wannacry | fdca1e0c8951ddfbea1f9a4fbdd44aff52f3608396788add49b99c3f0b482e09

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
resource tags

arch:x64arch:x86image:win10v2004-20220414-enlocale:en-usos:windows10-2004-x64system
submitted
20-07-2022 00:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8b54f5b032981768ddc1ba13d27c1018.dll
Size

5.0MB
MD5

8b54f5b032981768ddc1ba13d27c1018
SHA1

2e899f5379c09e40abc47d98539825d2e3e85bdc
SHA256

fdca1e0c8951ddfbea1f9a4fbdd44aff52f3608396788add49b99c3f0b482e09
SHA512

68ba135eab98110c7328b66d204d9d35cb36c0f7b53cb9e20a6751d8c56cd181d4142f814ec77aeb3a1edeaeb0219a95a1cce2f83c554705d69fb630ef24d18c

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3319) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Executes dropped EXE 3 IoCs

Processes:

mssecsvc.exemssecsvc.exetasksche.exe

pid process

2284 mssecsvc.exe
4692 mssecsvc.exe
3652 tasksche.exe
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Drops file in Windows directory 2 IoCs

Processes:

rundll32.exemssecsvc.exe

description ioc process

File created C:\WINDOWS\mssecsvc.exe rundll32.exe
File created C:\WINDOWS\tasksche.exe mssecsvc.exe

pid	process
2284	mssecsvc.exe
4692	mssecsvc.exe
3652	tasksche.exe

description	ioc	process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

mssecsvc.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2416 wrote to memory of 208	2416	rundll32.exe	rundll32.exe
PID 2416 wrote to memory of 208	2416	rundll32.exe	rundll32.exe
PID 2416 wrote to memory of 208	2416	rundll32.exe	rundll32.exe
PID 208 wrote to memory of 2284	208	rundll32.exe	mssecsvc.exe
PID 208 wrote to memory of 2284	208	rundll32.exe	mssecsvc.exe
PID 208 wrote to memory of 2284	208	rundll32.exe	mssecsvc.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8b54f5b032981768ddc1ba13d27c1018.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2416

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8b54f5b032981768ddc1ba13d27c1018.dll,#1
2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:208

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe
3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2284

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
4⤵
- Executes dropped EXE
PID:3652

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4692

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\mssecsvc.exe
Filesize
3.6MB

MD5
300755a49d5be3cc7ef7afcbfc1b429a

SHA1
8b06deaa9fc8bd15875fb0c8603cb623c5af2c28

SHA256
b6ed92348b5cad7eb63a8c4670254e7217ea5d8e0357366de9e0b78455c99828

SHA512
7b409b31db82e173afa680e08c8d71e6e27629892dffdb1ceedd9a843507006e1958f07435c1aa9736a09f453571fcb95845f264154a08483d7a768ca0241dfe

Download Submit
C:\Windows\mssecsvc.exe
Filesize
3.6MB

MD5
300755a49d5be3cc7ef7afcbfc1b429a

SHA1
8b06deaa9fc8bd15875fb0c8603cb623c5af2c28

SHA256
b6ed92348b5cad7eb63a8c4670254e7217ea5d8e0357366de9e0b78455c99828

SHA512
7b409b31db82e173afa680e08c8d71e6e27629892dffdb1ceedd9a843507006e1958f07435c1aa9736a09f453571fcb95845f264154a08483d7a768ca0241dfe

Download Submit
C:\Windows\mssecsvc.exe
Filesize
3.6MB

MD5
300755a49d5be3cc7ef7afcbfc1b429a

SHA1
8b06deaa9fc8bd15875fb0c8603cb623c5af2c28

SHA256
b6ed92348b5cad7eb63a8c4670254e7217ea5d8e0357366de9e0b78455c99828

SHA512
7b409b31db82e173afa680e08c8d71e6e27629892dffdb1ceedd9a843507006e1958f07435c1aa9736a09f453571fcb95845f264154a08483d7a768ca0241dfe

Download Submit
C:\Windows\tasksche.exe
Filesize
3.4MB

MD5
7009c62d2f4e879d5d04d3defd127648

SHA1
52305be8afca63f44f660fe3634dd6289579b6da

SHA256
8702d2b9be55b118d8ea0dac8611ee3afa34d24ef0b8b895c6997f48c75213b9

SHA512
480a69901364addea453429eb97e81024726d7285ea9c838e2cbe62ac00dc777d166ea8fc3d9bc72fa5d96cab7e6e0f0306110cb88d1c891025f4e3ad4881f95

Download Submit
memory/208-130-0x0000000000000000-mapping.dmp

Download
memory/2284-131-0x0000000000000000-mapping.dmp

Download