wannacry | 5d41284621b0512f8c6a5aca9af1de76ff91d70aa958445c588e2a5c7d8ca3b9

Analysis

max time kernel
121s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
12-05-2024 17:37

Target

3b4c468145f08af4b33fcf86fb8c6368_JaffaCakes118.exe
Size

8.0MB
MD5

3b4c468145f08af4b33fcf86fb8c6368
SHA1

60fb05288d9a44b8025fdd8dcac1851313d720f0
SHA256

5d41284621b0512f8c6a5aca9af1de76ff91d70aa958445c588e2a5c7d8ca3b9
SHA512

a0e19b705a9ccaf1fe2fb8cf7869e5774de81687b39b153d91ba9a89049a7084ab81be32e8c63aa92a968a698504a67686e28f3670cdeec12df58f8bbe785e91
SSDEEP

49152:2nAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAAuTfOIR1gEoByN3Z:yDqPoBhz1aRxcSUDk36SAxZ1gEowNp

Score

10^/10

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Executes dropped EXE 1 IoCs

Processes:

tasksche.exe

pid process

3812 tasksche.exe
Drops file in Windows directory 1 IoCs

Processes:

3b4c468145f08af4b33fcf86fb8c6368_JaffaCakes118.exe

description ioc process

File created C:\WINDOWS\tasksche.exe 3b4c468145f08af4b33fcf86fb8c6368_JaffaCakes118.exe

pid	process
3812	tasksche.exe

description	ioc	process
File created	C:\WINDOWS\tasksche.exe	3b4c468145f08af4b33fcf86fb8c6368_JaffaCakes118.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

3b4c468145f08af4b33fcf86fb8c6368_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	3b4c468145f08af4b33fcf86fb8c6368_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	3b4c468145f08af4b33fcf86fb8c6368_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	3b4c468145f08af4b33fcf86fb8c6368_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	3b4c468145f08af4b33fcf86fb8c6368_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	3b4c468145f08af4b33fcf86fb8c6368_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\3b4c468145f08af4b33fcf86fb8c6368_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3b4c468145f08af4b33fcf86fb8c6368_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
PID:4208

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
2⤵
- Executes dropped EXE
PID:3812

C:\Users\Admin\AppData\Local\Temp\3b4c468145f08af4b33fcf86fb8c6368_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\3b4c468145f08af4b33fcf86fb8c6368_JaffaCakes118.exe -m security
1⤵
- Modifies data under HKEY_USERS
PID:436

C:\Windows\tasksche.exe
Filesize
3.4MB

MD5
90688728772ac6a848611e74ae413c9e

SHA1
5795d99c657bb00d6f6cc104fee403f7c811cb12

SHA256
a656697d11966530a0bf1f608e30ee1fc2c9a5eddfd5cb7508978b9c42a20b66

SHA512
0aca0ff5a1847198298c3b11157f21777efdaf388cbf31c0aa2e1913334e05151cfc9d480b2fce0ea340e87427a404dd582fdc4fbc6b586eee6d43e6f2ea28a7

Download Submit