wannacry | 9627a29e207c056214d80b43ad8f1ddc9f12635e21036b948b05b5d945ad3c88

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220718-en
resource tags

arch:x64arch:x86image:win10v2004-20220718-enlocale:en-usos:windows10-2004-x64system
submitted
20-07-2022 01:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2e23662fe67183726f6ebeac6530b8eb.dll
Size

5.0MB
MD5

2e23662fe67183726f6ebeac6530b8eb
SHA1

786691eac6a90649b3c717534e4e8ad8a0a728f7
SHA256

9627a29e207c056214d80b43ad8f1ddc9f12635e21036b948b05b5d945ad3c88
SHA512

d92084b588fc2cc9c03d5f368764a77a3bfa35407a9af077ecef2e23cc7002c00dba16d92509e7b7e4cbaae3231b224d006b4814f07c76166423cd2ede6d01d8

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (2640) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Executes dropped EXE 3 IoCs

Processes:

mssecsvc.exemssecsvc.exetasksche.exe

pid process

1736 mssecsvc.exe
3864 mssecsvc.exe
3772 tasksche.exe
Drops file in Windows directory 2 IoCs

Processes:

rundll32.exemssecsvc.exe

description ioc process

File created C:\WINDOWS\mssecsvc.exe rundll32.exe
File created C:\WINDOWS\tasksche.exe mssecsvc.exe

pid	process
1736	mssecsvc.exe
3864	mssecsvc.exe
3772	tasksche.exe

description	ioc	process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

mssecsvc.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2020 wrote to memory of 1164	2020	rundll32.exe	rundll32.exe
PID 2020 wrote to memory of 1164	2020	rundll32.exe	rundll32.exe
PID 2020 wrote to memory of 1164	2020	rundll32.exe	rundll32.exe
PID 1164 wrote to memory of 1736	1164	rundll32.exe	mssecsvc.exe
PID 1164 wrote to memory of 1736	1164	rundll32.exe	mssecsvc.exe
PID 1164 wrote to memory of 1736	1164	rundll32.exe	mssecsvc.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e23662fe67183726f6ebeac6530b8eb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2020

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e23662fe67183726f6ebeac6530b8eb.dll,#1
2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1164

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe
3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1736

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
4⤵
- Executes dropped EXE
PID:3772

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:3864

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\mssecsvc.exe

Filesize
3.6MB

MD5
9220e79be504de8b69024ddba1dcf64b

SHA1
af436deac84f68798784a08f6a6ecb20fa6f5c18

SHA256
7e01eb5a24385e70bf42d6bfb3c7460c54984b4a766a256b92e9fe2bb0ebade6

SHA512
2bb8a5e6aba06e98b287bec6be4f8b863c19a42de5480d459410228fdbae158370ffcd498329166dbc55bbed18db3a7c9e61eafed5101d82678f9610d5fc2aea

Download Submit
C:\Windows\mssecsvc.exe

Filesize
3.6MB

MD5
9220e79be504de8b69024ddba1dcf64b

SHA1
af436deac84f68798784a08f6a6ecb20fa6f5c18

SHA256
7e01eb5a24385e70bf42d6bfb3c7460c54984b4a766a256b92e9fe2bb0ebade6

SHA512
2bb8a5e6aba06e98b287bec6be4f8b863c19a42de5480d459410228fdbae158370ffcd498329166dbc55bbed18db3a7c9e61eafed5101d82678f9610d5fc2aea

Download Submit
C:\Windows\mssecsvc.exe

Filesize
3.6MB

MD5
9220e79be504de8b69024ddba1dcf64b

SHA1
af436deac84f68798784a08f6a6ecb20fa6f5c18

SHA256
7e01eb5a24385e70bf42d6bfb3c7460c54984b4a766a256b92e9fe2bb0ebade6

SHA512
2bb8a5e6aba06e98b287bec6be4f8b863c19a42de5480d459410228fdbae158370ffcd498329166dbc55bbed18db3a7c9e61eafed5101d82678f9610d5fc2aea

Download Submit
C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
f5d909f22d58a3393c9b2608e5a96d7d

SHA1
ed1f93edf52231500dede66ace6b62cf3635af5e

SHA256
c04b04fb14ee3c2b0ea192ae6ecba7bc46a946dda33180ec238b4d2240f8f787

SHA512
7aee589a7950c23cdede59a2d564d2cbb08704d3b1e1077304a0bcc6021fab0698863f5f2c79b2a55efcf7f9207686c9475a631017b88d54a8fd4f9fb8f09ea2

Download Submit
memory/1164-130-0x0000000000000000-mapping.dmp

Download
memory/1736-131-0x0000000000000000-mapping.dmp

Download