wannacry | 623d15ba5658384ea5a60431603eddfe363c3edd4eb45ecbe62afe3c625e3d35

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220718-en
resource tags

arch:x64arch:x86image:win10v2004-20220718-enlocale:en-usos:windows10-2004-x64system
submitted
20-07-2022 00:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4e221caf0f5a010f819d0d07cfe19aeb.dll
Size

5.0MB
MD5

4e221caf0f5a010f819d0d07cfe19aeb
SHA1

d66ef7acbd3f163b2167948b432d8e558fa34196
SHA256

623d15ba5658384ea5a60431603eddfe363c3edd4eb45ecbe62afe3c625e3d35
SHA512

11b3b995589a8cf3fe788dce5a63461bcab8d0c959388adc16170a3e60a9213c18b513c3182fc1903f9c0a1c80d59a7a510591eadde151613dea01868b339bd2

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3218) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Executes dropped EXE 3 IoCs

Processes:

mssecsvc.exemssecsvc.exetasksche.exe

pid process

3928 mssecsvc.exe
2232 mssecsvc.exe
2428 tasksche.exe
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Drops file in Windows directory 2 IoCs

Processes:

rundll32.exemssecsvc.exe

description ioc process

File created C:\WINDOWS\mssecsvc.exe rundll32.exe
File created C:\WINDOWS\tasksche.exe mssecsvc.exe

pid	process
3928	mssecsvc.exe
2232	mssecsvc.exe
2428	tasksche.exe

description	ioc	process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

mssecsvc.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2524 wrote to memory of 1572	2524	rundll32.exe	rundll32.exe
PID 2524 wrote to memory of 1572	2524	rundll32.exe	rundll32.exe
PID 2524 wrote to memory of 1572	2524	rundll32.exe	rundll32.exe
PID 1572 wrote to memory of 3928	1572	rundll32.exe	mssecsvc.exe
PID 1572 wrote to memory of 3928	1572	rundll32.exe	mssecsvc.exe
PID 1572 wrote to memory of 3928	1572	rundll32.exe	mssecsvc.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4e221caf0f5a010f819d0d07cfe19aeb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2524

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4e221caf0f5a010f819d0d07cfe19aeb.dll,#1
2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1572

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe
3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3928

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
4⤵
- Executes dropped EXE
PID:2428

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:2232

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\mssecsvc.exe
Filesize
3.6MB

MD5
aa6d1fb0b37cf3d74ab2f03500991543

SHA1
a21637b8be53a909e414f08777828521645924e2

SHA256
3e0e79ceeb0a4dede37d03c8d4c332c4519121f82b4b8ad39b86fe6eaae2356b

SHA512
2d41b7ccdf397839ad10364521546ee22a2eea63369e0383e135a65febeb76ca6b68069b6047d3543b30ae3af0194e45a2557ab94f317c651b5a0bcde9c7b6db

Download Submit
C:\Windows\mssecsvc.exe
Filesize
3.6MB

MD5
aa6d1fb0b37cf3d74ab2f03500991543

SHA1
a21637b8be53a909e414f08777828521645924e2

SHA256
3e0e79ceeb0a4dede37d03c8d4c332c4519121f82b4b8ad39b86fe6eaae2356b

SHA512
2d41b7ccdf397839ad10364521546ee22a2eea63369e0383e135a65febeb76ca6b68069b6047d3543b30ae3af0194e45a2557ab94f317c651b5a0bcde9c7b6db

Download Submit
C:\Windows\mssecsvc.exe
Filesize
3.6MB

MD5
aa6d1fb0b37cf3d74ab2f03500991543

SHA1
a21637b8be53a909e414f08777828521645924e2

SHA256
3e0e79ceeb0a4dede37d03c8d4c332c4519121f82b4b8ad39b86fe6eaae2356b

SHA512
2d41b7ccdf397839ad10364521546ee22a2eea63369e0383e135a65febeb76ca6b68069b6047d3543b30ae3af0194e45a2557ab94f317c651b5a0bcde9c7b6db

Download Submit
C:\Windows\tasksche.exe
Filesize
3.4MB

MD5
2d04987a5c3573c65b4af3900602fb9a

SHA1
7e32f31f2e4dc9eccb92ca6fe3dc89f703aae54b

SHA256
b99387f5593142cfa093e0815cfa019a87be4068391cc4d842f9d034da40ec48

SHA512
c75d689e76d02907b64fb8f4c30d0977d24d85d46d99eea0bf1d7b1793e1693cfeda3da4b95527b1517d856055d03b3fb113e2f117d5f4c2e1c89a4663c354d8

Download Submit
memory/1572-130-0x0000000000000000-mapping.dmp

Download
memory/3928-131-0x0000000000000000-mapping.dmp

Download