wannacry | 6086ceb5624ff6f841f35a6b75ae823288e7385c2ab3076b45e35a7b961c4da7

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220718-en
resource tags

arch:x64arch:x86image:win10v2004-20220718-enlocale:en-usos:windows10-2004-x64system
submitted
20-07-2022 03:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c881745e136cd982aee1cb9edffb0020.dll
Size

5.0MB
MD5

c881745e136cd982aee1cb9edffb0020
SHA1

962cd2f8af7855570494551376341e548fecc0ea
SHA256

6086ceb5624ff6f841f35a6b75ae823288e7385c2ab3076b45e35a7b961c4da7
SHA512

67c689326c4f7b6b4209cdfb22283551f782be71f2cd6119b4fb4abe7fa019c5f47f475ffc55429bdfcd8f87a105e5ead1552b0079347648e7cf658e7bb0b5dd

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3188) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Executes dropped EXE 3 IoCs

Processes:

mssecsvc.exemssecsvc.exetasksche.exe

pid process

1352 mssecsvc.exe
3048 mssecsvc.exe
2904 tasksche.exe
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Drops file in Windows directory 2 IoCs

Processes:

rundll32.exemssecsvc.exe

description ioc process

File created C:\WINDOWS\mssecsvc.exe rundll32.exe
File created C:\WINDOWS\tasksche.exe mssecsvc.exe

pid	process
1352	mssecsvc.exe
3048	mssecsvc.exe
2904	tasksche.exe

description	ioc	process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

mssecsvc.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2716 wrote to memory of 416	2716	rundll32.exe	rundll32.exe
PID 2716 wrote to memory of 416	2716	rundll32.exe	rundll32.exe
PID 2716 wrote to memory of 416	2716	rundll32.exe	rundll32.exe
PID 416 wrote to memory of 1352	416	rundll32.exe	mssecsvc.exe
PID 416 wrote to memory of 1352	416	rundll32.exe	mssecsvc.exe
PID 416 wrote to memory of 1352	416	rundll32.exe	mssecsvc.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c881745e136cd982aee1cb9edffb0020.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2716

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c881745e136cd982aee1cb9edffb0020.dll,#1
2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:416

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe
3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1352

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
4⤵
- Executes dropped EXE
PID:2904

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:3048

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\mssecsvc.exe

Filesize
3.6MB

MD5
93ceb860c9f755d2437af5c0286a2678

SHA1
0f273760924065c9eb0edf2c719103b8abcef974

SHA256
9a8fb46cd6b8b8fc0846b1c8ec72a09948b203111e2945b6bda9b4326e4ff2eb

SHA512
fa2155e7ee2d69e3eabda47e0a32c8ee8fa6f9aa0881c95d00cd441dbfe0291758bf4b0571e4b7e9bb2945aa897fda6036d5102b64c6d8c72e8086b41b040708

Download Submit
C:\Windows\mssecsvc.exe

Filesize
3.6MB

MD5
93ceb860c9f755d2437af5c0286a2678

SHA1
0f273760924065c9eb0edf2c719103b8abcef974

SHA256
9a8fb46cd6b8b8fc0846b1c8ec72a09948b203111e2945b6bda9b4326e4ff2eb

SHA512
fa2155e7ee2d69e3eabda47e0a32c8ee8fa6f9aa0881c95d00cd441dbfe0291758bf4b0571e4b7e9bb2945aa897fda6036d5102b64c6d8c72e8086b41b040708

Download Submit
C:\Windows\mssecsvc.exe

Filesize
3.6MB

MD5
93ceb860c9f755d2437af5c0286a2678

SHA1
0f273760924065c9eb0edf2c719103b8abcef974

SHA256
9a8fb46cd6b8b8fc0846b1c8ec72a09948b203111e2945b6bda9b4326e4ff2eb

SHA512
fa2155e7ee2d69e3eabda47e0a32c8ee8fa6f9aa0881c95d00cd441dbfe0291758bf4b0571e4b7e9bb2945aa897fda6036d5102b64c6d8c72e8086b41b040708

Download Submit
C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
97bbd2ece4c729bb205791acdb78f4fd

SHA1
c4d9a76ceb0ba239e1836ea1cf0f667ce0e0b5d6

SHA256
1e268628cb68557ce923d7a9011dec0d8a56d59c791da278a977d5e9e52e4a9d

SHA512
351f673d22311df3408b87ab96fd8e5659abbd25f5dda3d2d4116ff58acd9d43c701fa6bdc29449e75dd66b143e7c9db737a9154d636cb7c5ef7fef16d7acb8f

Download Submit
memory/416-130-0x0000000000000000-mapping.dmp

Download
memory/1352-131-0x0000000000000000-mapping.dmp

Download