wannacry | 4641216ac5970ad74ae3d73cc81b430657a8c2cd4bb2637bd5a600153e2af56b

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 11:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-28_dd9faac1734f49e66f76397a2eb995ff_wannacry.exe
Size

5.0MB
MD5

dd9faac1734f49e66f76397a2eb995ff
SHA1

0eaf09665b99951f67660e3a94bccdd285fcffa8
SHA256

4641216ac5970ad74ae3d73cc81b430657a8c2cd4bb2637bd5a600153e2af56b
SHA512

bc256348512e93e7a4130ff749ceb3f48267ad51d44a7e959c46ab16368d4b5d709a8ee15fb372ef5a2706676f3bfee55b9dd642a04a8ef055186ed3d723860d
SSDEEP

98304:XDqPoBhz1aRxcSUDk36SAEdhvxWa9gtnXRUAeTKwz3Qqgbz:XDqPe1Cxcxk3ZAEUayXFaKwMt3

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (2689) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 1 IoCs

pid	Process
4884	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	2024-06-28_dd9faac1734f49e66f76397a2eb995ff_wannacry.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	2024-06-28_dd9faac1734f49e66f76397a2eb995ff_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	2024-06-28_dd9faac1734f49e66f76397a2eb995ff_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	2024-06-28_dd9faac1734f49e66f76397a2eb995ff_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	2024-06-28_dd9faac1734f49e66f76397a2eb995ff_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	2024-06-28_dd9faac1734f49e66f76397a2eb995ff_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2024-06-28_dd9faac1734f49e66f76397a2eb995ff_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-28_dd9faac1734f49e66f76397a2eb995ff_wannacry.exe"
1⤵
- Drops file in Windows directory
PID:4368
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:4884

C:\Users\Admin\AppData\Local\Temp\2024-06-28_dd9faac1734f49e66f76397a2eb995ff_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2024-06-28_dd9faac1734f49e66f76397a2eb995ff_wannacry.exe -m security
1⤵
- Modifies data under HKEY_USERS
PID:4236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
5ea357f60a8e9f00330383b49b411abf

SHA1
b94918231b025cf02013a0e51c154bb36d2302eb

SHA256
4bb989e6f9cb5bdd31f7f557b5e3f54fd7430ee8738eb134f3704e03ed590da9

SHA512
072a91559bd809e86b716c3a66df00dc2ad5e4effdfbffeaac568c019e087c2a956d03f4b9eb0bb46546c061a0d443434f2919428df72ebe7bacc4fea6344834

Download Submit