wannacry | 2a62c57ba98308fe2316508f077186b76e5ad55a1e367e58d19e5a9b08900eec

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 09:21

Target
2a62c57ba98308fe2316508f077186b76e5ad55a1e367e58d19e5a9b08900eec.exe
Size 2.2MB
Sample240713-lbkcesxdpf
SHA256 2a62c57ba98308fe2316508f077186b76e5ad55a1e367e58d19e5a9b08900eec
MD5 da8dde3005365992711946c4622a3c74
SHA1 d04042cd11cd11f3b6386a5e2275f14b92048fc6
SHA512 a06f8a53e5cd7e80429c2d7339f0c7d78a1d384da2fccb23a0cee5c7e9f39dbe3e73bac0ee271b84f3cfa8a545a57bcf592446666b6381397df20beb644a77e7
SSDEEP 49152:QnaMSPbcBVQej/1INMx+TSqTdX1H76SAARdhn:QaPoBhz1aMxcSUD76SAEdh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (2126) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	2a62c57ba98308fe2316508f077186b76e5ad55a1e367e58d19e5a9b08900eec.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	2a62c57ba98308fe2316508f077186b76e5ad55a1e367e58d19e5a9b08900eec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	2a62c57ba98308fe2316508f077186b76e5ad55a1e367e58d19e5a9b08900eec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	2a62c57ba98308fe2316508f077186b76e5ad55a1e367e58d19e5a9b08900eec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	2a62c57ba98308fe2316508f077186b76e5ad55a1e367e58d19e5a9b08900eec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	2a62c57ba98308fe2316508f077186b76e5ad55a1e367e58d19e5a9b08900eec.exe

C:\Users\Admin\AppData\Local\Temp\2a62c57ba98308fe2316508f077186b76e5ad55a1e367e58d19e5a9b08900eec.exe
"C:\Users\Admin\AppData\Local\Temp\2a62c57ba98308fe2316508f077186b76e5ad55a1e367e58d19e5a9b08900eec.exe"
1⤵
- Drops file in Windows directory
PID:4364

C:\Users\Admin\AppData\Local\Temp\2a62c57ba98308fe2316508f077186b76e5ad55a1e367e58d19e5a9b08900eec.exe
C:\Users\Admin\AppData\Local\Temp\2a62c57ba98308fe2316508f077186b76e5ad55a1e367e58d19e5a9b08900eec.exe -m security
1⤵
- Modifies data under HKEY_USERS
PID:4700

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact