wannacry | 42315a334dcd8401dc3e60c6de48071029105f978aa100384ef78fc2f6c8bf0b

Analysis

max time kernel
152s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
resource tags

arch:x64arch:x86image:win10v2004-20220414-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2022, 00:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dc7a903e44cda227a20486feeadb4341.dll
Size 5.0MB
Sample220720-ajbvgahfe9
SHA256 42315a334dcd8401dc3e60c6de48071029105f978aa100384ef78fc2f6c8bf0b
MD5 dc7a903e44cda227a20486feeadb4341
SHA1 15346e27aa8490b3c17085cf8a4a81ce92abc661
SHA512 d7e80f2ab84e4f687e62e84a56aca9ec9e0ad1ce3199c18c33e91191d22666a0f947adc4a83ef5f2a2a03ae7b007f8b97db07a53bb7caf9546b7b8437b1fa523
MD5 SHA1 SHA512

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3305) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Executes dropped EXE 3 IoCs

pid	Process
5092	mssecsvc.exe
4968	mssecsvc.exe
3336	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3316 wrote to memory of 4736	3316	rundll32.exe	81
PID 3316 wrote to memory of 4736	3316	rundll32.exe	81
PID 3316 wrote to memory of 4736	3316	rundll32.exe	81
PID 4736 wrote to memory of 5092	4736	rundll32.exe	82
PID 4736 wrote to memory of 5092	4736	rundll32.exe	82
PID 4736 wrote to memory of 5092	4736	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dc7a903e44cda227a20486feeadb4341.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3316
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dc7a903e44cda227a20486feeadb4341.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:4736
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:5092
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:3336

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4968

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvc.exe

Path C:\WINDOWS\mssecsvc.exe
Size 3.6MB
SHA256 bf8648b75a7ec378ae62517f920a4ab69d740352cd68622c5086df282da91156
MD5 f0d09f37eaf148e09b0e11659c9152a0
SHA1 ce75f0a52061ba0b153c0e6f4dd1a958cea0cf52
SHA512 1e44cdcb4f8077b147a9c9ea6212f89107acb4a1e1dafb15b3c34892f481ab03c79b43377fd36e5c0fc0ea384aa49b845fe825a506bcb1f77e744a8623aef4c6
SSDEEP 98304:XDqPoBhz1aRxcSUDk26SAEdhvxWa9P593R8yAV:XDqPe1Cxcxk2ZAEUadzR8yc
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 bf8648b75a7ec378ae62517f920a4ab69d740352cd68622c5086df282da91156
MD5 f0d09f37eaf148e09b0e11659c9152a0
SHA1 ce75f0a52061ba0b153c0e6f4dd1a958cea0cf52
SHA512 1e44cdcb4f8077b147a9c9ea6212f89107acb4a1e1dafb15b3c34892f481ab03c79b43377fd36e5c0fc0ea384aa49b845fe825a506bcb1f77e744a8623aef4c6
SSDEEP 98304:XDqPoBhz1aRxcSUDk26SAEdhvxWa9P593R8yAV:XDqPe1Cxcxk2ZAEUadzR8yc
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 bf8648b75a7ec378ae62517f920a4ab69d740352cd68622c5086df282da91156
MD5 f0d09f37eaf148e09b0e11659c9152a0
SHA1 ce75f0a52061ba0b153c0e6f4dd1a958cea0cf52
SHA512 1e44cdcb4f8077b147a9c9ea6212f89107acb4a1e1dafb15b3c34892f481ab03c79b43377fd36e5c0fc0ea384aa49b845fe825a506bcb1f77e744a8623aef4c6
SSDEEP 98304:XDqPoBhz1aRxcSUDk26SAEdhvxWa9P593R8yAV:XDqPe1Cxcxk2ZAEUadzR8yc
MD5 SHA1 SHA512 SSDEEP

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 63e04f6b9d05ee7f07565b87791c85c29bdd24de3adb5b38d5fd8acb29dc0c2f
MD5 e9e2b94ae571c0c12f515079cfd5e4a7
SHA1 286954a8d12e26dfb1810674939279fd03e300da
SHA512 65a19a51cbd210f69735ae579892953526f187ce4651ffed55bdea7a33ae45f9c71adad45e85ff955afcbb792c5f5f4eb6857df32026cbcb93ed979822ef5582
SSDEEP 98304:QqPoBhz1aRxcSUDk26SAEdhvxWa9P593R8yAV:QqPe1Cxcxk2ZAEUadzR8yc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads