wannacry | 8d7607b2ba9dd68f9518de91003f6c654d8438e1a12e059a6bebeec58d8f609e

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
26/06/2024, 09:42

Target
2024-06-26_068c0b9fb6b450540052b1b0387110ac_wannacry.exe
Size 3.6MB
Sample240626-lpp5tsycpd
SHA256 8d7607b2ba9dd68f9518de91003f6c654d8438e1a12e059a6bebeec58d8f609e
MD5 068c0b9fb6b450540052b1b0387110ac
SHA1 e7d7cc07bcd4748e80d839cda711b629a0a2c70a
SHA512 a8ef25410c419c151eda4bfd6348596364e7904188056dd75d1520847388aac0001b52db5b1cfbcd8ec2a708d40d4a0f24d1df41c877237bb036e499e90c1150
SSDEEP 24576:2bLgdr2XkQk+vbOSSqTPVXmiHkQg6eX6SASk+RdhA:2npk+TSqTdX1HkQo6SAARdh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (2185) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	2024-06-26_068c0b9fb6b450540052b1b0387110ac_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	2024-06-26_068c0b9fb6b450540052b1b0387110ac_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	2024-06-26_068c0b9fb6b450540052b1b0387110ac_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	2024-06-26_068c0b9fb6b450540052b1b0387110ac_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	2024-06-26_068c0b9fb6b450540052b1b0387110ac_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2024-06-26_068c0b9fb6b450540052b1b0387110ac_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-26_068c0b9fb6b450540052b1b0387110ac_wannacry.exe"
1⤵
PID:1796

C:\Users\Admin\AppData\Local\Temp\2024-06-26_068c0b9fb6b450540052b1b0387110ac_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2024-06-26_068c0b9fb6b450540052b1b0387110ac_wannacry.exe -m security
1⤵
- Modifies data under HKEY_USERS
PID:5824

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact