wannacry | 133c67eb527809b01c5977c560949ec03c3fb5b87c8ed4bcd38c580c8bfdbd10

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-05-16_7b43d71dbfb4dc8eba0e3e2a010c5a31_wannacry.exe
Size 3.6MB
Sample240516-e8x68acc2v
SHA256 133c67eb527809b01c5977c560949ec03c3fb5b87c8ed4bcd38c580c8bfdbd10
MD5 7b43d71dbfb4dc8eba0e3e2a010c5a31
SHA1 ebaca15297aa0a266c5ebf7f22f08891dc83903d
SHA512 dbff1d2971ffd81f1a3635b8dd6cbbc0543c4f0215f620bbdff04bbf984bf512a9891e177c14f19e5294455b25b1ca8548d532bd47971fb5eb578603ecc91349
SSDEEP 49152:2nAQJGx+TSqTdX1HkQo6SAASxJM0H9PAMEcaEau3R8yAH1plAHI:yDwxcSUDk36SA7xWa9P593R8yAVp2HI
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3324) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 1 IoCs

pid	Process
3620	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	2024-05-16_7b43d71dbfb4dc8eba0e3e2a010c5a31_wannacry.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	2024-05-16_7b43d71dbfb4dc8eba0e3e2a010c5a31_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	2024-05-16_7b43d71dbfb4dc8eba0e3e2a010c5a31_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	2024-05-16_7b43d71dbfb4dc8eba0e3e2a010c5a31_wannacry.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	2024-05-16_7b43d71dbfb4dc8eba0e3e2a010c5a31_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	2024-05-16_7b43d71dbfb4dc8eba0e3e2a010c5a31_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-16_7b43d71dbfb4dc8eba0e3e2a010c5a31_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-16_7b43d71dbfb4dc8eba0e3e2a010c5a31_wannacry.exe"
1⤵
- Drops file in Windows directory
PID:4736
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:3620

C:\Users\Admin\AppData\Local\Temp\2024-05-16_7b43d71dbfb4dc8eba0e3e2a010c5a31_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2024-05-16_7b43d71dbfb4dc8eba0e3e2a010c5a31_wannacry.exe -m security
1⤵
- Modifies data under HKEY_USERS
PID:4440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 dc3fe9a318d69f41e20f378fbd3368b8b7ce30cf1fa17f8d8318612acd24c80c
MD5 aa7f6c30c24531e82018968e7aaf8138
SHA1 1d0723bcd706cbc0ba7b4111b4d18d549ad7a8f7
SHA512 2a267267bfa44f74cda7e5f58d1c994381b290ac9c0a46ea8276f60db042fb50f7ba32352478910493a4318b2e8436e9468627d2704921a1203079d3fffce0c1
SSDEEP 49152:nQJGx+TSqTdX1HkQo6SAASxJM0H9PAMEcaEau3R8yAH1plAHj:QwxcSUDk36SA7xWa9P593R8yAVp2Hj
MD5 SHA1 SHA512 SSDEEP

Submit Download