wannacry | 2edd948b703c3249ba424930fe717825ce5c108423b54a4411f05ea77dfd43e9

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220718-en
resource tags

arch:x64arch:x86image:win10v2004-20220718-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2022, 00:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6be9b9594e72bb87f21d4ab00f066db3.dll
Size 5.0MB
Sample220720-a49l8sadbm
SHA256 2edd948b703c3249ba424930fe717825ce5c108423b54a4411f05ea77dfd43e9
MD5 6be9b9594e72bb87f21d4ab00f066db3
SHA1 744782f0359a8a106cf0347423b21e73414f3a1c
SHA512 23ca23ae03384f2819a7b5915385bf5b71101987aacf3e6f9dff0564eb579f085ad012bed9ed3f2eb7c74321780495ca169ef8d7d8b99d473ffe7ce824054ba1
MD5 SHA1 SHA512

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3293) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Executes dropped EXE 3 IoCs

pid	Process
1268	mssecsvc.exe
1856	mssecsvc.exe
2580	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4844 wrote to memory of 1016	4844	rundll32.exe	76
PID 4844 wrote to memory of 1016	4844	rundll32.exe	76
PID 4844 wrote to memory of 1016	4844	rundll32.exe	76
PID 1016 wrote to memory of 1268	1016	rundll32.exe	77
PID 1016 wrote to memory of 1268	1016	rundll32.exe	77
PID 1016 wrote to memory of 1268	1016	rundll32.exe	77

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6be9b9594e72bb87f21d4ab00f066db3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6be9b9594e72bb87f21d4ab00f066db3.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1016
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:1268
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:2580

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:1856

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvc.exe

Path C:\WINDOWS\mssecsvc.exe
Size 3.6MB
SHA256 03d93e0f3673884344181dc5a2812ba02604907b985c62efae68f6d89cd770e9
MD5 31760a330db5f71a6fda36fadcdd8d1e
SHA1 e2fe7b9ae78df44fbd740c123400140ccfaf47f9
SHA512 9d3b3151e6752e65dd0e4c6dd337a6fc1fdb756c69b3ca181b0f5dfbac663741ae2275eb637863f29aacf30e0c6362f92767a021053c85cf6be45d87364ccc6c
SSDEEP 98304:XDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2/:XDqPe1Cxcxk3ZAEUadzR8yc4/
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 03d93e0f3673884344181dc5a2812ba02604907b985c62efae68f6d89cd770e9
MD5 31760a330db5f71a6fda36fadcdd8d1e
SHA1 e2fe7b9ae78df44fbd740c123400140ccfaf47f9
SHA512 9d3b3151e6752e65dd0e4c6dd337a6fc1fdb756c69b3ca181b0f5dfbac663741ae2275eb637863f29aacf30e0c6362f92767a021053c85cf6be45d87364ccc6c
SSDEEP 98304:XDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2/:XDqPe1Cxcxk3ZAEUadzR8yc4/
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 03d93e0f3673884344181dc5a2812ba02604907b985c62efae68f6d89cd770e9
MD5 31760a330db5f71a6fda36fadcdd8d1e
SHA1 e2fe7b9ae78df44fbd740c123400140ccfaf47f9
SHA512 9d3b3151e6752e65dd0e4c6dd337a6fc1fdb756c69b3ca181b0f5dfbac663741ae2275eb637863f29aacf30e0c6362f92767a021053c85cf6be45d87364ccc6c
SSDEEP 98304:XDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2/:XDqPe1Cxcxk3ZAEUadzR8yc4/
MD5 SHA1 SHA512 SSDEEP

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 93398a32a538dae5b17322cba7b4131c73335be95377ea3aed906d074922d8d7
MD5 2935c7dc8f34e60ed96ea5418ad1a827
SHA1 80d36b6160d7da230942505dfb1cfe1138cbcf89
SHA512 0fb88116fd1c3977cbdd0575e9ee69c72f3afa368d75a65b489a802893390d7ef2e504f6323a592d15552a3f1a685c89904fe3c104056ee271a76393d697c049
SSDEEP 98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2D:QqPe1Cxcxk3ZAEUadzR8yc4D
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads