wannacry | 138887bdba248dab37aaa98cf2d7f06445b8018a24a9a2ffeb70da5a1d1be038

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220718-en
resource tags

arch:x64arch:x86image:win10v2004-20220718-enlocale:en-usos:windows10-2004-x64system
submitted
19-07-2022 23:33

Target

163776387e17b3608a6db423bbe4fc3f.dll
Size

5.0MB
MD5

163776387e17b3608a6db423bbe4fc3f
SHA1

c8253055cfea721a094548665363c268f25b27cb
SHA256

138887bdba248dab37aaa98cf2d7f06445b8018a24a9a2ffeb70da5a1d1be038
SHA512

02649642b7ad60317dd861538b0a0fe0cfe36d2d07e751445f5bbed0769a76c73da7e8a34c7abb47851a6998efd7dd8c95cd62c4460a0006c1d952dc48418f89

Score

10^/10

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (2068) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Executes dropped EXE 2 IoCs

Processes:

mssecsvc.exemssecsvc.exe

pid process

3532 mssecsvc.exe
4628 mssecsvc.exe
Drops file in Windows directory 2 IoCs

Processes:

rundll32.exemssecsvc.exe

description ioc process

File created C:\WINDOWS\mssecsvc.exe rundll32.exe
File created C:\WINDOWS\tasksche.exe mssecsvc.exe

pid	process
3532	mssecsvc.exe
4628	mssecsvc.exe

description	ioc	process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

mssecsvc.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 4208 wrote to memory of 764	4208	rundll32.exe	rundll32.exe
PID 4208 wrote to memory of 764	4208	rundll32.exe	rundll32.exe
PID 4208 wrote to memory of 764	4208	rundll32.exe	rundll32.exe
PID 764 wrote to memory of 3532	764	rundll32.exe	mssecsvc.exe
PID 764 wrote to memory of 3532	764	rundll32.exe	mssecsvc.exe
PID 764 wrote to memory of 3532	764	rundll32.exe	mssecsvc.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\163776387e17b3608a6db423bbe4fc3f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4208

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

C:\WINDOWS\mssecsvc.exe
Filesize
3.6MB

MD5
97482e7b16e42ed8c505a99a926a56cc

SHA1
080f06ca9c603df1447232f223a290d0e736d354

SHA256
0ccbddd39d86453355f3090740adc3e65bf7a1765a71d86b72b235f2ae8357c6

SHA512
8c5439b7387eb0f8a8cd51f06e751201d5621ce79a9d7ba5b8f28bdc03f6b9bc10a99216ee84e65495bdfcf4a8057bbb32ad8f34002eb4679bafcd6b2c35a244

Download Submit
C:\Windows\mssecsvc.exe
Filesize
3.6MB

MD5
97482e7b16e42ed8c505a99a926a56cc

SHA1
080f06ca9c603df1447232f223a290d0e736d354

SHA256
0ccbddd39d86453355f3090740adc3e65bf7a1765a71d86b72b235f2ae8357c6

SHA512
8c5439b7387eb0f8a8cd51f06e751201d5621ce79a9d7ba5b8f28bdc03f6b9bc10a99216ee84e65495bdfcf4a8057bbb32ad8f34002eb4679bafcd6b2c35a244

Download Submit
C:\Windows\mssecsvc.exe
Filesize
3.6MB

MD5
97482e7b16e42ed8c505a99a926a56cc

SHA1
080f06ca9c603df1447232f223a290d0e736d354

SHA256
0ccbddd39d86453355f3090740adc3e65bf7a1765a71d86b72b235f2ae8357c6

SHA512
8c5439b7387eb0f8a8cd51f06e751201d5621ce79a9d7ba5b8f28bdc03f6b9bc10a99216ee84e65495bdfcf4a8057bbb32ad8f34002eb4679bafcd6b2c35a244

Download Submit
memory/764-130-0x0000000000000000-mapping.dmp

Download
memory/3532-131-0x0000000000000000-mapping.dmp

Download