wannacry | 48fc9ccb42ec0234df4d4f41db1d0cb1e1fe6aa5e640c28625aa3d73e65d2856

Analysis

max time kernel
75s
max time network
91s
platform
windows10-2004_x64
resource
win10v2004-20220718-en
resource tags

arch:x64arch:x86image:win10v2004-20220718-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2022, 01:20

Target
0a9138624a09d2bd90e04a78799b35ac.dll
Size 5.0MB
Sample220720-bp4ywaaae8
SHA256 48fc9ccb42ec0234df4d4f41db1d0cb1e1fe6aa5e640c28625aa3d73e65d2856
MD5 0a9138624a09d2bd90e04a78799b35ac
SHA1 018aa130b119685c358514576ba3ba4d37b95e43
SHA512 24f7ed2d3a526ebfb1389833d2a7de79b565799c3bde644c67fdda37e0ca831c747d9267922caba4018dc4c16ec7b70825b44652cc69f6801d33b6af84d1958b
MD5 SHA1 SHA512

Score

10^/10

Executes dropped EXE 2 IoCs

pid	Process
3008	mssecsvc.exe
3220	mssecsvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 2344	1368	rundll32.exe	77
PID 1368 wrote to memory of 2344	1368	rundll32.exe	77
PID 1368 wrote to memory of 2344	1368	rundll32.exe	77
PID 2344 wrote to memory of 3008	2344	rundll32.exe	78
PID 2344 wrote to memory of 3008	2344	rundll32.exe	78
PID 2344 wrote to memory of 3008	2344	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0a9138624a09d2bd90e04a78799b35ac.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0a9138624a09d2bd90e04a78799b35ac.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2344
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:3008

mssecsvc.exe

Path C:\WINDOWS\mssecsvc.exe
Size 3.6MB
SHA256 9c47b3926cbb301c7449449cb427f9fc774d109bc2b46b6a1439adf50170d7b4
MD5 b5b08199acf7e5cdbbe3c804c751e04d
SHA1 47e0beb1515875af762dc41c7a5c7c912cae1fad
SHA512 22b28606176c8628ee6ffdfecf2ab29a4ff58371df034d2554d35ee4893de6c0d398d19e3842bf63e2a65505417362909d5c76979af4b307e85994df6607e256
SSDEEP 98304:XaPoB1zGX9+MDHODemamMIX6RSTq8ybHQstsJU8jMesffN:XaPSGt+MDsemamMIX6RSTq8ybHQy2U8i
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 9c47b3926cbb301c7449449cb427f9fc774d109bc2b46b6a1439adf50170d7b4
MD5 b5b08199acf7e5cdbbe3c804c751e04d
SHA1 47e0beb1515875af762dc41c7a5c7c912cae1fad
SHA512 22b28606176c8628ee6ffdfecf2ab29a4ff58371df034d2554d35ee4893de6c0d398d19e3842bf63e2a65505417362909d5c76979af4b307e85994df6607e256
SSDEEP 98304:XaPoB1zGX9+MDHODemamMIX6RSTq8ybHQstsJU8jMesffN:XaPSGt+MDsemamMIX6RSTq8ybHQy2U8i
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 9c47b3926cbb301c7449449cb427f9fc774d109bc2b46b6a1439adf50170d7b4
MD5 b5b08199acf7e5cdbbe3c804c751e04d
SHA1 47e0beb1515875af762dc41c7a5c7c912cae1fad
SHA512 22b28606176c8628ee6ffdfecf2ab29a4ff58371df034d2554d35ee4893de6c0d398d19e3842bf63e2a65505417362909d5c76979af4b307e85994df6607e256
SSDEEP 98304:XaPoB1zGX9+MDHODemamMIX6RSTq8ybHQstsJU8jMesffN:XaPSGt+MDsemamMIX6RSTq8ybHQy2U8i
MD5 SHA1 SHA512 SSDEEP

Submit Download