wannacry | 2557610c7a60f790051868762f9907822e52b2a40c09d3b9c8b241fe1ea28a01

Analysis

max time kernel
151s
max time network
153s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
20/07/2022, 00:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cd04b4d1ff7060806aa972214eff0e54.dll
Size 5.0MB
Sample220720-back3sadel
SHA256 2557610c7a60f790051868762f9907822e52b2a40c09d3b9c8b241fe1ea28a01
MD5 cd04b4d1ff7060806aa972214eff0e54
SHA1 c1137d8164f8374a6018c7c1910c0984111d3101
SHA512 931e4c930974e664f061f6ffe3743db4bde03967e9e0d124a42b84ad5ac59bffe45415e1bf278d1e68bd4a2482afd9a89d39d0dd4298facce7bca8b96db7d34c
MD5 SHA1 SHA512

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (1282) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Executes dropped EXE 3 IoCs

pid	Process
1148	mssecsvc.exe
888	mssecsvc.exe
1296	tasksche.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	mssecsvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvc.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 1816	1856	rundll32.exe	27
PID 1856 wrote to memory of 1816	1856	rundll32.exe	27
PID 1856 wrote to memory of 1816	1856	rundll32.exe	27
PID 1856 wrote to memory of 1816	1856	rundll32.exe	27
PID 1856 wrote to memory of 1816	1856	rundll32.exe	27
PID 1856 wrote to memory of 1816	1856	rundll32.exe	27
PID 1856 wrote to memory of 1816	1856	rundll32.exe	27
PID 1816 wrote to memory of 1148	1816	rundll32.exe	28
PID 1816 wrote to memory of 1148	1816	rundll32.exe	28
PID 1816 wrote to memory of 1148	1816	rundll32.exe	28
PID 1816 wrote to memory of 1148	1816	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cd04b4d1ff7060806aa972214eff0e54.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cd04b4d1ff7060806aa972214eff0e54.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1816
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:1148
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:1296

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:888

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvc.exe

Path C:\WINDOWS\mssecsvc.exe
Size 3.6MB
SHA256 a14730e33f4ac8fd24ddcc718149bba26c91931027e558899796c916b0b3c0e7
MD5 627f18ad810973a4b8eac539709ff6c5
SHA1 45d48d1a1eb6b5b70784f959522bb3c78eb6f5f3
SHA512 de6be42f250c3de53aa1d5665a3482d72d7ea5ce4f8104d1903201b72074ccfe4791a2db6637d0df712390a91b5170ffe9f04dffa8e273d986302ff26400abe5
SSDEEP 98304:Z8qPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2:Z8qPe1Cxcxk3ZAEUadzR8yc4
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 a14730e33f4ac8fd24ddcc718149bba26c91931027e558899796c916b0b3c0e7
MD5 627f18ad810973a4b8eac539709ff6c5
SHA1 45d48d1a1eb6b5b70784f959522bb3c78eb6f5f3
SHA512 de6be42f250c3de53aa1d5665a3482d72d7ea5ce4f8104d1903201b72074ccfe4791a2db6637d0df712390a91b5170ffe9f04dffa8e273d986302ff26400abe5
SSDEEP 98304:Z8qPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2:Z8qPe1Cxcxk3ZAEUadzR8yc4
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 a14730e33f4ac8fd24ddcc718149bba26c91931027e558899796c916b0b3c0e7
MD5 627f18ad810973a4b8eac539709ff6c5
SHA1 45d48d1a1eb6b5b70784f959522bb3c78eb6f5f3
SHA512 de6be42f250c3de53aa1d5665a3482d72d7ea5ce4f8104d1903201b72074ccfe4791a2db6637d0df712390a91b5170ffe9f04dffa8e273d986302ff26400abe5
SSDEEP 98304:Z8qPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2:Z8qPe1Cxcxk3ZAEUadzR8yc4
MD5 SHA1 SHA512 SSDEEP

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 4af2c3c1097b8b56366f194e29f3d2bf9bb5a111a8eba8c4f2c3fac18c0fc693
MD5 04fab5146a6f2c42ea3a76d85b439907
SHA1 2be3e0e02cf1bb5facd3af53fb436ed851c12be0
SHA512 8539215a5d0d7f500a4c640dc8a1713de982d9cb97eefae21a4a5c6fa964f1cb6e3bcaa84e5c65b99b70d824c87dabfa4c5380e885ff46c5f7b77892973898a7
SSDEEP 98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2:QqPe1Cxcxk3ZAEUadzR8yc4
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1816-55-0x0000000075831000-0x0000000075833000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads