wannacry | f2cf2c68920d3812d76104aa8388cfa07934c53a39e8f48e098a282ddccbfbcf

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220718-en
resource tags

arch:x64arch:x86image:win10v2004-20220718-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2022, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e54b3c74801bc99d032195f5e64b8631.dll
Size 5.0MB
Sample220720-ee3jvabed8
SHA256 f2cf2c68920d3812d76104aa8388cfa07934c53a39e8f48e098a282ddccbfbcf
MD5 e54b3c74801bc99d032195f5e64b8631
SHA1 30e28714c1e1217ba47e66a6b608a0acd53e530e
SHA512 cc6cd1da6cc2d41ea5a4bf94fe42f6182712a90032d1b5b783a267b1f211c5ecc2d64e5d79c45cae48e5fed39f3f71b017b51e23a95a95d93155d62d7852d62a
MD5 SHA1 SHA512

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3226) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Executes dropped EXE 3 IoCs

pid	Process
3572	mssecsvc.exe
4272	mssecsvc.exe
3312	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 3128	2768	rundll32.exe	79
PID 2768 wrote to memory of 3128	2768	rundll32.exe	79
PID 2768 wrote to memory of 3128	2768	rundll32.exe	79
PID 3128 wrote to memory of 3572	3128	rundll32.exe	80
PID 3128 wrote to memory of 3572	3128	rundll32.exe	80
PID 3128 wrote to memory of 3572	3128	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e54b3c74801bc99d032195f5e64b8631.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e54b3c74801bc99d032195f5e64b8631.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:3128
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:3572
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:3312

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4272

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvc.exe

Path C:\WINDOWS\mssecsvc.exe
Size 3.6MB
SHA256 ce45c82bcebe8ce436c3bcb4dc7813376af2df805314dc8633886298ac554baa
MD5 31dbf931fa56634182d8248472dce6e4
SHA1 a5edae7b62c53f08c67395ba5057b59bd51be8bb
SHA512 4512d72580f508672bd65babd341315b080309b129f50d78a93098fb569fbdb30ea7cd2da556944b128db61e67f1a534c6f1e178ddc38f53432d8d63ae1c82bd
SSDEEP 98304:XDqPoBhz1aU/xcEax7QY83EKx1eKOCXcn:XDqPe1DxY7j83PxISXcn
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 ce45c82bcebe8ce436c3bcb4dc7813376af2df805314dc8633886298ac554baa
MD5 31dbf931fa56634182d8248472dce6e4
SHA1 a5edae7b62c53f08c67395ba5057b59bd51be8bb
SHA512 4512d72580f508672bd65babd341315b080309b129f50d78a93098fb569fbdb30ea7cd2da556944b128db61e67f1a534c6f1e178ddc38f53432d8d63ae1c82bd
SSDEEP 98304:XDqPoBhz1aU/xcEax7QY83EKx1eKOCXcn:XDqPe1DxY7j83PxISXcn
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 ce45c82bcebe8ce436c3bcb4dc7813376af2df805314dc8633886298ac554baa
MD5 31dbf931fa56634182d8248472dce6e4
SHA1 a5edae7b62c53f08c67395ba5057b59bd51be8bb
SHA512 4512d72580f508672bd65babd341315b080309b129f50d78a93098fb569fbdb30ea7cd2da556944b128db61e67f1a534c6f1e178ddc38f53432d8d63ae1c82bd
SSDEEP 98304:XDqPoBhz1aU/xcEax7QY83EKx1eKOCXcn:XDqPe1DxY7j83PxISXcn
MD5 SHA1 SHA512 SSDEEP

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 2d9ed5674045816c685ff78311cf11c4a91e2610f1fe7f4984bd1e293d0c357c
MD5 d6df47df1b1a47a63610457b53225561
SHA1 be1d00bc96a6fc9ca2b0b4c3dbfc02172fe3c8f1
SHA512 537d779f15e9d42eb5cfc7a11ca2b60c0e1c6169048031c8478efd7868844af15c6b2ba34678bf0ca4c97b68994aec099bb4064027c2e07da41d8e577464e889
SSDEEP 49152:nQqMSPbcBVQej/1INo//fZAXEall988QY9uNg7aelKx1tku3OC8GcglK:QqPoBhz1aU/xcEax7QY83EKx1eKOCXcJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads