wannacry | 3c2cd56abacb10b9de1b11ba289bae4d3bf187830cd31afc3984b449ff90025e

General

Target

baed9ddd301c424b10fc2dd1d4bbb95e_JaffaCakes118.exe
Size

3.6MB
MD5

baed9ddd301c424b10fc2dd1d4bbb95e
SHA1

462bd00daa8df9a7455bf7c151c56b16b660417c
SHA256

3c2cd56abacb10b9de1b11ba289bae4d3bf187830cd31afc3984b449ff90025e
SHA512

942c9dca351eaf4794be665e39b9b86c019d5663e1e228eec49ca73488e0cac8d6d3f9be5c999cf8891137dc2f462a6bc4f00ef343823605fb4ac786154a70e0
SSDEEP

98304:wDqPoBhz1aRxcSUDk36SAQdhvxWa9P5wr:wDqPe1Cxcxk3ZAQUad0

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (2678) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Executes dropped EXE 1 IoCs

Processes:

tasksche.exe

pid process

1544 tasksche.exe

pid	process
1544	tasksche.exe

Drops file in System32 directory 1 IoCs

Processes:

baed9ddd301c424b10fc2dd1d4bbb95e_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	baed9ddd301c424b10fc2dd1d4bbb95e_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

Processes:

baed9ddd301c424b10fc2dd1d4bbb95e_JaffaCakes118.exe

description ioc process

File created C:\WINDOWS\tasksche.exe baed9ddd301c424b10fc2dd1d4bbb95e_JaffaCakes118.exe

description	ioc	process
File created	C:\WINDOWS\tasksche.exe	baed9ddd301c424b10fc2dd1d4bbb95e_JaffaCakes118.exe

Modifies data under HKEY_USERS 24 IoCs

Processes:

baed9ddd301c424b10fc2dd1d4bbb95e_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	baed9ddd301c424b10fc2dd1d4bbb95e_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	baed9ddd301c424b10fc2dd1d4bbb95e_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	baed9ddd301c424b10fc2dd1d4bbb95e_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f002c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	baed9ddd301c424b10fc2dd1d4bbb95e_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F5D3F108-CBEB-4BE1-A595-A906CEDDD0B8}\WpadDecisionReason = "1"	baed9ddd301c424b10fc2dd1d4bbb95e_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c2-b4-d6-c8-55-97\WpadDecisionReason = "1"	baed9ddd301c424b10fc2dd1d4bbb95e_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	baed9ddd301c424b10fc2dd1d4bbb95e_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	baed9ddd301c424b10fc2dd1d4bbb95e_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c2-b4-d6-c8-55-97\WpadDecisionTime = e04ffdee5ec1da01	baed9ddd301c424b10fc2dd1d4bbb95e_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F5D3F108-CBEB-4BE1-A595-A906CEDDD0B8}\c2-b4-d6-c8-55-97	baed9ddd301c424b10fc2dd1d4bbb95e_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	baed9ddd301c424b10fc2dd1d4bbb95e_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	baed9ddd301c424b10fc2dd1d4bbb95e_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	baed9ddd301c424b10fc2dd1d4bbb95e_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	baed9ddd301c424b10fc2dd1d4bbb95e_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F5D3F108-CBEB-4BE1-A595-A906CEDDD0B8}	baed9ddd301c424b10fc2dd1d4bbb95e_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F5D3F108-CBEB-4BE1-A595-A906CEDDD0B8}\WpadDecisionTime = e04ffdee5ec1da01	baed9ddd301c424b10fc2dd1d4bbb95e_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F5D3F108-CBEB-4BE1-A595-A906CEDDD0B8}\WpadDecision = "0"	baed9ddd301c424b10fc2dd1d4bbb95e_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F5D3F108-CBEB-4BE1-A595-A906CEDDD0B8}\WpadNetworkName = "Network 3"	baed9ddd301c424b10fc2dd1d4bbb95e_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	baed9ddd301c424b10fc2dd1d4bbb95e_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	baed9ddd301c424b10fc2dd1d4bbb95e_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c2-b4-d6-c8-55-97	baed9ddd301c424b10fc2dd1d4bbb95e_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c2-b4-d6-c8-55-97\WpadDecision = "0"	baed9ddd301c424b10fc2dd1d4bbb95e_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	baed9ddd301c424b10fc2dd1d4bbb95e_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	baed9ddd301c424b10fc2dd1d4bbb95e_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\baed9ddd301c424b10fc2dd1d4bbb95e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\baed9ddd301c424b10fc2dd1d4bbb95e_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
PID:2220

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
2⤵
- Executes dropped EXE
PID:1544

C:\Users\Admin\AppData\Local\Temp\baed9ddd301c424b10fc2dd1d4bbb95e_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\baed9ddd301c424b10fc2dd1d4bbb95e_JaffaCakes118.exe -m security
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

1

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
6e830e69f0b9364720c8ca0afcf0521f

SHA1
6e086a1b64fa2baa6d44500360fdecb71f1ea24d

SHA256
6fb5b16aa5c7743e40908e8234796e34cdd568d016665dfb48d760a70dc41310

SHA512
edfaaee6713ddbc8fe48c3c1e37e3ba2e363828f936f37494601deac9861233a34ddebdae9e5a92ddc360b45fa1b278be7fc36babb54d690cf9d3e8cd478a2d4

Download Submit

Analysis

Sharing