wannacry | d5bee2f82f619aca6f3e967112e37f1797a996f268fa3ed6236ba8adba140fe1

General

Target

2024-05-24_2c0a37f96ff7d5c08ebfc94d40b18606_wannacry.exe
Size

5.0MB
MD5

2c0a37f96ff7d5c08ebfc94d40b18606
SHA1

8db8602e6400aa0a980c0a046324dad968655cae
SHA256

d5bee2f82f619aca6f3e967112e37f1797a996f268fa3ed6236ba8adba140fe1
SHA512

2786d276253d810bedb7fff04cc7524acff358c7c66d7b173d429d29dee6793adf65f673aa8087cd45df3923e5a0513e8dd199ed0c650f0916217f89690f89ae
SSDEEP

24576:QbLguriI/MSirYbcMNgef0QeQjG/D8kIqBbOSSqTPVXmiHkQg6E:Qn9MSPbcBVQej/BSqTdX1HkQG

Score

10^/10

wannacry ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry

Drops file in System32 directory 1 IoCs

Processes:

2024-05-24_2c0a37f96ff7d5c08ebfc94d40b18606_wannacry.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	2024-05-24_2c0a37f96ff7d5c08ebfc94d40b18606_wannacry.exe

Drops file in Windows directory 1 IoCs

Processes:

2024-05-24_2c0a37f96ff7d5c08ebfc94d40b18606_wannacry.exe

description ioc process

File created C:\WINDOWS\tasksche.exe 2024-05-24_2c0a37f96ff7d5c08ebfc94d40b18606_wannacry.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File created	C:\WINDOWS\tasksche.exe	2024-05-24_2c0a37f96ff7d5c08ebfc94d40b18606_wannacry.exe

Modifies data under HKEY_USERS 24 IoCs

Processes:

2024-05-24_2c0a37f96ff7d5c08ebfc94d40b18606_wannacry.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	2024-05-24_2c0a37f96ff7d5c08ebfc94d40b18606_wannacry.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DF0CEC56-E98F-44C4-995D-69849CDD7EE8}	2024-05-24_2c0a37f96ff7d5c08ebfc94d40b18606_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DF0CEC56-E98F-44C4-995D-69849CDD7EE8}\WpadDecision = "0"	2024-05-24_2c0a37f96ff7d5c08ebfc94d40b18606_wannacry.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fa-c9-7a-3d-a3-5a	2024-05-24_2c0a37f96ff7d5c08ebfc94d40b18606_wannacry.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DF0CEC56-E98F-44C4-995D-69849CDD7EE8}\fa-c9-7a-3d-a3-5a	2024-05-24_2c0a37f96ff7d5c08ebfc94d40b18606_wannacry.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	2024-05-24_2c0a37f96ff7d5c08ebfc94d40b18606_wannacry.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	2024-05-24_2c0a37f96ff7d5c08ebfc94d40b18606_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DF0CEC56-E98F-44C4-995D-69849CDD7EE8}\WpadDecisionReason = "1"	2024-05-24_2c0a37f96ff7d5c08ebfc94d40b18606_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fa-c9-7a-3d-a3-5a\WpadDecisionReason = "1"	2024-05-24_2c0a37f96ff7d5c08ebfc94d40b18606_wannacry.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fa-c9-7a-3d-a3-5a\WpadDecisionTime = c0c78b27efadda01	2024-05-24_2c0a37f96ff7d5c08ebfc94d40b18606_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fa-c9-7a-3d-a3-5a\WpadDecision = "0"	2024-05-24_2c0a37f96ff7d5c08ebfc94d40b18606_wannacry.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DF0CEC56-E98F-44C4-995D-69849CDD7EE8}\WpadDecisionTime = c0c78b27efadda01	2024-05-24_2c0a37f96ff7d5c08ebfc94d40b18606_wannacry.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	2024-05-24_2c0a37f96ff7d5c08ebfc94d40b18606_wannacry.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	2024-05-24_2c0a37f96ff7d5c08ebfc94d40b18606_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	2024-05-24_2c0a37f96ff7d5c08ebfc94d40b18606_wannacry.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	2024-05-24_2c0a37f96ff7d5c08ebfc94d40b18606_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	2024-05-24_2c0a37f96ff7d5c08ebfc94d40b18606_wannacry.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	2024-05-24_2c0a37f96ff7d5c08ebfc94d40b18606_wannacry.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	2024-05-24_2c0a37f96ff7d5c08ebfc94d40b18606_wannacry.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	2024-05-24_2c0a37f96ff7d5c08ebfc94d40b18606_wannacry.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	2024-05-24_2c0a37f96ff7d5c08ebfc94d40b18606_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	2024-05-24_2c0a37f96ff7d5c08ebfc94d40b18606_wannacry.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	2024-05-24_2c0a37f96ff7d5c08ebfc94d40b18606_wannacry.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DF0CEC56-E98F-44C4-995D-69849CDD7EE8}\WpadNetworkName = "Network 3"	2024-05-24_2c0a37f96ff7d5c08ebfc94d40b18606_wannacry.exe

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\vsdm_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\vsdm_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.vsdm	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\vsdm_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.vsdm\ = "vsdm_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\vsdm_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\vsdm_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\vsdm_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2492 AcroRd32.exe
2492 AcroRd32.exe

pid	process
2492	AcroRd32.exe
2492	AcroRd32.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1000 wrote to memory of 2492	1000	rundll32.exe	AcroRd32.exe
PID 1000 wrote to memory of 2492	1000	rundll32.exe	AcroRd32.exe
PID 1000 wrote to memory of 2492	1000	rundll32.exe	AcroRd32.exe
PID 1000 wrote to memory of 2492	1000	rundll32.exe	AcroRd32.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-24_2c0a37f96ff7d5c08ebfc94d40b18606_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-24_2c0a37f96ff7d5c08ebfc94d40b18606_wannacry.exe"
1⤵
- Drops file in Windows directory
PID:1784

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2636

C:\Users\Admin\AppData\Local\Temp\2024-05-24_2c0a37f96ff7d5c08ebfc94d40b18606_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2024-05-24_2c0a37f96ff7d5c08ebfc94d40b18606_wannacry.exe -m security
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2400

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Downloads\AddGrant.vsdm
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1000
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\Downloads\AddGrant.vsdm"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e6c92168dc115ef836d8e3a4d9755af4

SHA1
ae992052297449bb54d8eedfcb3a34bd7dfd557b

SHA256
59dfa3cfa926e5005724dfdf9c6b6cf778b450c650fd9b8071c84b926fdde71c

SHA512
d6cf897475118d5dd2cbcdab51a628bd56bec24d311283d212d74fb638b9f98ecb79ce8e539deda936bea5c2ef1d771526e14a88e7e29ef2b0ee73726be21ef4

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads