wannacry | 844313aca3cb7a3b9505101d795db0e30017ebb2d2f3e3456bd26c4957fae152

Analysis

max time kernel
151s
max time network
155s
platform
windows7_x64
resource
win7-20220715-en
resource tags

arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
submitted
20/07/2022, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
de5e5585f3e65d16cc19af7b2daf3090.dll
Size 5.0MB
Sample220720-e9dtzacdhj
SHA256 844313aca3cb7a3b9505101d795db0e30017ebb2d2f3e3456bd26c4957fae152
MD5 de5e5585f3e65d16cc19af7b2daf3090
SHA1 7c3eb7cc2add4639a14f6229093c82b1c991dab7
SHA512 46e31062694d793dccc5764fca50a302cffa13aa2388357177027593741de8659d394943d9e499a1bc694d5e4655baf549dd0dfb0276c9c8da4eb734b2e5813b
MD5 SHA1 SHA512

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (1302) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Executes dropped EXE 3 IoCs

pid	Process
1656	mssecsvc.exe
1312	mssecsvc.exe
1268	tasksche.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	mssecsvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvc.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 736 wrote to memory of 1920	736	rundll32.exe	27
PID 736 wrote to memory of 1920	736	rundll32.exe	27
PID 736 wrote to memory of 1920	736	rundll32.exe	27
PID 736 wrote to memory of 1920	736	rundll32.exe	27
PID 736 wrote to memory of 1920	736	rundll32.exe	27
PID 736 wrote to memory of 1920	736	rundll32.exe	27
PID 736 wrote to memory of 1920	736	rundll32.exe	27
PID 1920 wrote to memory of 1656	1920	rundll32.exe	28
PID 1920 wrote to memory of 1656	1920	rundll32.exe	28
PID 1920 wrote to memory of 1656	1920	rundll32.exe	28
PID 1920 wrote to memory of 1656	1920	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\de5e5585f3e65d16cc19af7b2daf3090.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:736
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\de5e5585f3e65d16cc19af7b2daf3090.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1920
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:1656
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:1268

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1312

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvc.exe

Path C:\WINDOWS\mssecsvc.exe
Size 3.6MB
SHA256 30540c3446344ad9c7d16fc22937050cac13f7faebec0712e74b7b3766309c05
MD5 83dde909f2bd8df0cc79e54f81d6c1ce
SHA1 0b21909c33eab4df18983fd2e374313747fa453a
SHA512 87152d505618273b0d6fab968d42f0e05d04b3b535ff6038cf0528c5092202a8d09fc505f5d950c46f89bf7ca9fbc535265b7770183cf09ba47fe79dbbdcf616
SSDEEP 98304:Z8qPoBhz1aRxcSUDk36SAEdhvxWa9P593RU:Z8qPe1Cxcxk3ZAEUadzRU
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 30540c3446344ad9c7d16fc22937050cac13f7faebec0712e74b7b3766309c05
MD5 83dde909f2bd8df0cc79e54f81d6c1ce
SHA1 0b21909c33eab4df18983fd2e374313747fa453a
SHA512 87152d505618273b0d6fab968d42f0e05d04b3b535ff6038cf0528c5092202a8d09fc505f5d950c46f89bf7ca9fbc535265b7770183cf09ba47fe79dbbdcf616
SSDEEP 98304:Z8qPoBhz1aRxcSUDk36SAEdhvxWa9P593RU:Z8qPe1Cxcxk3ZAEUadzRU
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 30540c3446344ad9c7d16fc22937050cac13f7faebec0712e74b7b3766309c05
MD5 83dde909f2bd8df0cc79e54f81d6c1ce
SHA1 0b21909c33eab4df18983fd2e374313747fa453a
SHA512 87152d505618273b0d6fab968d42f0e05d04b3b535ff6038cf0528c5092202a8d09fc505f5d950c46f89bf7ca9fbc535265b7770183cf09ba47fe79dbbdcf616
SSDEEP 98304:Z8qPoBhz1aRxcSUDk36SAEdhvxWa9P593RU:Z8qPe1Cxcxk3ZAEUadzRU
MD5 SHA1 SHA512 SSDEEP

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 01b628fa60560c0cb4a332818cb380a65d0616d19976c084e0c3eaa433288b88
MD5 1fd3d102d83758e8317df2380821e807
SHA1 3709a9b48aee0d6039b4b3581be33f48d4919b79
SHA512 db0ee5b13e524f2182845aa94b8b1121749e87e48e75e5ba8fa26cae024216913d3a5904fb3544dfeefa49ecf76af5cf1324c410e6366a7197594e8e9e26025f
SSDEEP 98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593RH:QqPe1Cxcxk3ZAEUadzRH
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1920-55-0x00000000762B1000-0x00000000762B3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads