wannacry | 9a840996e18efb6729cf0b2f5c53b251dcccfffee9874bdd3626d8ba9c6180f0

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220718-en
resource tags

arch:x64arch:x86image:win10v2004-20220718-enlocale:en-usos:windows10-2004-x64system
submitted
20-07-2022 02:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d33512decfb5f2c8c423e5bd627bcdc8.dll
Size

5.0MB
MD5

d33512decfb5f2c8c423e5bd627bcdc8
SHA1

8675d0fa059e1fbc2e228f04ab9e80fe3e60b2d2
SHA256

9a840996e18efb6729cf0b2f5c53b251dcccfffee9874bdd3626d8ba9c6180f0
SHA512

655f16fec02571e19e6ac3be8a7f6160fb5aff79541f345e14fd8cf341823db525d24a40f584e6e631f072331897d657fb5cc8dbd89d18924521804489f61a02

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3161) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Executes dropped EXE 3 IoCs

Processes:

mssecsvc.exemssecsvc.exetasksche.exe

pid process

3800 mssecsvc.exe
2436 mssecsvc.exe
2236 tasksche.exe
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Drops file in Windows directory 2 IoCs

Processes:

rundll32.exemssecsvc.exe

description ioc process

File created C:\WINDOWS\mssecsvc.exe rundll32.exe
File created C:\WINDOWS\tasksche.exe mssecsvc.exe

pid	process
3800	mssecsvc.exe
2436	mssecsvc.exe
2236	tasksche.exe

description	ioc	process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

mssecsvc.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2484 wrote to memory of 2352	2484	rundll32.exe	rundll32.exe
PID 2484 wrote to memory of 2352	2484	rundll32.exe	rundll32.exe
PID 2484 wrote to memory of 2352	2484	rundll32.exe	rundll32.exe
PID 2352 wrote to memory of 3800	2352	rundll32.exe	mssecsvc.exe
PID 2352 wrote to memory of 3800	2352	rundll32.exe	mssecsvc.exe
PID 2352 wrote to memory of 3800	2352	rundll32.exe	mssecsvc.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d33512decfb5f2c8c423e5bd627bcdc8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2484

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d33512decfb5f2c8c423e5bd627bcdc8.dll,#1
2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2352

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe
3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3800

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
4⤵
- Executes dropped EXE
PID:2236

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:2436

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\mssecsvc.exe

Filesize
3.6MB

MD5
2863611c1b10c05572f38f38b669b800

SHA1
55d54bacab6358e98daca2b75f4e2945f4d376c7

SHA256
9eb7dccba1ca32e3528218ac3ece6705b7ac0c18c4d2ffa177d012557efddcb2

SHA512
77ffc098a1bbc709a71fd166c602b517a050e5b26d74dbd0c94f31e7a71421505717c95bfd46f83c182e94a9bac0ec194ac077eac81b06ef7884a6d3f6467fbb

Download Submit
C:\Windows\mssecsvc.exe

Filesize
3.6MB

MD5
2863611c1b10c05572f38f38b669b800

SHA1
55d54bacab6358e98daca2b75f4e2945f4d376c7

SHA256
9eb7dccba1ca32e3528218ac3ece6705b7ac0c18c4d2ffa177d012557efddcb2

SHA512
77ffc098a1bbc709a71fd166c602b517a050e5b26d74dbd0c94f31e7a71421505717c95bfd46f83c182e94a9bac0ec194ac077eac81b06ef7884a6d3f6467fbb

Download Submit
C:\Windows\mssecsvc.exe

Filesize
3.6MB

MD5
2863611c1b10c05572f38f38b669b800

SHA1
55d54bacab6358e98daca2b75f4e2945f4d376c7

SHA256
9eb7dccba1ca32e3528218ac3ece6705b7ac0c18c4d2ffa177d012557efddcb2

SHA512
77ffc098a1bbc709a71fd166c602b517a050e5b26d74dbd0c94f31e7a71421505717c95bfd46f83c182e94a9bac0ec194ac077eac81b06ef7884a6d3f6467fbb

Download Submit
C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
33597668502c3bf358c8006e932f8a4e

SHA1
a84bf3fade231e537c7ec98661555b90be18eb22

SHA256
15f7bb33ab359936d36b2873bb559da97c5635ad704f9e0e79020145058e9a65

SHA512
b5adf4cd47b3612533925d62a06388dd68ef2162ec1d78ea870b1d0b0539722c62b8cc856b2637cf584b6fdfbe0023e140b1e0e060b1a6374f514ca576fa9cf9

Download Submit
memory/2352-130-0x0000000000000000-mapping.dmp

Download
memory/3800-131-0x0000000000000000-mapping.dmp

Download