Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 10:35
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-01_71bc18c511a89c5ea61af1c0ac9c4357_wannacry.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-07-01_71bc18c511a89c5ea61af1c0ac9c4357_wannacry.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-07-01_71bc18c511a89c5ea61af1c0ac9c4357_wannacry.exe
-
Size
5.0MB
-
MD5
71bc18c511a89c5ea61af1c0ac9c4357
-
SHA1
67058e5304d37422a48fd409b35e195b3eac379b
-
SHA256
a6b3ad3e3d52a6ae63ad863bb18165521b956ef47a3ec4505e678633e782761c
-
SHA512
60d92a3a3a085b15af143907d5160657313df996983e7b301a9e47c79f000df8333cc9d9fb9aeff56340688780ea1d291f1a1a27b1d1343a0976953dfc7b0dd4
-
SSDEEP
49152:2ntQNMSPbcBVQej/1INRx+TSqTdX1HkQo6SAMn9ArNx5Fo2Fih1r5y:y2NPoBhz1aRxcSUDk36SA
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (2150) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 1 IoCs
Processes:
tasksche.exepid process 2428 tasksche.exe -
Drops file in System32 directory 1 IoCs
Processes:
2024-07-01_71bc18c511a89c5ea61af1c0ac9c4357_wannacry.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat 2024-07-01_71bc18c511a89c5ea61af1c0ac9c4357_wannacry.exe -
Drops file in Windows directory 1 IoCs
Processes:
2024-07-01_71bc18c511a89c5ea61af1c0ac9c4357_wannacry.exedescription ioc process File created C:\WINDOWS\tasksche.exe 2024-07-01_71bc18c511a89c5ea61af1c0ac9c4357_wannacry.exe -
Modifies data under HKEY_USERS 24 IoCs
Processes:
2024-07-01_71bc18c511a89c5ea61af1c0ac9c4357_wannacry.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings 2024-07-01_71bc18c511a89c5ea61af1c0ac9c4357_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" 2024-07-01_71bc18c511a89c5ea61af1c0ac9c4357_wannacry.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00e1000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 2024-07-01_71bc18c511a89c5ea61af1c0ac9c4357_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3E403E90-F009-4033-8306-D831E368A89F} 2024-07-01_71bc18c511a89c5ea61af1c0ac9c4357_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\16-7c-e5-e2-85-ce\WpadDecisionReason = "1" 2024-07-01_71bc18c511a89c5ea61af1c0ac9c4357_wannacry.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\16-7c-e5-e2-85-ce\WpadDecisionTime = a05ad68ea2cbda01 2024-07-01_71bc18c511a89c5ea61af1c0ac9c4357_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections 2024-07-01_71bc18c511a89c5ea61af1c0ac9c4357_wannacry.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 2024-07-01_71bc18c511a89c5ea61af1c0ac9c4357_wannacry.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 2024-07-01_71bc18c511a89c5ea61af1c0ac9c4357_wannacry.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 2024-07-01_71bc18c511a89c5ea61af1c0ac9c4357_wannacry.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 2024-07-01_71bc18c511a89c5ea61af1c0ac9c4357_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad 2024-07-01_71bc18c511a89c5ea61af1c0ac9c4357_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3E403E90-F009-4033-8306-D831E368A89F}\WpadDecisionReason = "1" 2024-07-01_71bc18c511a89c5ea61af1c0ac9c4357_wannacry.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3E403E90-F009-4033-8306-D831E368A89F}\WpadDecisionTime = a05ad68ea2cbda01 2024-07-01_71bc18c511a89c5ea61af1c0ac9c4357_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3E403E90-F009-4033-8306-D831E368A89F}\WpadDecision = "0" 2024-07-01_71bc18c511a89c5ea61af1c0ac9c4357_wannacry.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3E403E90-F009-4033-8306-D831E368A89F}\WpadNetworkName = "Network 3" 2024-07-01_71bc18c511a89c5ea61af1c0ac9c4357_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\16-7c-e5-e2-85-ce\WpadDecision = "0" 2024-07-01_71bc18c511a89c5ea61af1c0ac9c4357_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings 2024-07-01_71bc18c511a89c5ea61af1c0ac9c4357_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" 2024-07-01_71bc18c511a89c5ea61af1c0ac9c4357_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 2024-07-01_71bc18c511a89c5ea61af1c0ac9c4357_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" 2024-07-01_71bc18c511a89c5ea61af1c0ac9c4357_wannacry.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 2024-07-01_71bc18c511a89c5ea61af1c0ac9c4357_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\16-7c-e5-e2-85-ce 2024-07-01_71bc18c511a89c5ea61af1c0ac9c4357_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3E403E90-F009-4033-8306-D831E368A89F}\16-7c-e5-e2-85-ce 2024-07-01_71bc18c511a89c5ea61af1c0ac9c4357_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-01_71bc18c511a89c5ea61af1c0ac9c4357_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-01_71bc18c511a89c5ea61af1c0ac9c4357_wannacry.exe"1⤵
- Drops file in Windows directory
-
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\2024-07-01_71bc18c511a89c5ea61af1c0ac9c4357_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2024-07-01_71bc18c511a89c5ea61af1c0ac9c4357_wannacry.exe -m security1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\tasksche.exeFilesize
3.4MB
MD5aa3fe425600242348d960c1efed8c062
SHA11f4ccdfed84a35c71d025a6b7d3fb058b5424697
SHA256e6d711bfe035f1806900d613de4f6bc6f19aa6bd8e43c173d1763bb94fc0bb4a
SHA512e78046c036e171712ed79c1cc72a5359f458279b5925df7d8409c972f9dc5c62e34d6df20c0daafa12685dc66491ffca5f800d2b24f8ba2843c913b9be9a1292