wannacry | c9db9ce17eb23dd902c86fdf9190599718bb01572983cdb14e10f9c4d71a3977

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220718-en
resource tags

arch:x64arch:x86image:win10v2004-20220718-enlocale:en-usos:windows10-2004-x64system
submitted
20-07-2022 01:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

85d3a6eb4f1c04311c52891051503b3a.dll
Size

5.0MB
MD5

85d3a6eb4f1c04311c52891051503b3a
SHA1

b69a6112fe9e3f1903e57eda73e990c4ffadeb6d
SHA256

c9db9ce17eb23dd902c86fdf9190599718bb01572983cdb14e10f9c4d71a3977
SHA512

acdf2290b61bc08c6bb693598e5e081e8c2f1408fcd08818b2ecf32ec7c84a2ebb0ff36630c77f2cd7b19cb9f802c6884a6a7a9ceb69cc8d23c0d59b42043e57

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3233) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Executes dropped EXE 3 IoCs

Processes:

mssecsvc.exemssecsvc.exetasksche.exe

pid process

1492 mssecsvc.exe
2456 mssecsvc.exe
3244 tasksche.exe
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Drops file in Windows directory 2 IoCs

Processes:

rundll32.exemssecsvc.exe

description ioc process

File created C:\WINDOWS\mssecsvc.exe rundll32.exe
File created C:\WINDOWS\tasksche.exe mssecsvc.exe

pid	process
1492	mssecsvc.exe
2456	mssecsvc.exe
3244	tasksche.exe

description	ioc	process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

mssecsvc.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2280 wrote to memory of 1236	2280	rundll32.exe	rundll32.exe
PID 2280 wrote to memory of 1236	2280	rundll32.exe	rundll32.exe
PID 2280 wrote to memory of 1236	2280	rundll32.exe	rundll32.exe
PID 1236 wrote to memory of 1492	1236	rundll32.exe	mssecsvc.exe
PID 1236 wrote to memory of 1492	1236	rundll32.exe	mssecsvc.exe
PID 1236 wrote to memory of 1492	1236	rundll32.exe	mssecsvc.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\85d3a6eb4f1c04311c52891051503b3a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2280

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\85d3a6eb4f1c04311c52891051503b3a.dll,#1
2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1236

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe
3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1492

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
4⤵
- Executes dropped EXE
PID:3244

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:2456

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\mssecsvc.exe
Filesize
3.6MB

MD5
a614a0ad86696a9a2c65ddd73ae87c75

SHA1
870539bcda0c1981b946b709660631c6be52558c

SHA256
78e9045a7d6d914a550a29c3d446cdf3a4ef2950eaac279e5868587cea02b55e

SHA512
531f7945a686dcbf272123352830637ce5c235e3f1f803c6d0d9d0df4b8931a0d03ad1db599be79e61366a0c55e12badda143accb9993b1ccd5ce159620b3637

Download Submit
C:\Windows\mssecsvc.exe
Filesize
3.6MB

MD5
a614a0ad86696a9a2c65ddd73ae87c75

SHA1
870539bcda0c1981b946b709660631c6be52558c

SHA256
78e9045a7d6d914a550a29c3d446cdf3a4ef2950eaac279e5868587cea02b55e

SHA512
531f7945a686dcbf272123352830637ce5c235e3f1f803c6d0d9d0df4b8931a0d03ad1db599be79e61366a0c55e12badda143accb9993b1ccd5ce159620b3637

Download Submit
C:\Windows\mssecsvc.exe
Filesize
3.6MB

MD5
a614a0ad86696a9a2c65ddd73ae87c75

SHA1
870539bcda0c1981b946b709660631c6be52558c

SHA256
78e9045a7d6d914a550a29c3d446cdf3a4ef2950eaac279e5868587cea02b55e

SHA512
531f7945a686dcbf272123352830637ce5c235e3f1f803c6d0d9d0df4b8931a0d03ad1db599be79e61366a0c55e12badda143accb9993b1ccd5ce159620b3637

Download Submit
C:\Windows\tasksche.exe
Filesize
3.4MB

MD5
05b29f45d56d401e2e00e7892c696de1

SHA1
1f5591566c9a7bb485a87fe35d7d2a88fa0447b6

SHA256
7ffa57a70b24a82ba79d41038bcbb42aca217325dc86140d156b408e3c218a07

SHA512
84a31f191d5c89c4c3c8219a87da7dff12e12c120bd06937a2157163331f388029024c24a56409ee6b5b88ab677af952e76c7812ff644ca61ac6032660c39da7

Download Submit
memory/1236-130-0x0000000000000000-mapping.dmp

Download
memory/1492-131-0x0000000000000000-mapping.dmp

Download