wannacry | 66f1d8d65c041689a1c05c661794e44bab00a546fac687089bab07a556c859ce

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
resource tags

arch:x64arch:x86image:win10v2004-20220414-enlocale:en-usos:windows10-2004-x64system
submitted
20-07-2022 01:40

Target

2259ebf3658c2dd6ab1e53e3c23fad4d.dll
Size

5.0MB
MD5

2259ebf3658c2dd6ab1e53e3c23fad4d
SHA1

0e1170d4132d995d404b86772cf41b399aa967d4
SHA256

66f1d8d65c041689a1c05c661794e44bab00a546fac687089bab07a556c859ce
SHA512

6b2f2ef1eb186923d64f86fb3fe9a08baac2089ec1d405a931c33c1c097692685ab4514aeeb9896ced9497709269120519695c8c26d04575bf26eba3d855aae8

Score

10^/10

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3169) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Executes dropped EXE 2 IoCs

Processes:

mssecsvr.exemssecsvr.exe

pid process

4564 mssecsvr.exe
2472 mssecsvr.exe
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Drops file in Windows directory 2 IoCs

Processes:

rundll32.exemssecsvr.exe

description ioc process

File created C:\WINDOWS\mssecsvr.exe rundll32.exe
File created C:\WINDOWS\tasksche.exe mssecsvr.exe

pid	process
4564	mssecsvr.exe
2472	mssecsvr.exe

description	ioc	process
File created	C:\WINDOWS\mssecsvr.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvr.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

mssecsvr.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvr.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 460 wrote to memory of 4656	460	rundll32.exe	rundll32.exe
PID 460 wrote to memory of 4656	460	rundll32.exe	rundll32.exe
PID 460 wrote to memory of 4656	460	rundll32.exe	rundll32.exe
PID 4656 wrote to memory of 4564	4656	rundll32.exe	mssecsvr.exe
PID 4656 wrote to memory of 4564	4656	rundll32.exe	mssecsvr.exe
PID 4656 wrote to memory of 4564	4656	rundll32.exe	mssecsvr.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2259ebf3658c2dd6ab1e53e3c23fad4d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:460

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

C:\WINDOWS\mssecsvr.exe
Filesize
3.6MB

MD5
50dc06528bc615007083fc5084369964

SHA1
c3fe4bc71b70991ab20f50edafd99f0f12448f58

SHA256
c0f19b6b51913c494055efbd17850e8c195374c4f198323429787ed16e1eb2f2

SHA512
d6e33412f1ba1c15931717f702fcab3ca35ac988e53aea37e20fbf6b31876f2cde7b303e0b43e792df2468b3bf3a425f71d4fb5e56e60935f03f5965d1c4beab

Download Submit
C:\Windows\mssecsvr.exe
Filesize
3.6MB

MD5
50dc06528bc615007083fc5084369964

SHA1
c3fe4bc71b70991ab20f50edafd99f0f12448f58

SHA256
c0f19b6b51913c494055efbd17850e8c195374c4f198323429787ed16e1eb2f2

SHA512
d6e33412f1ba1c15931717f702fcab3ca35ac988e53aea37e20fbf6b31876f2cde7b303e0b43e792df2468b3bf3a425f71d4fb5e56e60935f03f5965d1c4beab

Download Submit
C:\Windows\mssecsvr.exe
Filesize
3.6MB

MD5
50dc06528bc615007083fc5084369964

SHA1
c3fe4bc71b70991ab20f50edafd99f0f12448f58

SHA256
c0f19b6b51913c494055efbd17850e8c195374c4f198323429787ed16e1eb2f2

SHA512
d6e33412f1ba1c15931717f702fcab3ca35ac988e53aea37e20fbf6b31876f2cde7b303e0b43e792df2468b3bf3a425f71d4fb5e56e60935f03f5965d1c4beab

Download Submit
memory/4564-131-0x0000000000000000-mapping.dmp

Download
memory/4656-130-0x0000000000000000-mapping.dmp

Download