wannacry | cf5ddb5dedea0104a3fc464c822e6181a9dd9fa6e27e713c54af0eafb7c5faf0

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
resource tags

arch:x64arch:x86image:win10v2004-20220414-enlocale:en-usos:windows10-2004-x64system
submitted
20-07-2022 02:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a55b9addb2447db1882a3ae995a70151.dll
Size

5.0MB
MD5

a55b9addb2447db1882a3ae995a70151
SHA1

f8d5a24a90ae78bece5f280852e0f393757fc685
SHA256

cf5ddb5dedea0104a3fc464c822e6181a9dd9fa6e27e713c54af0eafb7c5faf0
SHA512

a2a1ca078e5dc4a5060547948d87a41c22186eba6b671f840bd6ddfefad257162fa896f56865092cf85cc5aded76324fd4a27c11c5ef1e36910f5dcc1cd6f4d8

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3276) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Executes dropped EXE 3 IoCs

Processes:

mssecsvc.exemssecsvc.exetasksche.exe

pid process

4904 mssecsvc.exe
1608 mssecsvc.exe
1528 tasksche.exe
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Drops file in Windows directory 2 IoCs

Processes:

rundll32.exemssecsvc.exe

description ioc process

File created C:\WINDOWS\mssecsvc.exe rundll32.exe
File created C:\WINDOWS\tasksche.exe mssecsvc.exe

pid	process
4904	mssecsvc.exe
1608	mssecsvc.exe
1528	tasksche.exe

description	ioc	process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

mssecsvc.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 4216 wrote to memory of 4476	4216	rundll32.exe	rundll32.exe
PID 4216 wrote to memory of 4476	4216	rundll32.exe	rundll32.exe
PID 4216 wrote to memory of 4476	4216	rundll32.exe	rundll32.exe
PID 4476 wrote to memory of 4904	4476	rundll32.exe	mssecsvc.exe
PID 4476 wrote to memory of 4904	4476	rundll32.exe	mssecsvc.exe
PID 4476 wrote to memory of 4904	4476	rundll32.exe	mssecsvc.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a55b9addb2447db1882a3ae995a70151.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4216

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a55b9addb2447db1882a3ae995a70151.dll,#1
2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4476

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe
3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4904

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
4⤵
- Executes dropped EXE
PID:1528

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:1608

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\mssecsvc.exe

Filesize
3.6MB

MD5
478abb44dbba06e87decd2df49f3d986

SHA1
0d1bdc648b6fe87652fd4f299ebb1eac821dfef3

SHA256
a90873267deb6777193d65a390752e86b6a1bbf3523cfb28c266139e24ed69f8

SHA512
7a3a0ad0207aebd5971c9ef36dff7ca0183126643040ecf60ea67b208c99ad622d5bff6ac972bebe6ed7d16d069c801f264a422bd25110efb7d3ed5550715a0f

Download Submit
C:\Windows\mssecsvc.exe

Filesize
3.6MB

MD5
478abb44dbba06e87decd2df49f3d986

SHA1
0d1bdc648b6fe87652fd4f299ebb1eac821dfef3

SHA256
a90873267deb6777193d65a390752e86b6a1bbf3523cfb28c266139e24ed69f8

SHA512
7a3a0ad0207aebd5971c9ef36dff7ca0183126643040ecf60ea67b208c99ad622d5bff6ac972bebe6ed7d16d069c801f264a422bd25110efb7d3ed5550715a0f

Download Submit
C:\Windows\mssecsvc.exe

Filesize
3.6MB

MD5
478abb44dbba06e87decd2df49f3d986

SHA1
0d1bdc648b6fe87652fd4f299ebb1eac821dfef3

SHA256
a90873267deb6777193d65a390752e86b6a1bbf3523cfb28c266139e24ed69f8

SHA512
7a3a0ad0207aebd5971c9ef36dff7ca0183126643040ecf60ea67b208c99ad622d5bff6ac972bebe6ed7d16d069c801f264a422bd25110efb7d3ed5550715a0f

Download Submit
C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
3233aced9279ef54267c479bba665b90

SHA1
0b2cc142386641901511269503cdf6f641fad305

SHA256
f60f8a6bcaf1384a0d6a76d3e88007a8604560b263d2b8aeee06fd74c9ee5b3b

SHA512
55f25c51ffb89d46f2a7d2ed9b67701e178bd68e74b71d757d5fa14bd9530a427104fc36116633033ead762ecf7960ab96429f5b0a085a701001c6832ba4555e

Download Submit
memory/4476-131-0x0000000000000000-mapping.dmp

Download
memory/4904-132-0x0000000000000000-mapping.dmp

Download