wannacry | 4aec93b2e437151c2d618a9dddb37957a27529b6b3577bccd41ee057beac8d67

General

Target

2024-07-01_75b350c8f7e67883d1ba9d71198cef1b_wannacry.exe
Size

5.0MB
MD5

75b350c8f7e67883d1ba9d71198cef1b
SHA1

833a369367059b5ae28542fea0eee425140b70ff
SHA256

4aec93b2e437151c2d618a9dddb37957a27529b6b3577bccd41ee057beac8d67
SHA512

cc08357d1bb621ec3bcb1f7d0055dd52c477f70327377f0aec9767281318a0c6c37294d15f7d59ab3cbe39fd589d9a11f8ae8f3983c78d5a72f2af634a1fa660
SSDEEP

49152:2nAQqMSPTx+TSqTdX1HkQo6SAARdhnvxJM0H9PAMEcaEau3R8yAH:yDqPTxcSUDk36SAEdhvxWa9P593R8yA

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3131) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 1 IoCs

pid	Process
1416	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	2024-07-01_75b350c8f7e67883d1ba9d71198cef1b_wannacry.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	2024-07-01_75b350c8f7e67883d1ba9d71198cef1b_wannacry.exe

Modifies data under HKEY_USERS 24 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	2024-07-01_75b350c8f7e67883d1ba9d71198cef1b_wannacry.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{341031A7-7D60-4E5E-AA7E-E4E789E95128}\WpadDecisionTime = 7044655aa7cbda01	2024-07-01_75b350c8f7e67883d1ba9d71198cef1b_wannacry.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ba-2d-a6-de-1c-17\WpadDecisionTime = 7044655aa7cbda01	2024-07-01_75b350c8f7e67883d1ba9d71198cef1b_wannacry.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	2024-07-01_75b350c8f7e67883d1ba9d71198cef1b_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	2024-07-01_75b350c8f7e67883d1ba9d71198cef1b_wannacry.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	2024-07-01_75b350c8f7e67883d1ba9d71198cef1b_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	2024-07-01_75b350c8f7e67883d1ba9d71198cef1b_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ba-2d-a6-de-1c-17\WpadDecision = "0"	2024-07-01_75b350c8f7e67883d1ba9d71198cef1b_wannacry.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	2024-07-01_75b350c8f7e67883d1ba9d71198cef1b_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	2024-07-01_75b350c8f7e67883d1ba9d71198cef1b_wannacry.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	2024-07-01_75b350c8f7e67883d1ba9d71198cef1b_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{341031A7-7D60-4E5E-AA7E-E4E789E95128}\WpadDecisionReason = "1"	2024-07-01_75b350c8f7e67883d1ba9d71198cef1b_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{341031A7-7D60-4E5E-AA7E-E4E789E95128}\WpadDecision = "0"	2024-07-01_75b350c8f7e67883d1ba9d71198cef1b_wannacry.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{341031A7-7D60-4E5E-AA7E-E4E789E95128}\ba-2d-a6-de-1c-17	2024-07-01_75b350c8f7e67883d1ba9d71198cef1b_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ba-2d-a6-de-1c-17\WpadDecisionReason = "1"	2024-07-01_75b350c8f7e67883d1ba9d71198cef1b_wannacry.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	2024-07-01_75b350c8f7e67883d1ba9d71198cef1b_wannacry.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	2024-07-01_75b350c8f7e67883d1ba9d71198cef1b_wannacry.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	2024-07-01_75b350c8f7e67883d1ba9d71198cef1b_wannacry.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0044000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	2024-07-01_75b350c8f7e67883d1ba9d71198cef1b_wannacry.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ba-2d-a6-de-1c-17	2024-07-01_75b350c8f7e67883d1ba9d71198cef1b_wannacry.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	2024-07-01_75b350c8f7e67883d1ba9d71198cef1b_wannacry.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	2024-07-01_75b350c8f7e67883d1ba9d71198cef1b_wannacry.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{341031A7-7D60-4E5E-AA7E-E4E789E95128}	2024-07-01_75b350c8f7e67883d1ba9d71198cef1b_wannacry.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{341031A7-7D60-4E5E-AA7E-E4E789E95128}\WpadNetworkName = "Network 3"	2024-07-01_75b350c8f7e67883d1ba9d71198cef1b_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2024-07-01_75b350c8f7e67883d1ba9d71198cef1b_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2024-07-01_75b350c8f7e67883d1ba9d71198cef1b_wannacry.exe"
1⤵
- Drops file in Windows directory
PID:2316
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:1416

C:\Users\Admin\AppData\Local\Temp\2024-07-01_75b350c8f7e67883d1ba9d71198cef1b_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2024-07-01_75b350c8f7e67883d1ba9d71198cef1b_wannacry.exe -m security
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

2

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
7f1cd7f071ee1e55b6d10990c31bdc14

SHA1
c8848b84a15bf538ca7ecefcf362ddb4e11b4a43

SHA256
83f9c04a45f3be7cd72e98089ca121bdedaa49f7c45f84df915fdcea970a0245

SHA512
f76f7244cf78f0623ac3284694854d99cad5c9e86a2efc591c053f50e0f0c48aaff59abe873cf665d04d4fbdb8b252eeebee8ae79e95ce44f2e5bac4e27b61f9

Download Submit

Resubmissions

Analysis

Sharing