wannacry | 108138186d532491af3a8e360b2f205d6e4cc49ba2a1590816fa4e7fc52b99c8

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220718-en
resource tags

arch:x64arch:x86image:win10v2004-20220718-enlocale:en-usos:windows10-2004-x64system
submitted
20-07-2022 00:50

Target

e1003550914817e37165ac6b903c71f8.dll
Size

5.0MB
MD5

e1003550914817e37165ac6b903c71f8
SHA1

4d256cc34cc98a68f25a6bc818888b6b1d175f8a
SHA256

108138186d532491af3a8e360b2f205d6e4cc49ba2a1590816fa4e7fc52b99c8
SHA512

4ad5f08e61362671689345104ea32a5355eac3b120b2ffbd9e2d8515a883b5bd1358645c80547b42ed714dc7253dc5a38c02a15b6812444fd6c4be61e4105379

Score

10^/10

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3281) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Executes dropped EXE 2 IoCs

Processes:

mssecsvr.exemssecsvr.exe

pid process

3928 mssecsvr.exe
2232 mssecsvr.exe
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Drops file in Windows directory 2 IoCs

Processes:

rundll32.exemssecsvr.exe

description ioc process

File created C:\WINDOWS\mssecsvr.exe rundll32.exe
File created C:\WINDOWS\tasksche.exe mssecsvr.exe

pid	process
3928	mssecsvr.exe
2232	mssecsvr.exe

description	ioc	process
File created	C:\WINDOWS\mssecsvr.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvr.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

mssecsvr.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvr.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2524 wrote to memory of 2332	2524	rundll32.exe	rundll32.exe
PID 2524 wrote to memory of 2332	2524	rundll32.exe	rundll32.exe
PID 2524 wrote to memory of 2332	2524	rundll32.exe	rundll32.exe
PID 2332 wrote to memory of 3928	2332	rundll32.exe	mssecsvr.exe
PID 2332 wrote to memory of 3928	2332	rundll32.exe	mssecsvr.exe
PID 2332 wrote to memory of 3928	2332	rundll32.exe	mssecsvr.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e1003550914817e37165ac6b903c71f8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2524

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\WINDOWS\mssecsvr.exe
Filesize
2.2MB

MD5
17a8e7d9bdd8cec9a48babd735dc3f5a

SHA1
162401276a888b45eb733182d14194b9eca198ae

SHA256
c71dde8b8280eb70792dde84a9e085c9dded42dccea98a81b8a9c8aee04902e4

SHA512
8a0a2ceef8eb67ce242d96e5f385c52a9fc816063475bd488a01576f0c00f4a60fd2296952fca73b9f5f3aa75f611ee82cc51bd5131491997b2246723cb1fc17

Download Submit
C:\Windows\mssecsvr.exe
Filesize
2.2MB

MD5
17a8e7d9bdd8cec9a48babd735dc3f5a

SHA1
162401276a888b45eb733182d14194b9eca198ae

SHA256
c71dde8b8280eb70792dde84a9e085c9dded42dccea98a81b8a9c8aee04902e4

SHA512
8a0a2ceef8eb67ce242d96e5f385c52a9fc816063475bd488a01576f0c00f4a60fd2296952fca73b9f5f3aa75f611ee82cc51bd5131491997b2246723cb1fc17

Download Submit
C:\Windows\mssecsvr.exe
Filesize
2.2MB

MD5
17a8e7d9bdd8cec9a48babd735dc3f5a

SHA1
162401276a888b45eb733182d14194b9eca198ae

SHA256
c71dde8b8280eb70792dde84a9e085c9dded42dccea98a81b8a9c8aee04902e4

SHA512
8a0a2ceef8eb67ce242d96e5f385c52a9fc816063475bd488a01576f0c00f4a60fd2296952fca73b9f5f3aa75f611ee82cc51bd5131491997b2246723cb1fc17

Download Submit
memory/2332-130-0x0000000000000000-mapping.dmp

Download
memory/3928-131-0x0000000000000000-mapping.dmp

Download