wannacry | 505fd4e46d0438e9199696c5f3af11e1fccc249d7d1d0297b3fd1b1633bc2ddd

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220718-en
resource tags

arch:x64arch:x86image:win10v2004-20220718-enlocale:en-usos:windows10-2004-x64system
submitted
19-07-2022 03:19

Target

505fd4e46d0438e9199696c5f3af11e1fccc249d7d1d0297b3fd1b1633bc2ddd.dll
Size

5.0MB
MD5

5a629184d474f6d3bcf2f026a61afec9
SHA1

d7032c0bbd690793b1a7d0072249d3eb6feaab4a
SHA256

505fd4e46d0438e9199696c5f3af11e1fccc249d7d1d0297b3fd1b1633bc2ddd
SHA512

15aa2e10c3b4519cb6eb6cb959c7392597d73d4787b7f6ed0bc2f454fb65280f2291739005047c9dc36020a9ec7f16ea407fa799bbc10c3a47120305be6fa74e

Score

10^/10

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3141) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Executes dropped EXE 2 IoCs

Processes:

mssecsvc.exemssecsvc.exe

pid process

1400 mssecsvc.exe
4980 mssecsvc.exe
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Drops file in Windows directory 2 IoCs

Processes:

rundll32.exemssecsvc.exe

description ioc process

File created C:\WINDOWS\mssecsvc.exe rundll32.exe
File created C:\WINDOWS\tasksche.exe mssecsvc.exe

pid	process
1400	mssecsvc.exe
4980	mssecsvc.exe

description	ioc	process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

mssecsvc.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 3460 wrote to memory of 3816	3460	rundll32.exe	rundll32.exe
PID 3460 wrote to memory of 3816	3460	rundll32.exe	rundll32.exe
PID 3460 wrote to memory of 3816	3460	rundll32.exe	rundll32.exe
PID 3816 wrote to memory of 1400	3816	rundll32.exe	mssecsvc.exe
PID 3816 wrote to memory of 1400	3816	rundll32.exe	mssecsvc.exe
PID 3816 wrote to memory of 1400	3816	rundll32.exe	mssecsvc.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\505fd4e46d0438e9199696c5f3af11e1fccc249d7d1d0297b3fd1b1633bc2ddd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3460

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

C:\WINDOWS\mssecsvc.exe
Filesize
3.6MB

MD5
7b3d6cc2c9d18a2db7449d57b9438997

SHA1
b4ccb027f9a2ef258ce7fe830ba7153722c38530

SHA256
af50fe34abdfc9d72b6153ce7800a39181ab2651451ef050326fb2adf2eb298b

SHA512
6327a0043aae1c1fc5a4c25fe389a09b9dca286ac2fb823045b21e8d8f480d274236155606035117b091901d0117d32341d55fd95fc403e609d752df150cd6a7

Download Submit
C:\Windows\mssecsvc.exe
Filesize
3.6MB

MD5
7b3d6cc2c9d18a2db7449d57b9438997

SHA1
b4ccb027f9a2ef258ce7fe830ba7153722c38530

SHA256
af50fe34abdfc9d72b6153ce7800a39181ab2651451ef050326fb2adf2eb298b

SHA512
6327a0043aae1c1fc5a4c25fe389a09b9dca286ac2fb823045b21e8d8f480d274236155606035117b091901d0117d32341d55fd95fc403e609d752df150cd6a7

Download Submit
C:\Windows\mssecsvc.exe
Filesize
3.6MB

MD5
7b3d6cc2c9d18a2db7449d57b9438997

SHA1
b4ccb027f9a2ef258ce7fe830ba7153722c38530

SHA256
af50fe34abdfc9d72b6153ce7800a39181ab2651451ef050326fb2adf2eb298b

SHA512
6327a0043aae1c1fc5a4c25fe389a09b9dca286ac2fb823045b21e8d8f480d274236155606035117b091901d0117d32341d55fd95fc403e609d752df150cd6a7

Download Submit
memory/1400-131-0x0000000000000000-mapping.dmp

Download
memory/3816-130-0x0000000000000000-mapping.dmp

Download