wannacry | b77665487dd354f83ab68f978f8cc82afa45c8e5083224aa9fbb4d81c4b69f97

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
resource tags

arch:x64arch:x86image:win10v2004-20220414-enlocale:en-usos:windows10-2004-x64system
submitted
20-07-2022 00:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

320be0fb7b2e0a09dbbdb0f1baaa464c.dll
Size

5.0MB
MD5

320be0fb7b2e0a09dbbdb0f1baaa464c
SHA1

65e4a93f5e21c7ee0838b658f4d4ea91101301f8
SHA256

b77665487dd354f83ab68f978f8cc82afa45c8e5083224aa9fbb4d81c4b69f97
SHA512

7c28d605258d2660159232bd5882f61e36b469a4456a57b87bf4d7215d8a885fcb102fe79b0829a78fc1937759282cf47271ea30f37d234491a677dc173f437d

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3210) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Executes dropped EXE 3 IoCs

Processes:

mssecsvc.exemssecsvc.exetasksche.exe

pid process

3776 mssecsvc.exe
2252 mssecsvc.exe
3740 tasksche.exe
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Drops file in Windows directory 2 IoCs

Processes:

rundll32.exemssecsvc.exe

description ioc process

File created C:\WINDOWS\mssecsvc.exe rundll32.exe
File created C:\WINDOWS\tasksche.exe mssecsvc.exe

pid	process
3776	mssecsvc.exe
2252	mssecsvc.exe
3740	tasksche.exe

description	ioc	process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1028 wrote to memory of 4308	1028	rundll32.exe	rundll32.exe
PID 1028 wrote to memory of 4308	1028	rundll32.exe	rundll32.exe
PID 1028 wrote to memory of 4308	1028	rundll32.exe	rundll32.exe
PID 4308 wrote to memory of 3776	4308	rundll32.exe	mssecsvc.exe
PID 4308 wrote to memory of 3776	4308	rundll32.exe	mssecsvc.exe
PID 4308 wrote to memory of 3776	4308	rundll32.exe	mssecsvc.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\320be0fb7b2e0a09dbbdb0f1baaa464c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1028

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\320be0fb7b2e0a09dbbdb0f1baaa464c.dll,#1
2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4308

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe
3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3776

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
4⤵
- Executes dropped EXE
PID:3740

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
PID:2252

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\mssecsvc.exe
Filesize
3.6MB

MD5
185bec96a82edd3681173c67e69c1ecf

SHA1
33b7bff0bc4aeb8a75b1d47e3246401a1f394430

SHA256
1df8314f8b0dee306f0cb7d2ee56013dab11231bdfd67066576cdbe2e208e36d

SHA512
8f457c25d40ab606a8e7e5d11c1dbbac4d0b929a077a5469e5abca764d75d752599927af19ffeff909bfe87f9454d0f954213119e5192cc63ae0dfcc3029dbee

Download Submit
C:\Windows\mssecsvc.exe
Filesize
3.6MB

MD5
185bec96a82edd3681173c67e69c1ecf

SHA1
33b7bff0bc4aeb8a75b1d47e3246401a1f394430

SHA256
1df8314f8b0dee306f0cb7d2ee56013dab11231bdfd67066576cdbe2e208e36d

SHA512
8f457c25d40ab606a8e7e5d11c1dbbac4d0b929a077a5469e5abca764d75d752599927af19ffeff909bfe87f9454d0f954213119e5192cc63ae0dfcc3029dbee

Download Submit
C:\Windows\mssecsvc.exe
Filesize
3.6MB

MD5
185bec96a82edd3681173c67e69c1ecf

SHA1
33b7bff0bc4aeb8a75b1d47e3246401a1f394430

SHA256
1df8314f8b0dee306f0cb7d2ee56013dab11231bdfd67066576cdbe2e208e36d

SHA512
8f457c25d40ab606a8e7e5d11c1dbbac4d0b929a077a5469e5abca764d75d752599927af19ffeff909bfe87f9454d0f954213119e5192cc63ae0dfcc3029dbee

Download Submit
C:\Windows\tasksche.exe
Filesize
3.4MB

MD5
e40839dba564d0fa244ae41fe4e2a1ba

SHA1
e34589af147ce299986172445c9eb438a39a82f9

SHA256
55078b6ed1ec27c63a63b8f13d8b5403a23c6b94feb438b4238dc9f0c82d4341

SHA512
7a5ce8c4115aa1d96b132c8e3710d7c40cd081665437f89e4c6d38f8c7d91c6bffb0a92860d90e8f84387ffb9b18a8851fa604ac55efa55f97e7241e78756c09

Download Submit
memory/3776-131-0x0000000000000000-mapping.dmp

Download
memory/4308-130-0x0000000000000000-mapping.dmp

Download