wannacry | acc83239318190f2b7840cc4578c0afcdd0e379e9d2b68640a53a1b1238ff61b

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220718-en
resource tags

arch:x64arch:x86image:win10v2004-20220718-enlocale:en-usos:windows10-2004-x64system
submitted
20-07-2022 01:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d445e2e0b050ee7127cbe72fe13ee2b4.dll
Size

5.0MB
MD5

d445e2e0b050ee7127cbe72fe13ee2b4
SHA1

a34d7fd1d1de115fedfeede6baa9d9867dc3e78b
SHA256

acc83239318190f2b7840cc4578c0afcdd0e379e9d2b68640a53a1b1238ff61b
SHA512

31d6185986c21a46612a8413c645461a7a5f18066f84d071cd11ac31be7400b69933982681ef99742d5d6ec489c69e142db26d6d8b8517d853fb5f05f74b31d6

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (2659) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Executes dropped EXE 3 IoCs

Processes:

mssecsvc.exemssecsvc.exetasksche.exe

pid process

5032 mssecsvc.exe
4500 mssecsvc.exe
2244 tasksche.exe
Drops file in Windows directory 2 IoCs

Processes:

rundll32.exemssecsvc.exe

description ioc process

File created C:\WINDOWS\mssecsvc.exe rundll32.exe
File created C:\WINDOWS\tasksche.exe mssecsvc.exe

pid	process
5032	mssecsvc.exe
4500	mssecsvc.exe
2244	tasksche.exe

description	ioc	process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

mssecsvc.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 3612 wrote to memory of 4936	3612	rundll32.exe	rundll32.exe
PID 3612 wrote to memory of 4936	3612	rundll32.exe	rundll32.exe
PID 3612 wrote to memory of 4936	3612	rundll32.exe	rundll32.exe
PID 4936 wrote to memory of 5032	4936	rundll32.exe	mssecsvc.exe
PID 4936 wrote to memory of 5032	4936	rundll32.exe	mssecsvc.exe
PID 4936 wrote to memory of 5032	4936	rundll32.exe	mssecsvc.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d445e2e0b050ee7127cbe72fe13ee2b4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3612

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d445e2e0b050ee7127cbe72fe13ee2b4.dll,#1
2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4936

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe
3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5032

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
4⤵
- Executes dropped EXE
PID:2244

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4500

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\mssecsvc.exe
Filesize
3.6MB

MD5
cf11f914efc5f6d096d58badf9d72915

SHA1
8ab39ed37e8291070a9cf5c3e4ea0bde0828ef9d

SHA256
69e6d253f9a00dbeebfea92c0bdbc9e53bf2f878cd4a4f142f9e935eb9eed7b7

SHA512
d013bfd13206de40912083e96e8702e963e5711188d9d9cf22546421bb57646184a75d20b1f0125cd6a6b41b420f3dd4df29066fdd4fe1650c2e470b6988c4e9

Download Submit
C:\Windows\mssecsvc.exe
Filesize
3.6MB

MD5
cf11f914efc5f6d096d58badf9d72915

SHA1
8ab39ed37e8291070a9cf5c3e4ea0bde0828ef9d

SHA256
69e6d253f9a00dbeebfea92c0bdbc9e53bf2f878cd4a4f142f9e935eb9eed7b7

SHA512
d013bfd13206de40912083e96e8702e963e5711188d9d9cf22546421bb57646184a75d20b1f0125cd6a6b41b420f3dd4df29066fdd4fe1650c2e470b6988c4e9

Download Submit
C:\Windows\mssecsvc.exe
Filesize
3.6MB

MD5
cf11f914efc5f6d096d58badf9d72915

SHA1
8ab39ed37e8291070a9cf5c3e4ea0bde0828ef9d

SHA256
69e6d253f9a00dbeebfea92c0bdbc9e53bf2f878cd4a4f142f9e935eb9eed7b7

SHA512
d013bfd13206de40912083e96e8702e963e5711188d9d9cf22546421bb57646184a75d20b1f0125cd6a6b41b420f3dd4df29066fdd4fe1650c2e470b6988c4e9

Download Submit
C:\Windows\tasksche.exe
Filesize
3.4MB

MD5
7bffd6dfd8e5c5fe55577df5d87559e5

SHA1
3536b3d1fa74db8619e305ff4bc772ea82d53c0f

SHA256
c5d0817617551bf5bae966e0c95ad66a1f536633b44b0eeb09ae3ee33ac67980

SHA512
af153f93af0a80b2ab351eced1063d164f9c43ad5f604ddae41b738a03bf1e12b723c312905165725894b9e1d4d38841b48123d995371eaab33fd9574047e77e

Download Submit
memory/4500-139-0x0000000000400000-0x0000000000A73000-memory.dmp

Filesize
6.4MB

Download
memory/4500-140-0x0000000000400000-0x0000000000A73000-memory.dmp

Filesize
6.4MB

Download
memory/4936-130-0x0000000000000000-mapping.dmp

Download
memory/5032-131-0x0000000000000000-mapping.dmp

Download
memory/5032-134-0x0000000000400000-0x0000000000A73000-memory.dmp

Filesize
6.4MB

Download
memory/5032-135-0x0000000000400000-0x0000000000A73000-memory.dmp

Filesize
6.4MB

Download
memory/5032-138-0x0000000000400000-0x0000000000A73000-memory.dmp

Filesize
6.4MB

Download