wannacry | e731a40736374c87eabcacd5826396756b0cf469edf30311fbfe34aeffea5446

Analysis

max time kernel
151s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
resource tags

arch:x64arch:x86image:win10v2004-20220414-enlocale:en-usos:windows10-2004-x64system
submitted
20-07-2022 01:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

867a36244ecf57e3b1894fe6b91cd2ce.dll
Size

5.0MB
MD5

867a36244ecf57e3b1894fe6b91cd2ce
SHA1

7ab48690ef8252a062f1974ae177008af744c586
SHA256

e731a40736374c87eabcacd5826396756b0cf469edf30311fbfe34aeffea5446
SHA512

75aad2a78fb539b348cc49b09d8848bf2922a115460ebd7670e1d4912bb3dd4d695d71aecdb838cd43b0878489a0af472664d674bc2a582172aa286015473ce3

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3118) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Executes dropped EXE 3 IoCs

Processes:

mssecsvc.exemssecsvc.exetasksche.exe

pid process

1252 mssecsvc.exe
4196 mssecsvc.exe
4636 tasksche.exe
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Drops file in Windows directory 2 IoCs

Processes:

rundll32.exemssecsvc.exe

description ioc process

File created C:\WINDOWS\mssecsvc.exe rundll32.exe
File created C:\WINDOWS\tasksche.exe mssecsvc.exe

pid	process
1252	mssecsvc.exe
4196	mssecsvc.exe
4636	tasksche.exe

description	ioc	process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

mssecsvc.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 4484 wrote to memory of 988	4484	rundll32.exe	rundll32.exe
PID 4484 wrote to memory of 988	4484	rundll32.exe	rundll32.exe
PID 4484 wrote to memory of 988	4484	rundll32.exe	rundll32.exe
PID 988 wrote to memory of 1252	988	rundll32.exe	mssecsvc.exe
PID 988 wrote to memory of 1252	988	rundll32.exe	mssecsvc.exe
PID 988 wrote to memory of 1252	988	rundll32.exe	mssecsvc.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\867a36244ecf57e3b1894fe6b91cd2ce.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4484

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\867a36244ecf57e3b1894fe6b91cd2ce.dll,#1
2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:988

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe
3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1252

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
4⤵
- Executes dropped EXE
PID:4636

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4196

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\mssecsvc.exe
Filesize
3.6MB

MD5
eda979224125226e14430f733500d396

SHA1
449eac805d4d6650e2359c659510d3f6d5c8ec10

SHA256
345af5d882de7e430fd604456b14d9efa929c72769fd00f78647dda4a2677038

SHA512
59875dae0e41aceb54f9918747093748d030ba13b3607b0aadcd63b8bfb2a665c57229ef018bef6fb454d67ed0f21362c7d2bd1e913ef7cd18f1c98192ca3f60

Download Submit
C:\Windows\mssecsvc.exe
Filesize
3.6MB

MD5
eda979224125226e14430f733500d396

SHA1
449eac805d4d6650e2359c659510d3f6d5c8ec10

SHA256
345af5d882de7e430fd604456b14d9efa929c72769fd00f78647dda4a2677038

SHA512
59875dae0e41aceb54f9918747093748d030ba13b3607b0aadcd63b8bfb2a665c57229ef018bef6fb454d67ed0f21362c7d2bd1e913ef7cd18f1c98192ca3f60

Download Submit
C:\Windows\mssecsvc.exe
Filesize
3.6MB

MD5
eda979224125226e14430f733500d396

SHA1
449eac805d4d6650e2359c659510d3f6d5c8ec10

SHA256
345af5d882de7e430fd604456b14d9efa929c72769fd00f78647dda4a2677038

SHA512
59875dae0e41aceb54f9918747093748d030ba13b3607b0aadcd63b8bfb2a665c57229ef018bef6fb454d67ed0f21362c7d2bd1e913ef7cd18f1c98192ca3f60

Download Submit
C:\Windows\tasksche.exe
Filesize
3.4MB

MD5
f4eb85b271eae6f15c4a9b13a2e5b752

SHA1
b3693583e092709b54b71559b8724025656ac1d4

SHA256
362c6c91624f52e3ef36d55d74f7bd7228d5cbf4d676c0d7775f6afb91cecb2d

SHA512
863d81575222674b45d6c1f135fb02c9f83a325f5fcb1d5d8eb178539414140979e33ec2159ca0741f12c5d52a0a0f56b796e6b8c5178f22ce3e6a550e652f08

Download Submit
memory/988-130-0x0000000000000000-mapping.dmp

Download
memory/1252-131-0x0000000000000000-mapping.dmp

Download