wannacry | 190dc8bbf160ad52059047cdcac0eda73e6a9d8119d6b42d57cf33a35df83fec

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220718-en
resource tags

arch:x64arch:x86image:win10v2004-20220718-enlocale:en-usos:windows10-2004-x64system
submitted
19-07-2022 23:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5e9c5a51094fa1c3d88fd30cd5c4934c.dll
Size

5.0MB
MD5

5e9c5a51094fa1c3d88fd30cd5c4934c
SHA1

c89cf3fa904e833856d809a7117e3a33b34c90f6
SHA256

190dc8bbf160ad52059047cdcac0eda73e6a9d8119d6b42d57cf33a35df83fec
SHA512

5417ded155fb88be401ee13addbf8f0f28915deaab9e76850db6b42a5e56e174c0efe994138f2389c11c3908877cc06034b581a7a33a54e8250b687f7a384a76

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (2650) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Executes dropped EXE 3 IoCs

Processes:

mssecsvc.exemssecsvc.exetasksche.exe

pid process

4792 mssecsvc.exe
3116 mssecsvc.exe
3180 tasksche.exe
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Drops file in Windows directory 2 IoCs

Processes:

rundll32.exemssecsvc.exe

description ioc process

File created C:\WINDOWS\mssecsvc.exe rundll32.exe
File created C:\WINDOWS\tasksche.exe mssecsvc.exe

pid	process
4792	mssecsvc.exe
3116	mssecsvc.exe
3180	tasksche.exe

description	ioc	process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

mssecsvc.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 3432 wrote to memory of 3436	3432	rundll32.exe	rundll32.exe
PID 3432 wrote to memory of 3436	3432	rundll32.exe	rundll32.exe
PID 3432 wrote to memory of 3436	3432	rundll32.exe	rundll32.exe
PID 3436 wrote to memory of 4792	3436	rundll32.exe	mssecsvc.exe
PID 3436 wrote to memory of 4792	3436	rundll32.exe	mssecsvc.exe
PID 3436 wrote to memory of 4792	3436	rundll32.exe	mssecsvc.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e9c5a51094fa1c3d88fd30cd5c4934c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3432

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e9c5a51094fa1c3d88fd30cd5c4934c.dll,#1
2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3436

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe
3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4792

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
4⤵
- Executes dropped EXE
PID:3180

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:3116

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\mssecsvc.exe
Filesize
3.6MB

MD5
e6a5f18d9fb21a5f0272657404773dd7

SHA1
3d5cae9c2f57b32788d8e046857bf19933622b2c

SHA256
df06a81ec30ecafa9cda12fd568134dbda4d28902d4278164d3d60dbd1281cdc

SHA512
4710d55a450da50b2e2138494b6e8161c263c3047f3477f18add5ca8e72c5637d17e268c326d1eec49ba0ca281ed1adda4739a997958dacf64bdbb0b0015355f

Download Submit
C:\Windows\mssecsvc.exe
Filesize
3.6MB

MD5
e6a5f18d9fb21a5f0272657404773dd7

SHA1
3d5cae9c2f57b32788d8e046857bf19933622b2c

SHA256
df06a81ec30ecafa9cda12fd568134dbda4d28902d4278164d3d60dbd1281cdc

SHA512
4710d55a450da50b2e2138494b6e8161c263c3047f3477f18add5ca8e72c5637d17e268c326d1eec49ba0ca281ed1adda4739a997958dacf64bdbb0b0015355f

Download Submit
C:\Windows\mssecsvc.exe
Filesize
3.6MB

MD5
e6a5f18d9fb21a5f0272657404773dd7

SHA1
3d5cae9c2f57b32788d8e046857bf19933622b2c

SHA256
df06a81ec30ecafa9cda12fd568134dbda4d28902d4278164d3d60dbd1281cdc

SHA512
4710d55a450da50b2e2138494b6e8161c263c3047f3477f18add5ca8e72c5637d17e268c326d1eec49ba0ca281ed1adda4739a997958dacf64bdbb0b0015355f

Download Submit
C:\Windows\tasksche.exe
Filesize
3.4MB

MD5
e53eca70af35bcd7f7afd4dcc3f49dae

SHA1
bdf8f0c559ba71c0e66c06164768573c33d0e774

SHA256
b18fb7c3a78546b005e0d6efe496168181c4d9ba8a03d75508f94990d021f016

SHA512
e6e113fc4d454f2756d3611db8c32f1f7491414a42341bfddc709b634180adf903125f14f1e31300afa552afba17edef8e323643c47579eabef1aae7aae2ade8

Download Submit
memory/3436-130-0x0000000000000000-mapping.dmp

Download
memory/4792-131-0x0000000000000000-mapping.dmp

Download