wannacry | 121185201c29380e366cdee4e00038fd7aedb191e67498ba97bf85c16e39db6c

Analysis

max time kernel
156s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20220718-en
resource tags

arch:x64arch:x86image:win10v2004-20220718-enlocale:en-usos:windows10-2004-x64system
submitted
20-07-2022 01:36

Target

9c27887058bdc8efa7761da28e613994.dll
Size

5.0MB
MD5

9c27887058bdc8efa7761da28e613994
SHA1

01be4b3c0fd62ff481450e646453d4e3651b5713
SHA256

121185201c29380e366cdee4e00038fd7aedb191e67498ba97bf85c16e39db6c
SHA512

59c6f7a6f592db777d7802faeef6f3507f4c7d4db9ea2edf4cd685d7220e0c5238cb7fa27b8bce3a2fa87a3fbd8caf4a510bb28efee0a9a0f4df593355ea2d7a

Score

10^/10

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (2849) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Executes dropped EXE 2 IoCs

Processes:

mssecsvr.exemssecsvr.exe

pid process

2172 mssecsvr.exe
3036 mssecsvr.exe
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Drops file in Windows directory 2 IoCs

Processes:

rundll32.exemssecsvr.exe

description ioc process

File created C:\WINDOWS\mssecsvr.exe rundll32.exe
File created C:\WINDOWS\tasksche.exe mssecsvr.exe

pid	process
2172	mssecsvr.exe
3036	mssecsvr.exe

description	ioc	process
File created	C:\WINDOWS\mssecsvr.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvr.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

mssecsvr.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvr.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1156 wrote to memory of 4412	1156	rundll32.exe	rundll32.exe
PID 1156 wrote to memory of 4412	1156	rundll32.exe	rundll32.exe
PID 1156 wrote to memory of 4412	1156	rundll32.exe	rundll32.exe
PID 4412 wrote to memory of 2172	4412	rundll32.exe	mssecsvr.exe
PID 4412 wrote to memory of 2172	4412	rundll32.exe	mssecsvr.exe
PID 4412 wrote to memory of 2172	4412	rundll32.exe	mssecsvr.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9c27887058bdc8efa7761da28e613994.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1156

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\WINDOWS\mssecsvr.exe
Filesize
2.2MB

MD5
074660125e8b575e6cb1a4af9094a7e9

SHA1
3aa024f4e7b5282c6b3450246492b29783017b6c

SHA256
b4c63d4a7eeffef514ca7be622e4d3331af935565ded5d233e8a21d27a481af4

SHA512
0494fe133dab8e1b7bf30f4ff6ee2ba0530e64324df44f86a253f763e152c8b6a2f329f0895bd145656deaa72d40221d6743f2adfc966887c2a0e0986b596de3

Download Submit
C:\Windows\mssecsvr.exe
Filesize
2.2MB

MD5
074660125e8b575e6cb1a4af9094a7e9

SHA1
3aa024f4e7b5282c6b3450246492b29783017b6c

SHA256
b4c63d4a7eeffef514ca7be622e4d3331af935565ded5d233e8a21d27a481af4

SHA512
0494fe133dab8e1b7bf30f4ff6ee2ba0530e64324df44f86a253f763e152c8b6a2f329f0895bd145656deaa72d40221d6743f2adfc966887c2a0e0986b596de3

Download Submit
C:\Windows\mssecsvr.exe
Filesize
2.2MB

MD5
074660125e8b575e6cb1a4af9094a7e9

SHA1
3aa024f4e7b5282c6b3450246492b29783017b6c

SHA256
b4c63d4a7eeffef514ca7be622e4d3331af935565ded5d233e8a21d27a481af4

SHA512
0494fe133dab8e1b7bf30f4ff6ee2ba0530e64324df44f86a253f763e152c8b6a2f329f0895bd145656deaa72d40221d6743f2adfc966887c2a0e0986b596de3

Download Submit
memory/2172-131-0x0000000000000000-mapping.dmp

Download
memory/4412-130-0x0000000000000000-mapping.dmp

Download