wannacry | 8d7607b2ba9dd68f9518de91003f6c654d8438e1a12e059a6bebeec58d8f609e

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
26-06-2024 09:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-26_068c0b9fb6b450540052b1b0387110ac_wannacry.exe
Size

3.6MB
MD5

068c0b9fb6b450540052b1b0387110ac
SHA1

e7d7cc07bcd4748e80d839cda711b629a0a2c70a
SHA256

8d7607b2ba9dd68f9518de91003f6c654d8438e1a12e059a6bebeec58d8f609e
SHA512

a8ef25410c419c151eda4bfd6348596364e7904188056dd75d1520847388aac0001b52db5b1cfbcd8ec2a708d40d4a0f24d1df41c877237bb036e499e90c1150
SSDEEP

24576:2bLgdr2XkQk+vbOSSqTPVXmiHkQg6eX6SASk+RdhA:2npk+TSqTdX1HkQo6SAARdh

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (2185) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Modifies data under HKEY_USERS 5 IoCs

Processes:

2024-06-26_068c0b9fb6b450540052b1b0387110ac_wannacry.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	2024-06-26_068c0b9fb6b450540052b1b0387110ac_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	2024-06-26_068c0b9fb6b450540052b1b0387110ac_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	2024-06-26_068c0b9fb6b450540052b1b0387110ac_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	2024-06-26_068c0b9fb6b450540052b1b0387110ac_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	2024-06-26_068c0b9fb6b450540052b1b0387110ac_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2024-06-26_068c0b9fb6b450540052b1b0387110ac_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-26_068c0b9fb6b450540052b1b0387110ac_wannacry.exe"
1⤵
PID:1796

C:\Users\Admin\AppData\Local\Temp\2024-06-26_068c0b9fb6b450540052b1b0387110ac_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2024-06-26_068c0b9fb6b450540052b1b0387110ac_wannacry.exe -m security
1⤵
- Modifies data under HKEY_USERS
PID:5824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads