wannacry | 8d7960d4c8943d901f5e435bcc4406027ba814733b0b3c2e16f8b265df83dd53

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220718-en
resource tags

arch:x64arch:x86image:win10v2004-20220718-enlocale:en-usos:windows10-2004-x64system
submitted
20-07-2022 00:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ecce5039634ff774782109f78831fab2.dll
Size

5.0MB
MD5

ecce5039634ff774782109f78831fab2
SHA1

201cf971c2c4aa8e99121ccc1b4f403730d0ade8
SHA256

8d7960d4c8943d901f5e435bcc4406027ba814733b0b3c2e16f8b265df83dd53
SHA512

3ee99d676596885435f616e13dcb356e2f5d7733da8387ae780f32a86179b4cfb721525f789af4d2fa6f3ad7bd6204b1885a0a06c9f9bb84bc2ece54c3351ec7

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3140) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Executes dropped EXE 3 IoCs

Processes:

mssecsvc.exemssecsvc.exetasksche.exe

pid process

1420 mssecsvc.exe
1620 mssecsvc.exe
3408 tasksche.exe
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Drops file in Windows directory 2 IoCs

Processes:

rundll32.exemssecsvc.exe

description ioc process

File created C:\WINDOWS\mssecsvc.exe rundll32.exe
File created C:\WINDOWS\tasksche.exe mssecsvc.exe

pid	process
1420	mssecsvc.exe
1620	mssecsvc.exe
3408	tasksche.exe

description	ioc	process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

mssecsvc.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 3428 wrote to memory of 3732	3428	rundll32.exe	rundll32.exe
PID 3428 wrote to memory of 3732	3428	rundll32.exe	rundll32.exe
PID 3428 wrote to memory of 3732	3428	rundll32.exe	rundll32.exe
PID 3732 wrote to memory of 1420	3732	rundll32.exe	mssecsvc.exe
PID 3732 wrote to memory of 1420	3732	rundll32.exe	mssecsvc.exe
PID 3732 wrote to memory of 1420	3732	rundll32.exe	mssecsvc.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ecce5039634ff774782109f78831fab2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3428

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ecce5039634ff774782109f78831fab2.dll,#1
2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3732

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe
3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1420

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
4⤵
- Executes dropped EXE
PID:3408

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:1620

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\mssecsvc.exe
Filesize
3.6MB

MD5
a425528f249d2888378de9f8300af9cb

SHA1
d4987b17422d3ab83307a8358d1749a717d3fd1b

SHA256
4306cb0038e00851ab6c9989adfcf5c9ea9107a4fb3552dc9d7732622c1111af

SHA512
f749b65cc8c0bcb9cbf5c5219f25ceb713f239c716cb6a2ba373e2cd2613bdb92818c6e0b907bf4f9d5c8a31598e306ca4f966eff4e492bb05ac40301fb20617

Download Submit
C:\Windows\mssecsvc.exe
Filesize
3.6MB

MD5
a425528f249d2888378de9f8300af9cb

SHA1
d4987b17422d3ab83307a8358d1749a717d3fd1b

SHA256
4306cb0038e00851ab6c9989adfcf5c9ea9107a4fb3552dc9d7732622c1111af

SHA512
f749b65cc8c0bcb9cbf5c5219f25ceb713f239c716cb6a2ba373e2cd2613bdb92818c6e0b907bf4f9d5c8a31598e306ca4f966eff4e492bb05ac40301fb20617

Download Submit
C:\Windows\mssecsvc.exe
Filesize
3.6MB

MD5
a425528f249d2888378de9f8300af9cb

SHA1
d4987b17422d3ab83307a8358d1749a717d3fd1b

SHA256
4306cb0038e00851ab6c9989adfcf5c9ea9107a4fb3552dc9d7732622c1111af

SHA512
f749b65cc8c0bcb9cbf5c5219f25ceb713f239c716cb6a2ba373e2cd2613bdb92818c6e0b907bf4f9d5c8a31598e306ca4f966eff4e492bb05ac40301fb20617

Download Submit
C:\Windows\tasksche.exe
Filesize
3.4MB

MD5
79bc33ad0c61b11edca10c373137ace7

SHA1
5c56289d0fdb2391f8c36c5fcca1085ab28f8b52

SHA256
f9fdf806b56b1b71fcab1613d3c1761bdae006d432e3508bd16a6b04e092320f

SHA512
7acffdbe1435fe45108010c4dfc6150d44b66e04df533d749276912ece7a9724e87b10e9c71c6da4b84d80712126d7775dd34cb5d72eb02f13cadbc35ca5d0c5

Download Submit
memory/1420-131-0x0000000000000000-mapping.dmp

Download
memory/3732-130-0x0000000000000000-mapping.dmp

Download