wannacry | e0bb2977e9d0f4e8f59b966634f89727a5ebe103adb4c9f5e59a0318fea18529

General

Target

2024-06-20_f8f8a7957a6842794bd956c655e72e1c_wannacry.exe
Size

5.0MB
MD5

f8f8a7957a6842794bd956c655e72e1c
SHA1

682f3a12d043fa17546e6d45e99e82c8c1ef997d
SHA256

e0bb2977e9d0f4e8f59b966634f89727a5ebe103adb4c9f5e59a0318fea18529
SHA512

baf7437a783a83e022eee017a153f39d76332a39a83cc1a323b17d1808da0719c100ef70d69611997d7baa156eb1fb63dd47f33f202ad99b2a11048dd7b57912
SSDEEP

24576:2bLgddQhfdmMSirYbcMNgef0VeX6SASk+Kdq:2nAQqMSPbcBVU6SAA

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (2670) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Executes dropped EXE 1 IoCs

Processes:

tasksche.exe

pid process

2180 tasksche.exe

pid	process
2180	tasksche.exe

Drops file in System32 directory 1 IoCs

Processes:

2024-06-20_f8f8a7957a6842794bd956c655e72e1c_wannacry.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	2024-06-20_f8f8a7957a6842794bd956c655e72e1c_wannacry.exe

Drops file in Windows directory 1 IoCs

Processes:

2024-06-20_f8f8a7957a6842794bd956c655e72e1c_wannacry.exe

description ioc process

File created C:\WINDOWS\tasksche.exe 2024-06-20_f8f8a7957a6842794bd956c655e72e1c_wannacry.exe

description	ioc	process
File created	C:\WINDOWS\tasksche.exe	2024-06-20_f8f8a7957a6842794bd956c655e72e1c_wannacry.exe

Modifies data under HKEY_USERS 24 IoCs

Processes:

2024-06-20_f8f8a7957a6842794bd956c655e72e1c_wannacry.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	2024-06-20_f8f8a7957a6842794bd956c655e72e1c_wannacry.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	2024-06-20_f8f8a7957a6842794bd956c655e72e1c_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	2024-06-20_f8f8a7957a6842794bd956c655e72e1c_wannacry.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	2024-06-20_f8f8a7957a6842794bd956c655e72e1c_wannacry.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	2024-06-20_f8f8a7957a6842794bd956c655e72e1c_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9A29B2ED-1562-4373-9DEC-E6F33554AD41}\WpadDecision = "0"	2024-06-20_f8f8a7957a6842794bd956c655e72e1c_wannacry.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	2024-06-20_f8f8a7957a6842794bd956c655e72e1c_wannacry.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9A29B2ED-1562-4373-9DEC-E6F33554AD41}	2024-06-20_f8f8a7957a6842794bd956c655e72e1c_wannacry.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9A29B2ED-1562-4373-9DEC-E6F33554AD41}\WpadDecisionTime = 602b76df15c3da01	2024-06-20_f8f8a7957a6842794bd956c655e72e1c_wannacry.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9A29B2ED-1562-4373-9DEC-E6F33554AD41}\WpadNetworkName = "Network 3"	2024-06-20_f8f8a7957a6842794bd956c655e72e1c_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7e-13-bd-1f-4c-7f\WpadDecisionReason = "1"	2024-06-20_f8f8a7957a6842794bd956c655e72e1c_wannacry.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	2024-06-20_f8f8a7957a6842794bd956c655e72e1c_wannacry.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	2024-06-20_f8f8a7957a6842794bd956c655e72e1c_wannacry.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	2024-06-20_f8f8a7957a6842794bd956c655e72e1c_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	2024-06-20_f8f8a7957a6842794bd956c655e72e1c_wannacry.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	2024-06-20_f8f8a7957a6842794bd956c655e72e1c_wannacry.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	2024-06-20_f8f8a7957a6842794bd956c655e72e1c_wannacry.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7e-13-bd-1f-4c-7f	2024-06-20_f8f8a7957a6842794bd956c655e72e1c_wannacry.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9A29B2ED-1562-4373-9DEC-E6F33554AD41}\7e-13-bd-1f-4c-7f	2024-06-20_f8f8a7957a6842794bd956c655e72e1c_wannacry.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	2024-06-20_f8f8a7957a6842794bd956c655e72e1c_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9A29B2ED-1562-4373-9DEC-E6F33554AD41}\WpadDecisionReason = "1"	2024-06-20_f8f8a7957a6842794bd956c655e72e1c_wannacry.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7e-13-bd-1f-4c-7f\WpadDecisionTime = 602b76df15c3da01	2024-06-20_f8f8a7957a6842794bd956c655e72e1c_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7e-13-bd-1f-4c-7f\WpadDecision = "0"	2024-06-20_f8f8a7957a6842794bd956c655e72e1c_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	2024-06-20_f8f8a7957a6842794bd956c655e72e1c_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2024-06-20_f8f8a7957a6842794bd956c655e72e1c_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-20_f8f8a7957a6842794bd956c655e72e1c_wannacry.exe"
1⤵
- Drops file in Windows directory
PID:1988

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
2⤵
- Executes dropped EXE
PID:2180

C:\Users\Admin\AppData\Local\Temp\2024-06-20_f8f8a7957a6842794bd956c655e72e1c_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2024-06-20_f8f8a7957a6842794bd956c655e72e1c_wannacry.exe -m security
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

1

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
7c7c44a14f6185bf618b8c0050346540

SHA1
049bb662416f3417cf0cca001e43b4f42d61cb57

SHA256
971717c71f0c184ab016cb1307d0e583eef27a70107f81169b8d8e67c08782ff

SHA512
01e518a6f8fd7350052b2a5fb9af69d2a503c40cc9b9e86bbb5e80165b79e77a4f26822a39384afe93acef45a52ce7018e6e2678c277afdcd802a76a8238c263

Download Submit

Resubmissions

Analysis

Sharing