wannacry | fa7ec5ed808379714b63d9825281b1960b3e224fa165956ba2c0aacb967cb5ec

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 09:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-07-01_4b886d44b9596d296881bc90ac59eacf_wannacry.exe
Size

3.6MB
MD5

4b886d44b9596d296881bc90ac59eacf
SHA1

3607bbaa8cc538dc71b6b9471a7fa83db7d82702
SHA256

fa7ec5ed808379714b63d9825281b1960b3e224fa165956ba2c0aacb967cb5ec
SHA512

3d100fa0e38842d85e7bb0bd3c9d63e31eebbb5c8b4d56a01782ccf61603819eb59da472a182c4d7ad8a18b40d2fe572e129b0b61dd0ef5f309b0ef3e3b214b2
SSDEEP

98304:XDqPoBhz1aRxcSUDk36SAEdhvxWa9gtnXRUAeTKwz3Qqgbzh:XDqPe1Cxcxk3ZAEUayXFaKwMt3h

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3211) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Executes dropped EXE 1 IoCs

Processes:

tasksche.exe

pid process

2860 tasksche.exe
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

pid	process
2860	tasksche.exe

Drops file in System32 directory 1 IoCs

Processes:

2024-07-01_4b886d44b9596d296881bc90ac59eacf_wannacry.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	2024-07-01_4b886d44b9596d296881bc90ac59eacf_wannacry.exe

Drops file in Windows directory 1 IoCs

Processes:

2024-07-01_4b886d44b9596d296881bc90ac59eacf_wannacry.exe

description ioc process

File created C:\WINDOWS\tasksche.exe 2024-07-01_4b886d44b9596d296881bc90ac59eacf_wannacry.exe

description	ioc	process
File created	C:\WINDOWS\tasksche.exe	2024-07-01_4b886d44b9596d296881bc90ac59eacf_wannacry.exe

Modifies data under HKEY_USERS 24 IoCs

Processes:

2024-07-01_4b886d44b9596d296881bc90ac59eacf_wannacry.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	2024-07-01_4b886d44b9596d296881bc90ac59eacf_wannacry.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	2024-07-01_4b886d44b9596d296881bc90ac59eacf_wannacry.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	2024-07-01_4b886d44b9596d296881bc90ac59eacf_wannacry.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2C4FD9F4-7F94-4908-9A67-A2A5EDA9EDB1}	2024-07-01_4b886d44b9596d296881bc90ac59eacf_wannacry.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2C4FD9F4-7F94-4908-9A67-A2A5EDA9EDB1}\4e-16-e1-fb-db-a9	2024-07-01_4b886d44b9596d296881bc90ac59eacf_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\4e-16-e1-fb-db-a9\WpadDecision = "0"	2024-07-01_4b886d44b9596d296881bc90ac59eacf_wannacry.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\4e-16-e1-fb-db-a9	2024-07-01_4b886d44b9596d296881bc90ac59eacf_wannacry.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	2024-07-01_4b886d44b9596d296881bc90ac59eacf_wannacry.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	2024-07-01_4b886d44b9596d296881bc90ac59eacf_wannacry.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	2024-07-01_4b886d44b9596d296881bc90ac59eacf_wannacry.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	2024-07-01_4b886d44b9596d296881bc90ac59eacf_wannacry.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	2024-07-01_4b886d44b9596d296881bc90ac59eacf_wannacry.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f016d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	2024-07-01_4b886d44b9596d296881bc90ac59eacf_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2C4FD9F4-7F94-4908-9A67-A2A5EDA9EDB1}\WpadDecision = "0"	2024-07-01_4b886d44b9596d296881bc90ac59eacf_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\4e-16-e1-fb-db-a9\WpadDecisionReason = "1"	2024-07-01_4b886d44b9596d296881bc90ac59eacf_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	2024-07-01_4b886d44b9596d296881bc90ac59eacf_wannacry.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	2024-07-01_4b886d44b9596d296881bc90ac59eacf_wannacry.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2C4FD9F4-7F94-4908-9A67-A2A5EDA9EDB1}\WpadNetworkName = "Network 3"	2024-07-01_4b886d44b9596d296881bc90ac59eacf_wannacry.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\4e-16-e1-fb-db-a9\WpadDecisionTime = b0c2771a99cbda01	2024-07-01_4b886d44b9596d296881bc90ac59eacf_wannacry.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	2024-07-01_4b886d44b9596d296881bc90ac59eacf_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	2024-07-01_4b886d44b9596d296881bc90ac59eacf_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	2024-07-01_4b886d44b9596d296881bc90ac59eacf_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2C4FD9F4-7F94-4908-9A67-A2A5EDA9EDB1}\WpadDecisionReason = "1"	2024-07-01_4b886d44b9596d296881bc90ac59eacf_wannacry.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2C4FD9F4-7F94-4908-9A67-A2A5EDA9EDB1}\WpadDecisionTime = b0c2771a99cbda01	2024-07-01_4b886d44b9596d296881bc90ac59eacf_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2024-07-01_4b886d44b9596d296881bc90ac59eacf_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2024-07-01_4b886d44b9596d296881bc90ac59eacf_wannacry.exe"
1⤵
- Drops file in Windows directory
PID:2168

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
2⤵
- Executes dropped EXE
PID:2860

C:\Users\Admin\AppData\Local\Temp\2024-07-01_4b886d44b9596d296881bc90ac59eacf_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2024-07-01_4b886d44b9596d296881bc90ac59eacf_wannacry.exe -m security
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3012

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe
Filesize
3.4MB

MD5
5ea357f60a8e9f00330383b49b411abf

SHA1
b94918231b025cf02013a0e51c154bb36d2302eb

SHA256
4bb989e6f9cb5bdd31f7f557b5e3f54fd7430ee8738eb134f3704e03ed590da9

SHA512
072a91559bd809e86b716c3a66df00dc2ad5e4effdfbffeaac568c019e087c2a956d03f4b9eb0bb46546c061a0d443434f2919428df72ebe7bacc4fea6344834

Download Submit