wannacry | 258b3f320f0548dea3d65fc7a9f99c962b1a11c0c0cf894115fb860495c94f90

Analysis

max time kernel
155s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20220718-en
resource tags

arch:x64arch:x86image:win10v2004-20220718-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2022, 02:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a07e202cc146dd5dc0b238a72e95fc9c.dll
Size 5.0MB
Sample220720-cmvg4abbdj
SHA256 258b3f320f0548dea3d65fc7a9f99c962b1a11c0c0cf894115fb860495c94f90
MD5 a07e202cc146dd5dc0b238a72e95fc9c
SHA1 83881af4942bed2de3b80a6c2382cecf25a5c1a6
SHA512 4f4af7b884678977ec7d39d83fa8b4817d173ed1341c5b0e7ea61453a907dafb679374ba2f8bcdb98da6595298288f8e5ea92557d91218e990ec2bc92b08a9e6
MD5 SHA1 SHA512

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (2519) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Executes dropped EXE 3 IoCs

pid	Process
3120	mssecsvc.exe
1632	mssecsvc.exe
4716	tasksche.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3104 wrote to memory of 3216	3104	rundll32.exe	76
PID 3104 wrote to memory of 3216	3104	rundll32.exe	76
PID 3104 wrote to memory of 3216	3104	rundll32.exe	76
PID 3216 wrote to memory of 3120	3216	rundll32.exe	77
PID 3216 wrote to memory of 3120	3216	rundll32.exe	77
PID 3216 wrote to memory of 3120	3216	rundll32.exe	77

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a07e202cc146dd5dc0b238a72e95fc9c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3104
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a07e202cc146dd5dc0b238a72e95fc9c.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:3216
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:3120
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:4716

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:1632

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvc.exe

Path C:\WINDOWS\mssecsvc.exe
Size 3.6MB
SHA256 51224e22dfca48144bd1a71085cbc6a03c0fa632132703c5afbee2a0387c6f1b
MD5 869c609bc935752a2215f257fa2e3584
SHA1 06604cf4d05a95c5abda74c26e66b44b2b6e8b96
SHA512 7498bc12f7319d4bfb8f14f4022f5b0f6b0d09f16c59dba43f3b8b6f40611cbcb629b601bb9c785da69bf2f0c0104adb1b490d8beca3df8420ad3e563a15e0f9
SSDEEP 98304:XDqPoBhz1aRxcSUDk36SAEdhvxWa9P5HBPI:XDqPe1Cxcxk3ZAEUadpBPI
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 51224e22dfca48144bd1a71085cbc6a03c0fa632132703c5afbee2a0387c6f1b
MD5 869c609bc935752a2215f257fa2e3584
SHA1 06604cf4d05a95c5abda74c26e66b44b2b6e8b96
SHA512 7498bc12f7319d4bfb8f14f4022f5b0f6b0d09f16c59dba43f3b8b6f40611cbcb629b601bb9c785da69bf2f0c0104adb1b490d8beca3df8420ad3e563a15e0f9
SSDEEP 98304:XDqPoBhz1aRxcSUDk36SAEdhvxWa9P5HBPI:XDqPe1Cxcxk3ZAEUadpBPI
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 51224e22dfca48144bd1a71085cbc6a03c0fa632132703c5afbee2a0387c6f1b
MD5 869c609bc935752a2215f257fa2e3584
SHA1 06604cf4d05a95c5abda74c26e66b44b2b6e8b96
SHA512 7498bc12f7319d4bfb8f14f4022f5b0f6b0d09f16c59dba43f3b8b6f40611cbcb629b601bb9c785da69bf2f0c0104adb1b490d8beca3df8420ad3e563a15e0f9
SSDEEP 98304:XDqPoBhz1aRxcSUDk36SAEdhvxWa9P5HBPI:XDqPe1Cxcxk3ZAEUadpBPI
MD5 SHA1 SHA512 SSDEEP

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 44b0bca51a73888c2b514a1ba113e5829bd09e67076f3040a75e588ed5da2e07
MD5 aa6b91ba01dc3f2bcd1edf06ce6b4c61
SHA1 d9805d0357863a2a9416b820b3a7f84add942db8
SHA512 6a7b6a0403eb439067852bf055a307f7c1c01f376fa5114a6f931af8cc797e299db9ca749fc11c70c1e440a637e259973650054934a5fcce6b1b6ced553f24ea
SSDEEP 98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P5HBPj:QqPe1Cxcxk3ZAEUadpBPj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads