wannacry | 3f7692fe81d0069acb1dee416aadd65552aa78938cc5ceb0d7a732f14527de69

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09-07-2024 07:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-07-09_d849bfc953519cd76541dc6269ef96c2_wannacry.exe
Size

5.0MB
MD5

d849bfc953519cd76541dc6269ef96c2
SHA1

0eb5bdd954c209d5652461d6e7b22249cb38140a
SHA256

3f7692fe81d0069acb1dee416aadd65552aa78938cc5ceb0d7a732f14527de69
SHA512

b77fdd3a8437f7cbb9f05bf503fce8fe39fb034f2a3e25a5ee9c94524a6d7dec69514e577d71a96b7decc86dbdb09eb4b25a394b99521ed6066539c8447c85ba
SSDEEP

12288:GebLgPlu+QhMbaIMu7L5NVErCA4z2g6rTcbckPU821UEVS87xY:XbLgddQhfdmMSirYbcMLE+

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3146) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 1 IoCs

pid	Process
468	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	2024-07-09_d849bfc953519cd76541dc6269ef96c2_wannacry.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	2024-07-09_d849bfc953519cd76541dc6269ef96c2_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	2024-07-09_d849bfc953519cd76541dc6269ef96c2_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	2024-07-09_d849bfc953519cd76541dc6269ef96c2_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	2024-07-09_d849bfc953519cd76541dc6269ef96c2_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	2024-07-09_d849bfc953519cd76541dc6269ef96c2_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2024-07-09_d849bfc953519cd76541dc6269ef96c2_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2024-07-09_d849bfc953519cd76541dc6269ef96c2_wannacry.exe"
1⤵
- Drops file in Windows directory
PID:2664
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:468

C:\Users\Admin\AppData\Local\Temp\2024-07-09_d849bfc953519cd76541dc6269ef96c2_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2024-07-09_d849bfc953519cd76541dc6269ef96c2_wannacry.exe -m security
1⤵
- Modifies data under HKEY_USERS
PID:3752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
0c688f74fb71e3d51d97c35c5d1c1105

SHA1
121713aa2f1d48d40d25f9d527615e5832474892

SHA256
97df363ac70bb9303ad5867daf511a814c39a468a7cea909c0755df84209a3b4

SHA512
24d8c419a229fa2ba32103796aac8adc2e2a9b367203b4fcf65cf4822a03b6376182a5518b71c2b293b5cae4790f1c82ffdd853fbe55ffe34282be03ccc8ca37

Download Submit