wannacry | 0474576d4895d7649d7877702436063128e3ffd60ec451dc515e53e0f6c00e2c

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15-06-2024 00:24

Target

2024-06-15_250968028930086c1e8e53c3369a285b_wannacry.exe
Size

3.6MB
MD5

250968028930086c1e8e53c3369a285b
SHA1

7baeb4fa31cd458aff1a73e09e35da013b7d030b
SHA256

0474576d4895d7649d7877702436063128e3ffd60ec451dc515e53e0f6c00e2c
SHA512

ec5fd5b0615572a33449c376afb7ad66eb0ed4d9614f514ab1c991ac454643f120e7cc312e6165d577c1a391fcf736eb8640bc80c13c59747103fc0dff427efa
SSDEEP

12288:GVbLgPlu+QhMbaIMu7L5N5b0Xo3LLFzTM8bQr28mw2:wbLgddQhfdmngBm

Score

10^/10

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (2683) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Executes dropped EXE 1 IoCs

Processes:

tasksche.exe

pid process

5088 tasksche.exe
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Drops file in Windows directory 1 IoCs

Processes:

2024-06-15_250968028930086c1e8e53c3369a285b_wannacry.exe

description ioc process

File created C:\WINDOWS\tasksche.exe 2024-06-15_250968028930086c1e8e53c3369a285b_wannacry.exe

pid	process
5088	tasksche.exe

description	ioc	process
File created	C:\WINDOWS\tasksche.exe	2024-06-15_250968028930086c1e8e53c3369a285b_wannacry.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

2024-06-15_250968028930086c1e8e53c3369a285b_wannacry.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	2024-06-15_250968028930086c1e8e53c3369a285b_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	2024-06-15_250968028930086c1e8e53c3369a285b_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	2024-06-15_250968028930086c1e8e53c3369a285b_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	2024-06-15_250968028930086c1e8e53c3369a285b_wannacry.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	2024-06-15_250968028930086c1e8e53c3369a285b_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2024-06-15_250968028930086c1e8e53c3369a285b_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-15_250968028930086c1e8e53c3369a285b_wannacry.exe"
1⤵
- Drops file in Windows directory
PID:2452

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
2⤵
- Executes dropped EXE
PID:5088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4088,i,11266875042087428226,16669718873272757238,262144 --variations-seed-version --mojo-platform-channel-handle=1280 /prefetch:8
1⤵
PID:1116

C:\Users\Admin\AppData\Local\Temp\2024-06-15_250968028930086c1e8e53c3369a285b_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2024-06-15_250968028930086c1e8e53c3369a285b_wannacry.exe -m security
1⤵
- Modifies data under HKEY_USERS
PID:5060

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
bdda04ebcc92840a64946fc222edc563

SHA1
6f7a92ddf4b6d82c4f8040af1f3d615e00d95a7e

SHA256
0bb221bf62d875cca625778324fe5bd6907640f6998d21f3106a0447aabc1e3c

SHA512
b8f2fbb8f9b78976b3a43ce63e005ddfc434cbb630ddaa83e0ab4e5979cd6c27b96c4bf2e4e5e23fc363a0e148fe8925d5ff32da390fb4c848febae6a7b07290

Download Submit