wannacry | 5823d78a9481362079453c173def070195664a58a50ce05dcedd3c8586f6dfdd

General

Target

5823d78a9481362079453c173def070195664a58a50ce05dcedd3c8586f6dfdd.exe
Size

5.0MB
MD5

9385f6b2f35ea1691f0991db34661d0b
SHA1

109811190317ac4a0a90a01a7828afc5c081edd0
SHA256

5823d78a9481362079453c173def070195664a58a50ce05dcedd3c8586f6dfdd
SHA512

cd924f50b01c286fe6af1f58761840e67c8d91063acc629a99aa49e5a40f86f438d20c687d8335245fe318c6ea1e9e173bda0e8230e411026c799a4ed69989ec
SSDEEP

49152:QnpEKUacBVQej/QINRx+TSqTdX1HkQo6SAgql:QpyfBhzQaRxcSUDk36SAg2

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3291) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Executes dropped EXE 1 IoCs

Processes:

tasksche.exe

pid process

548 tasksche.exe
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

pid	process
548	tasksche.exe

Drops file in System32 directory 4 IoCs

Processes:

5823d78a9481362079453c173def070195664a58a50ce05dcedd3c8586f6dfdd.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	5823d78a9481362079453c173def070195664a58a50ce05dcedd3c8586f6dfdd.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	5823d78a9481362079453c173def070195664a58a50ce05dcedd3c8586f6dfdd.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	5823d78a9481362079453c173def070195664a58a50ce05dcedd3c8586f6dfdd.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	5823d78a9481362079453c173def070195664a58a50ce05dcedd3c8586f6dfdd.exe

Drops file in Windows directory 3 IoCs

Processes:

5823d78a9481362079453c173def070195664a58a50ce05dcedd3c8586f6dfdd.exetasksche.exe

description	ioc	process
File created	C:\WINDOWS\tasksche.exe	5823d78a9481362079453c173def070195664a58a50ce05dcedd3c8586f6dfdd.exe
File created	C:\Windows\__tmp_rar_sfx_access_check_240610687	tasksche.exe
File created	C:\Windows\eee.exe	tasksche.exe

Modifies data under HKEY_USERS 15 IoCs

Processes:

5823d78a9481362079453c173def070195664a58a50ce05dcedd3c8586f6dfdd.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	5823d78a9481362079453c173def070195664a58a50ce05dcedd3c8586f6dfdd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	5823d78a9481362079453c173def070195664a58a50ce05dcedd3c8586f6dfdd.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	5823d78a9481362079453c173def070195664a58a50ce05dcedd3c8586f6dfdd.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	5823d78a9481362079453c173def070195664a58a50ce05dcedd3c8586f6dfdd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History	5823d78a9481362079453c173def070195664a58a50ce05dcedd3c8586f6dfdd.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	5823d78a9481362079453c173def070195664a58a50ce05dcedd3c8586f6dfdd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	5823d78a9481362079453c173def070195664a58a50ce05dcedd3c8586f6dfdd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P	5823d78a9481362079453c173def070195664a58a50ce05dcedd3c8586f6dfdd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	5823d78a9481362079453c173def070195664a58a50ce05dcedd3c8586f6dfdd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	5823d78a9481362079453c173def070195664a58a50ce05dcedd3c8586f6dfdd.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	5823d78a9481362079453c173def070195664a58a50ce05dcedd3c8586f6dfdd.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	5823d78a9481362079453c173def070195664a58a50ce05dcedd3c8586f6dfdd.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	5823d78a9481362079453c173def070195664a58a50ce05dcedd3c8586f6dfdd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	5823d78a9481362079453c173def070195664a58a50ce05dcedd3c8586f6dfdd.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	5823d78a9481362079453c173def070195664a58a50ce05dcedd3c8586f6dfdd.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

5823d78a9481362079453c173def070195664a58a50ce05dcedd3c8586f6dfdd.exe

description	pid	process	target process
PID 4532 wrote to memory of 548	4532	5823d78a9481362079453c173def070195664a58a50ce05dcedd3c8586f6dfdd.exe	tasksche.exe
PID 4532 wrote to memory of 548	4532	5823d78a9481362079453c173def070195664a58a50ce05dcedd3c8586f6dfdd.exe	tasksche.exe
PID 4532 wrote to memory of 548	4532	5823d78a9481362079453c173def070195664a58a50ce05dcedd3c8586f6dfdd.exe	tasksche.exe

C:\Users\Admin\AppData\Local\Temp\5823d78a9481362079453c173def070195664a58a50ce05dcedd3c8586f6dfdd.exe
"C:\Users\Admin\AppData\Local\Temp\5823d78a9481362079453c173def070195664a58a50ce05dcedd3c8586f6dfdd.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4532

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
2⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:548

C:\Users\Admin\AppData\Local\Temp\5823d78a9481362079453c173def070195664a58a50ce05dcedd3c8586f6dfdd.exe
C:\Users\Admin\AppData\Local\Temp\5823d78a9481362079453c173def070195664a58a50ce05dcedd3c8586f6dfdd.exe -m security
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4256

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

2

T1046

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe
Filesize
2.0MB

MD5
57137b0ac9dbbcbdcda6231af50c75a6

SHA1
560d59311fcd30d2204e66e8d6f684ec93b88b2a

SHA256
2fe66c39cc67912614e673276df7aa46ce8ad86e48899fbdd93ac9c0bc5e0cca

SHA512
0bac3773f99c74d5cc83d5ca4f26e1d58ca94ea218730af9060f100879a284b95045f7b5c4303768b58735ae597b0951bcb075f30270aa06cb4e0f0532423053

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads