wannacry | 71e5a4b325e2848229931f838f54c440fc6ed12c44274b9f8c85d14eea459d1c

Analysis

max time kernel
152s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220718-en
resource tags

arch:x64arch:x86image:win10v2004-20220718-enlocale:en-usos:windows10-2004-x64system
submitted
20-07-2022 02:56

Target

5bf40e2fc5e5cc0246dabbafcd2739fe.dll
Size

5.0MB
MD5

5bf40e2fc5e5cc0246dabbafcd2739fe
SHA1

9823558083e56b95d658bcde6c2202e9c6742026
SHA256

71e5a4b325e2848229931f838f54c440fc6ed12c44274b9f8c85d14eea459d1c
SHA512

a56ab6815557df8362d1eda5d405645ed40fd1d524d9f5aa7fb3667b0ff9cd12ae727b02baa47e49cee12bdad8d7a0b28bc3cf80617987c711a5078481771f70

Score

10^/10

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3169) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Executes dropped EXE 2 IoCs

Processes:

mssecsvr.exemssecsvr.exe

pid process

3528 mssecsvr.exe
1756 mssecsvr.exe
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Drops file in Windows directory 2 IoCs

Processes:

rundll32.exemssecsvr.exe

description ioc process

File created C:\WINDOWS\mssecsvr.exe rundll32.exe
File created C:\WINDOWS\tasksche.exe mssecsvr.exe

pid	process
3528	mssecsvr.exe
1756	mssecsvr.exe

description	ioc	process
File created	C:\WINDOWS\mssecsvr.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvr.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

mssecsvr.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvr.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 3448 wrote to memory of 2748	3448	rundll32.exe	rundll32.exe
PID 3448 wrote to memory of 2748	3448	rundll32.exe	rundll32.exe
PID 3448 wrote to memory of 2748	3448	rundll32.exe	rundll32.exe
PID 2748 wrote to memory of 3528	2748	rundll32.exe	mssecsvr.exe
PID 2748 wrote to memory of 3528	2748	rundll32.exe	mssecsvr.exe
PID 2748 wrote to memory of 3528	2748	rundll32.exe	mssecsvr.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5bf40e2fc5e5cc0246dabbafcd2739fe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3448

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\WINDOWS\mssecsvr.exe

Filesize
3.6MB

MD5
d8ccba7882c4bfe7baba94e01c34b7b0

SHA1
1c94cb73dc4667f79da0098234b1aaaa0f5eef67

SHA256
718d4b4413e021020918dd3b1bf0478f2163f0bcb813327b069787882d06a3d9

SHA512
574f2e70cb2f0bd5fc667039ed176f6a1d26bd97801cd397f85cc3db06d09dac56e12d0ffb4b9244364b7d89f756cffca84103518dc2781fb894c524201e862c

Download Submit
C:\Windows\mssecsvr.exe

Filesize
3.6MB

MD5
d8ccba7882c4bfe7baba94e01c34b7b0

SHA1
1c94cb73dc4667f79da0098234b1aaaa0f5eef67

SHA256
718d4b4413e021020918dd3b1bf0478f2163f0bcb813327b069787882d06a3d9

SHA512
574f2e70cb2f0bd5fc667039ed176f6a1d26bd97801cd397f85cc3db06d09dac56e12d0ffb4b9244364b7d89f756cffca84103518dc2781fb894c524201e862c

Download Submit
C:\Windows\mssecsvr.exe

Filesize
3.6MB

MD5
d8ccba7882c4bfe7baba94e01c34b7b0

SHA1
1c94cb73dc4667f79da0098234b1aaaa0f5eef67

SHA256
718d4b4413e021020918dd3b1bf0478f2163f0bcb813327b069787882d06a3d9

SHA512
574f2e70cb2f0bd5fc667039ed176f6a1d26bd97801cd397f85cc3db06d09dac56e12d0ffb4b9244364b7d89f756cffca84103518dc2781fb894c524201e862c

Download Submit
memory/2748-130-0x0000000000000000-mapping.dmp

Download
memory/3528-131-0x0000000000000000-mapping.dmp

Download