wannacry | 226b3f09c308afa4dd4643ce807ceb8214bfe0e4238be6a776f31acd9cbeaf21

Analysis

max time kernel
151s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
resource tags

arch:x64arch:x86image:win10v2004-20220414-enlocale:en-usos:windows10-2004-x64system
submitted
20-07-2022 01:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e46efeb5217e2d4bc9b9d28bcf80f3b6.dll
Size

5.0MB
MD5

e46efeb5217e2d4bc9b9d28bcf80f3b6
SHA1

1a42ab2977b67967a3cbdc0ace3ababd76d049b5
SHA256

226b3f09c308afa4dd4643ce807ceb8214bfe0e4238be6a776f31acd9cbeaf21
SHA512

41244f203bc5d206e5d7b81bcc619860e7abbdc448b9c5b5e5b02dd344613eaa70d2e3f22008468437b29501f968226aacd946b4212cb1c0eccb5de0ca4c7982

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3292) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Executes dropped EXE 3 IoCs

Processes:

mssecsvc.exemssecsvc.exetasksche.exe

pid process

4480 mssecsvc.exe
4792 mssecsvc.exe
5100 tasksche.exe
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Drops file in Windows directory 2 IoCs

Processes:

rundll32.exemssecsvc.exe

description ioc process

File created C:\WINDOWS\mssecsvc.exe rundll32.exe
File created C:\WINDOWS\tasksche.exe mssecsvc.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4140 5100 WerFault.exe tasksche.exe

pid	process
4480	mssecsvc.exe
4792	mssecsvc.exe
5100	tasksche.exe

description	ioc	process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

pid	pid_target	process	target process
4140	5100	WerFault.exe	tasksche.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

rundll32.exerundll32.exemssecsvc.exe

description	pid	process	target process
PID 3124 wrote to memory of 4836	3124	rundll32.exe	rundll32.exe
PID 3124 wrote to memory of 4836	3124	rundll32.exe	rundll32.exe
PID 3124 wrote to memory of 4836	3124	rundll32.exe	rundll32.exe
PID 4836 wrote to memory of 4480	4836	rundll32.exe	mssecsvc.exe
PID 4836 wrote to memory of 4480	4836	rundll32.exe	mssecsvc.exe
PID 4836 wrote to memory of 4480	4836	rundll32.exe	mssecsvc.exe
PID 4480 wrote to memory of 5100	4480	mssecsvc.exe	tasksche.exe
PID 4480 wrote to memory of 5100	4480	mssecsvc.exe	tasksche.exe
PID 4480 wrote to memory of 5100	4480	mssecsvc.exe	tasksche.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e46efeb5217e2d4bc9b9d28bcf80f3b6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3124

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e46efeb5217e2d4bc9b9d28bcf80f3b6.dll,#1
2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4836

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe
3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4480

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
4⤵
- Executes dropped EXE
PID:5100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5100 -s 220
5⤵
- Program crash
PID:4140

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
PID:4792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5100 -ip 5100
1⤵
PID:2160

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\mssecsvc.exe
Filesize
3.6MB

MD5
fa5998e94530ad9f75734f4a33e47b59

SHA1
302b9ec84a6c783fdcecb5a013bdb39770d533a1

SHA256
02c77661bf747f40ee9979dbd44885df8b337b9e4a546f385855343ba5a92c5c

SHA512
466cb61e6bbf06b612f924e818e9a0101ae72cda214ded01175b9396a7d379efc17e5115c3c1babcd85656324a7b284acfa622e140714863ba8376150850062b

Download Submit
C:\WINDOWS\tasksche.exe
Filesize
3.4MB

MD5
1fa618bc1133f2933c5fb144de693db1

SHA1
c5489b50f7816213d62f8a7bc5c3fd56ee36351f

SHA256
4c3932c024d000297e5dd33567e8fa05ebd42defbd4d63423106b4e686696962

SHA512
a9de952fa3b59f5eef0b1673faff07b324803730096047dbeac1e24837dd6469e6d7cd1aa7d2cf56f0194a5d2e37ea2bfab0749d52ac00e3a0b12299f935a324

Download Submit
C:\Windows\mssecsvc.exe
Filesize
3.6MB

MD5
fa5998e94530ad9f75734f4a33e47b59

SHA1
302b9ec84a6c783fdcecb5a013bdb39770d533a1

SHA256
02c77661bf747f40ee9979dbd44885df8b337b9e4a546f385855343ba5a92c5c

SHA512
466cb61e6bbf06b612f924e818e9a0101ae72cda214ded01175b9396a7d379efc17e5115c3c1babcd85656324a7b284acfa622e140714863ba8376150850062b

Download Submit
C:\Windows\mssecsvc.exe
Filesize
3.6MB

MD5
fa5998e94530ad9f75734f4a33e47b59

SHA1
302b9ec84a6c783fdcecb5a013bdb39770d533a1

SHA256
02c77661bf747f40ee9979dbd44885df8b337b9e4a546f385855343ba5a92c5c

SHA512
466cb61e6bbf06b612f924e818e9a0101ae72cda214ded01175b9396a7d379efc17e5115c3c1babcd85656324a7b284acfa622e140714863ba8376150850062b

Download Submit
C:\Windows\tasksche.exe
Filesize
3.4MB

MD5
1fa618bc1133f2933c5fb144de693db1

SHA1
c5489b50f7816213d62f8a7bc5c3fd56ee36351f

SHA256
4c3932c024d000297e5dd33567e8fa05ebd42defbd4d63423106b4e686696962

SHA512
a9de952fa3b59f5eef0b1673faff07b324803730096047dbeac1e24837dd6469e6d7cd1aa7d2cf56f0194a5d2e37ea2bfab0749d52ac00e3a0b12299f935a324

Download Submit
memory/4480-131-0x0000000000000000-mapping.dmp

Download
memory/4480-134-0x0000000000400000-0x0000000000A70000-memory.dmp

Filesize
6.4MB

Download
memory/4480-139-0x0000000000400000-0x0000000000A70000-memory.dmp

Filesize
6.4MB

Download
memory/4792-140-0x0000000000400000-0x0000000000A70000-memory.dmp

Filesize
6.4MB

Download
memory/4792-141-0x0000000000400000-0x0000000000A70000-memory.dmp

Filesize
6.4MB

Download
memory/4836-130-0x0000000000000000-mapping.dmp

Download
memory/5100-136-0x0000000000000000-mapping.dmp

Download