wannacry | 226b3f09c308afa4dd4643ce807ceb8214bfe0e4238be6a776f31acd9cbeaf21

Analysis

max time kernel
151s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
resource tags

arch:x64arch:x86image:win10v2004-20220414-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2022, 01:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e46efeb5217e2d4bc9b9d28bcf80f3b6.dll
Size 5.0MB
Sample220720-bvntvaafcq
SHA256 226b3f09c308afa4dd4643ce807ceb8214bfe0e4238be6a776f31acd9cbeaf21
MD5 e46efeb5217e2d4bc9b9d28bcf80f3b6
SHA1 1a42ab2977b67967a3cbdc0ace3ababd76d049b5
SHA512 41244f203bc5d206e5d7b81bcc619860e7abbdc448b9c5b5e5b02dd344613eaa70d2e3f22008468437b29501f968226aacd946b4212cb1c0eccb5de0ca4c7982
MD5 SHA1 SHA512

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3292) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Executes dropped EXE 3 IoCs

pid	Process
4480	mssecsvc.exe
4792	mssecsvc.exe
5100	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4140	5100	WerFault.exe	84

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3124 wrote to memory of 4836	3124	rundll32.exe	81
PID 3124 wrote to memory of 4836	3124	rundll32.exe	81
PID 3124 wrote to memory of 4836	3124	rundll32.exe	81
PID 4836 wrote to memory of 4480	4836	rundll32.exe	82
PID 4836 wrote to memory of 4480	4836	rundll32.exe	82
PID 4836 wrote to memory of 4480	4836	rundll32.exe	82
PID 4480 wrote to memory of 5100	4480	mssecsvc.exe	84
PID 4480 wrote to memory of 5100	4480	mssecsvc.exe	84
PID 4480 wrote to memory of 5100	4480	mssecsvc.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e46efeb5217e2d4bc9b9d28bcf80f3b6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3124
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e46efeb5217e2d4bc9b9d28bcf80f3b6.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:4836
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:4480
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:5100
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5100 -s 220
        5⤵
        Program crash
        
        PID:4140

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
PID:4792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5100 -ip 5100
1⤵
PID:2160

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvc.exe

Path C:\WINDOWS\mssecsvc.exe
Size 3.6MB
SHA256 02c77661bf747f40ee9979dbd44885df8b337b9e4a546f385855343ba5a92c5c
MD5 fa5998e94530ad9f75734f4a33e47b59
SHA1 302b9ec84a6c783fdcecb5a013bdb39770d533a1
SHA512 466cb61e6bbf06b612f924e818e9a0101ae72cda214ded01175b9396a7d379efc17e5115c3c1babcd85656324a7b284acfa622e140714863ba8376150850062b
SSDEEP 49152:+njQdPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9PAMEcaE:q8RoBhz1aRxcSUDk36SAEdhvxWa9P5
MD5 SHA1 SHA512 SSDEEP

Submit Download

tasksche.exe

Path C:\WINDOWS\tasksche.exe
Size 3.4MB
SHA256 4c3932c024d000297e5dd33567e8fa05ebd42defbd4d63423106b4e686696962
MD5 1fa618bc1133f2933c5fb144de693db1
SHA1 c5489b50f7816213d62f8a7bc5c3fd56ee36351f
SHA512 a9de952fa3b59f5eef0b1673faff07b324803730096047dbeac1e24837dd6469e6d7cd1aa7d2cf56f0194a5d2e37ea2bfab0749d52ac00e3a0b12299f935a324
SSDEEP 49152:nQdPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9PAMEcaE:QRoBhz1aRxcSUDk36SAEdhvxWa9P5
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 02c77661bf747f40ee9979dbd44885df8b337b9e4a546f385855343ba5a92c5c
MD5 fa5998e94530ad9f75734f4a33e47b59
SHA1 302b9ec84a6c783fdcecb5a013bdb39770d533a1
SHA512 466cb61e6bbf06b612f924e818e9a0101ae72cda214ded01175b9396a7d379efc17e5115c3c1babcd85656324a7b284acfa622e140714863ba8376150850062b
SSDEEP 49152:+njQdPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9PAMEcaE:q8RoBhz1aRxcSUDk36SAEdhvxWa9P5
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 02c77661bf747f40ee9979dbd44885df8b337b9e4a546f385855343ba5a92c5c
MD5 fa5998e94530ad9f75734f4a33e47b59
SHA1 302b9ec84a6c783fdcecb5a013bdb39770d533a1
SHA512 466cb61e6bbf06b612f924e818e9a0101ae72cda214ded01175b9396a7d379efc17e5115c3c1babcd85656324a7b284acfa622e140714863ba8376150850062b
SSDEEP 49152:+njQdPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9PAMEcaE:q8RoBhz1aRxcSUDk36SAEdhvxWa9P5
MD5 SHA1 SHA512 SSDEEP

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 4c3932c024d000297e5dd33567e8fa05ebd42defbd4d63423106b4e686696962
MD5 1fa618bc1133f2933c5fb144de693db1
SHA1 c5489b50f7816213d62f8a7bc5c3fd56ee36351f
SHA512 a9de952fa3b59f5eef0b1673faff07b324803730096047dbeac1e24837dd6469e6d7cd1aa7d2cf56f0194a5d2e37ea2bfab0749d52ac00e3a0b12299f935a324
SSDEEP 49152:nQdPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9PAMEcaE:QRoBhz1aRxcSUDk36SAEdhvxWa9P5
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4480-134-0x0000000000400000-0x0000000000A70000-memory.dmp

Download

memory/4480-139-0x0000000000400000-0x0000000000A70000-memory.dmp

Download

memory/4792-140-0x0000000000400000-0x0000000000A70000-memory.dmp

Download

memory/4792-141-0x0000000000400000-0x0000000000A70000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads