wannacry | 4d25660b5b5010913c52354a6c24e9cb82da4b8c187d49a62c150bd6623cbdb3

Analysis

max time kernel
151s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01-05-2024 12:44

Target

0bd3d686c4a3002e9eb140d4751e42bf_JaffaCakes118.exe
Size

3.6MB
MD5

0bd3d686c4a3002e9eb140d4751e42bf
SHA1

2f818f3b1f0c1aaa9245e5816ced58bd518d30f8
SHA256

4d25660b5b5010913c52354a6c24e9cb82da4b8c187d49a62c150bd6623cbdb3
SHA512

547bc25dfcc25bfbe8fb95bc362ab47bd8b969334cbd7b5e72998771cea89e2992520424a2e337b4384071dce867966dcec08deee8013cb95011b15ec998146d
SSDEEP

98304:yDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2M:yDqPe1Cxcxk3ZAEUadzR8yc4M

Score

10^/10

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3103) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Executes dropped EXE 1 IoCs

Processes:

tasksche.exe

pid process

3560 tasksche.exe
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Drops file in Windows directory 1 IoCs

Processes:

0bd3d686c4a3002e9eb140d4751e42bf_JaffaCakes118.exe

description ioc process

File created C:\WINDOWS\tasksche.exe 0bd3d686c4a3002e9eb140d4751e42bf_JaffaCakes118.exe

pid	process
3560	tasksche.exe

description	ioc	process
File created	C:\WINDOWS\tasksche.exe	0bd3d686c4a3002e9eb140d4751e42bf_JaffaCakes118.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

0bd3d686c4a3002e9eb140d4751e42bf_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	0bd3d686c4a3002e9eb140d4751e42bf_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	0bd3d686c4a3002e9eb140d4751e42bf_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	0bd3d686c4a3002e9eb140d4751e42bf_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	0bd3d686c4a3002e9eb140d4751e42bf_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	0bd3d686c4a3002e9eb140d4751e42bf_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\0bd3d686c4a3002e9eb140d4751e42bf_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0bd3d686c4a3002e9eb140d4751e42bf_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
PID:1544

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
2⤵
- Executes dropped EXE
PID:3560

C:\Users\Admin\AppData\Local\Temp\0bd3d686c4a3002e9eb140d4751e42bf_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\0bd3d686c4a3002e9eb140d4751e42bf_JaffaCakes118.exe -m security
1⤵
- Modifies data under HKEY_USERS
PID:3960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4080 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8
1⤵
PID:2892

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Windows\tasksche.exe
Filesize
3.4MB

MD5
ca52bd49050531ca4fed17e87dd2b16c

SHA1
7d7e188f903b635bd267b1200067cd526f3db6f1

SHA256
c623c3e2ec9c66a857a1de7abcb48ca69872b83d95e01466506c1750f5d4db82

SHA512
9c0be5206449fe5d4916e9884b255bdde98f3b65c278a86865fa8b3dcb1ecd38e9c077d034458a043f4469ea9e063d0ede41491af58ec1046a625fefd6cd824b

Download Submit