wannacry | a0ee36d49a60e9f30bab6f7092a10bb9b258ca12fdb39e259d96b9a8c20a04bb

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
resource tags

arch:x64arch:x86image:win10v2004-20220414-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2022, 02:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2ac5712639a1d50fc079a26f6703062e.dll
Size 5.0MB
Sample220720-cykf9sbfap
SHA256 a0ee36d49a60e9f30bab6f7092a10bb9b258ca12fdb39e259d96b9a8c20a04bb
MD5 2ac5712639a1d50fc079a26f6703062e
SHA1 249db5028c2b53c257e383984288f3ad38264852
SHA512 9b6863cada9391794d14cce12d8ca24cd585cabea74f7706d4a94ad5b2cfd7ad406d53201d6930af072ba8327c3398ee7efb85362472343c22e6778fbf16d667
MD5 SHA1 SHA512

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3273) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Executes dropped EXE 3 IoCs

pid	Process
2200	mssecsvc.exe
4340	mssecsvc.exe
1000	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3196 wrote to memory of 1432	3196	rundll32.exe	79
PID 3196 wrote to memory of 1432	3196	rundll32.exe	79
PID 3196 wrote to memory of 1432	3196	rundll32.exe	79
PID 1432 wrote to memory of 2200	1432	rundll32.exe	80
PID 1432 wrote to memory of 2200	1432	rundll32.exe	80
PID 1432 wrote to memory of 2200	1432	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ac5712639a1d50fc079a26f6703062e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3196
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ac5712639a1d50fc079a26f6703062e.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1432
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:2200
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:1000

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4340

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvc.exe

Path C:\WINDOWS\mssecsvc.exe
Size 3.6MB
SHA256 20fd8e808c7ed043017578b7423e1ad5d27ca8935b73280ff8888568f1c1fa3b
MD5 e1fff4bb225513a9ef2a48d766b6e93e
SHA1 030ca1bc092fda2a7d8393fa22a8bbee1d822ad8
SHA512 7227405bb535075ee71f85c85d8bcfb9f55a5d055966568f116297b9c845a3ad3de9eb7f51023e89ca32af68f64a942bd90de42c073165fdc202f6ce0911bfd0
SSDEEP 49152:2nAQqMSPbcBVQejl+TSqTdX1HkQo6SAA:yDqPoBhhcSUDk36SA
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 20fd8e808c7ed043017578b7423e1ad5d27ca8935b73280ff8888568f1c1fa3b
MD5 e1fff4bb225513a9ef2a48d766b6e93e
SHA1 030ca1bc092fda2a7d8393fa22a8bbee1d822ad8
SHA512 7227405bb535075ee71f85c85d8bcfb9f55a5d055966568f116297b9c845a3ad3de9eb7f51023e89ca32af68f64a942bd90de42c073165fdc202f6ce0911bfd0
SSDEEP 49152:2nAQqMSPbcBVQejl+TSqTdX1HkQo6SAA:yDqPoBhhcSUDk36SA
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 20fd8e808c7ed043017578b7423e1ad5d27ca8935b73280ff8888568f1c1fa3b
MD5 e1fff4bb225513a9ef2a48d766b6e93e
SHA1 030ca1bc092fda2a7d8393fa22a8bbee1d822ad8
SHA512 7227405bb535075ee71f85c85d8bcfb9f55a5d055966568f116297b9c845a3ad3de9eb7f51023e89ca32af68f64a942bd90de42c073165fdc202f6ce0911bfd0
SSDEEP 49152:2nAQqMSPbcBVQejl+TSqTdX1HkQo6SAA:yDqPoBhhcSUDk36SA
MD5 SHA1 SHA512 SSDEEP

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 f751c3278c83adff04b0aea8ae8497b4a9ea487a88b8f9c0c419909db76e37d0
MD5 e2374281b38f6937433d31fc4209de4c
SHA1 38ea415ffa6d8a9ca73e2cca81ed0a75cbf9cef8
SHA512 cd37739b1096365573aeba4264cc30c00543d2c248a3b97c414cd20394e542157622bd76516e9b17d5ef9b9a32be014105ddd4641a9f83dfd717d7c1695a9d04
SSDEEP 24576:nQhfdmMSirYbcMNgef0QeQjGl+vbOSSqTPVXmiHkQg6eX6SASk+K:nQqMSPbcBVQejl+TSqTdX1HkQo6SAA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads