wannacry | a414c88ea3abea18940a7cfa966006ec106c8194854dca735791340516a6ddbd

Analysis

max time kernel
151s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
resource tags

arch:x64arch:x86image:win10v2004-20220414-enlocale:en-usos:windows10-2004-x64system
submitted
20-07-2022 00:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7f97f07acd6ebae1ae1e25728c8e5718.dll
Size

5.0MB
MD5

7f97f07acd6ebae1ae1e25728c8e5718
SHA1

f0a286bbd4954fa0a3c70cda523b51e3f5a873dd
SHA256

a414c88ea3abea18940a7cfa966006ec106c8194854dca735791340516a6ddbd
SHA512

10b56fdfac0612f72cfbecc274f9b43647fc4658a38cf11af9847a9be140d47861d76481004ac94a41026e3ea772376127ebcd7e6b6add441d9aa93e697c2b6d

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3206) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Executes dropped EXE 3 IoCs

Processes:

mssecsvc.exemssecsvc.exetasksche.exe

pid process

3852 mssecsvc.exe
4660 mssecsvc.exe
3900 tasksche.exe
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Drops file in Windows directory 2 IoCs

Processes:

rundll32.exemssecsvc.exe

description ioc process

File created C:\WINDOWS\mssecsvc.exe rundll32.exe
File created C:\WINDOWS\tasksche.exe mssecsvc.exe

pid	process
3852	mssecsvc.exe
4660	mssecsvc.exe
3900	tasksche.exe

description	ioc	process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

mssecsvc.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1340 wrote to memory of 428	1340	rundll32.exe	rundll32.exe
PID 1340 wrote to memory of 428	1340	rundll32.exe	rundll32.exe
PID 1340 wrote to memory of 428	1340	rundll32.exe	rundll32.exe
PID 428 wrote to memory of 3852	428	rundll32.exe	mssecsvc.exe
PID 428 wrote to memory of 3852	428	rundll32.exe	mssecsvc.exe
PID 428 wrote to memory of 3852	428	rundll32.exe	mssecsvc.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7f97f07acd6ebae1ae1e25728c8e5718.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1340

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7f97f07acd6ebae1ae1e25728c8e5718.dll,#1
2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:428

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe
3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3852

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
4⤵
- Executes dropped EXE
PID:3900

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4660

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\mssecsvc.exe
Filesize
3.6MB

MD5
fdd413bd48b8e870615b57b6d70e919a

SHA1
7b5db8f9695da121ad5ab038a763971c5fac8bdd

SHA256
ab312f2bc2503ae9e62ae95df973f729f13ee5dc923b0a1fe599b490f9a78b2d

SHA512
aa15905f21a790ddbbe8ac0928b955de9bc0f1bc771effdf8e1128ace3de97c53c3f1e3541d17f7a85b7f1afc6b4f5c4828663f24a45a9eab1df7fef25e911f1

Download Submit
C:\Windows\mssecsvc.exe
Filesize
3.6MB

MD5
fdd413bd48b8e870615b57b6d70e919a

SHA1
7b5db8f9695da121ad5ab038a763971c5fac8bdd

SHA256
ab312f2bc2503ae9e62ae95df973f729f13ee5dc923b0a1fe599b490f9a78b2d

SHA512
aa15905f21a790ddbbe8ac0928b955de9bc0f1bc771effdf8e1128ace3de97c53c3f1e3541d17f7a85b7f1afc6b4f5c4828663f24a45a9eab1df7fef25e911f1

Download Submit
C:\Windows\mssecsvc.exe
Filesize
3.6MB

MD5
fdd413bd48b8e870615b57b6d70e919a

SHA1
7b5db8f9695da121ad5ab038a763971c5fac8bdd

SHA256
ab312f2bc2503ae9e62ae95df973f729f13ee5dc923b0a1fe599b490f9a78b2d

SHA512
aa15905f21a790ddbbe8ac0928b955de9bc0f1bc771effdf8e1128ace3de97c53c3f1e3541d17f7a85b7f1afc6b4f5c4828663f24a45a9eab1df7fef25e911f1

Download Submit
C:\Windows\tasksche.exe
Filesize
3.4MB

MD5
3cd12bc33759850852afe8ecdc8ab09f

SHA1
8ed34809398e16f470eca7bc33142be36de7ae44

SHA256
360768fb57d8baa76fe544fb52893bca68f48e07f486263d2a187274cb3548cc

SHA512
0a5702fdfe5576d7da1880a771c99b74e85c01c56d11a65ec0f1a28e27ddba50a0ec23ad596dd4d8249e41a847ce0e9ee8bece9bf4198dd85180b3d61fc6d23a

Download Submit
memory/428-130-0x0000000000000000-mapping.dmp

Download
memory/3852-131-0x0000000000000000-mapping.dmp

Download