wannacry | eed86ba53d4d84ceef045203667f3a4a4636948c36d4bb45ba8de5d69bf87778

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2023 17:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eed86ba53d4d84ceef045203667f3a4a4636948c36d4bb45ba8de5d69bf87778.exe
Size

5.0MB
MD5

58a71165053c76d81f99b3d46d4739a2
SHA1

7ed53c7f2c2628e576ee2436d3493aaa7d371265
SHA256

eed86ba53d4d84ceef045203667f3a4a4636948c36d4bb45ba8de5d69bf87778
SHA512

4b43646a9590b5e5c95daae4b71f6e5c676d69461bd209b8b6c0cdf41c196921df0b57438f27f242918f85f4d68d642d213a6da910542e686ce7238f1c97608e
SSDEEP

98304:yDqPoB2SUDk36SAEdhvxWa9P593R8yAVp2H:yDqPDxk3ZAEUadzR8yc4H

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3196) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Executes dropped EXE 1 IoCs

Processes:

tasksche.exe

pid process

4060 tasksche.exe
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Drops file in Windows directory 1 IoCs

Processes:

eed86ba53d4d84ceef045203667f3a4a4636948c36d4bb45ba8de5d69bf87778.exe

description ioc process

File created C:\WINDOWS\tasksche.exe eed86ba53d4d84ceef045203667f3a4a4636948c36d4bb45ba8de5d69bf87778.exe

pid	process
4060	tasksche.exe

description	ioc	process
File created	C:\WINDOWS\tasksche.exe	eed86ba53d4d84ceef045203667f3a4a4636948c36d4bb45ba8de5d69bf87778.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

eed86ba53d4d84ceef045203667f3a4a4636948c36d4bb45ba8de5d69bf87778.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	eed86ba53d4d84ceef045203667f3a4a4636948c36d4bb45ba8de5d69bf87778.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	eed86ba53d4d84ceef045203667f3a4a4636948c36d4bb45ba8de5d69bf87778.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	eed86ba53d4d84ceef045203667f3a4a4636948c36d4bb45ba8de5d69bf87778.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	eed86ba53d4d84ceef045203667f3a4a4636948c36d4bb45ba8de5d69bf87778.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	eed86ba53d4d84ceef045203667f3a4a4636948c36d4bb45ba8de5d69bf87778.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeManageVolumePrivilege 3676 svchost.exe

description	pid	process
Token: SeManageVolumePrivilege	3676	svchost.exe

C:\Users\Admin\AppData\Local\Temp\eed86ba53d4d84ceef045203667f3a4a4636948c36d4bb45ba8de5d69bf87778.exe
"C:\Users\Admin\AppData\Local\Temp\eed86ba53d4d84ceef045203667f3a4a4636948c36d4bb45ba8de5d69bf87778.exe"
1⤵
- Drops file in Windows directory
PID:4992

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
2⤵
- Executes dropped EXE
PID:4060

C:\Users\Admin\AppData\Local\Temp\eed86ba53d4d84ceef045203667f3a4a4636948c36d4bb45ba8de5d69bf87778.exe
C:\Users\Admin\AppData\Local\Temp\eed86ba53d4d84ceef045203667f3a4a4636948c36d4bb45ba8de5d69bf87778.exe -m security
1⤵
- Modifies data under HKEY_USERS
PID:4980

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:2252

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3676

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe
Filesize
3.4MB

MD5
42feb8cfc81e600a9dffb27dc4d98aaa

SHA1
ab166680c392b9e5cb5ffd5204304c57744c75d1

SHA256
3e0134e6498eaf17a3195849491877e1f08ccc4ed2663c4ab42a96321f2b9475

SHA512
2a147e989d8e174f3ca192593c2229a0232d6e9897bf3add55ffeb4f2078dbf0f0d450fb5f5515d517d51829f4da0c2b2166c03fcc7bdd2a3709617065eb492b

Download Submit
memory/3676-3-0x00000296D6F80000-0x00000296D6F90000-memory.dmp

Filesize
64KB

Download
memory/3676-19-0x00000296D7080000-0x00000296D7090000-memory.dmp

Filesize
64KB

Download
memory/3676-35-0x00000296DF3F0000-0x00000296DF3F1000-memory.dmp

Filesize
4KB

Download
memory/3676-37-0x00000296DF420000-0x00000296DF421000-memory.dmp

Filesize
4KB

Download
memory/3676-38-0x00000296DF420000-0x00000296DF421000-memory.dmp

Filesize
4KB

Download
memory/3676-39-0x00000296DF530000-0x00000296DF531000-memory.dmp

Filesize
4KB

Download