wannacry | 23f6479727d003cf908a021cdaa08a766d0b9aa6b84d279698a47833cb28ef7e

Analysis

max time kernel
151s
max time network
154s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
20/07/2022, 04:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c16751ee056198949d3e88cd51ffbbb7.dll
Size 5.0MB
Sample220720-enhk2abfb9
SHA256 23f6479727d003cf908a021cdaa08a766d0b9aa6b84d279698a47833cb28ef7e
MD5 c16751ee056198949d3e88cd51ffbbb7
SHA1 d3bb0f320d204807431927bbe74bd80e07e51933
SHA512 fd7f5aef43ac7549f175381d79e02ae7197b9740e0402de7be8ef389525c25e376e49b37bf82329ce1c82e7b37a3d388cc131c426bb0e58c4edf1d017f722a01
MD5 SHA1 SHA512

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (1234) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Executes dropped EXE 3 IoCs

pid	Process
1064	mssecsvc.exe
932	mssecsvc.exe
2028	tasksche.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	mssecsvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvc.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 848	1420	rundll32.exe	27
PID 1420 wrote to memory of 848	1420	rundll32.exe	27
PID 1420 wrote to memory of 848	1420	rundll32.exe	27
PID 1420 wrote to memory of 848	1420	rundll32.exe	27
PID 1420 wrote to memory of 848	1420	rundll32.exe	27
PID 1420 wrote to memory of 848	1420	rundll32.exe	27
PID 1420 wrote to memory of 848	1420	rundll32.exe	27
PID 848 wrote to memory of 1064	848	rundll32.exe	28
PID 848 wrote to memory of 1064	848	rundll32.exe	28
PID 848 wrote to memory of 1064	848	rundll32.exe	28
PID 848 wrote to memory of 1064	848	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c16751ee056198949d3e88cd51ffbbb7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c16751ee056198949d3e88cd51ffbbb7.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:848
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:1064
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:2028

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:932

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvc.exe

Path C:\WINDOWS\mssecsvc.exe
Size 3.6MB
SHA256 031d43cde1da7ac350008e2691b51d7d75e5fb6d8b45a4851c854f7756ef1965
MD5 391ef7867a262be875e10994d354b1e1
SHA1 148483be72c6e0fb1a0039933b7d60626910fa5d
SHA512 ac068f9018f32ad963b8c129abd14dda910401b461957ce8da87b29c69b0c13a8083dae7de9c035bb2b8677d938078cd1314d5a1b6dab50c60c0a96425d9a2d6
SSDEEP 49152:wnjQ57xJM0H9PAMEcaEau3R8yAH1plAHI:w8xxWa9P593R8yAVp2HI
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 031d43cde1da7ac350008e2691b51d7d75e5fb6d8b45a4851c854f7756ef1965
MD5 391ef7867a262be875e10994d354b1e1
SHA1 148483be72c6e0fb1a0039933b7d60626910fa5d
SHA512 ac068f9018f32ad963b8c129abd14dda910401b461957ce8da87b29c69b0c13a8083dae7de9c035bb2b8677d938078cd1314d5a1b6dab50c60c0a96425d9a2d6
SSDEEP 49152:wnjQ57xJM0H9PAMEcaEau3R8yAH1plAHI:w8xxWa9P593R8yAVp2HI
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 031d43cde1da7ac350008e2691b51d7d75e5fb6d8b45a4851c854f7756ef1965
MD5 391ef7867a262be875e10994d354b1e1
SHA1 148483be72c6e0fb1a0039933b7d60626910fa5d
SHA512 ac068f9018f32ad963b8c129abd14dda910401b461957ce8da87b29c69b0c13a8083dae7de9c035bb2b8677d938078cd1314d5a1b6dab50c60c0a96425d9a2d6
SSDEEP 49152:wnjQ57xJM0H9PAMEcaEau3R8yAH1plAHI:w8xxWa9P593R8yAVp2HI
MD5 SHA1 SHA512 SSDEEP

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 4593ed37840678fae92fed778e84b14bfab0ae157dba9977cda575b0dbdd0bc3
MD5 55d925321d8f07d9134a38cbd7bb4f7d
SHA1 2ba3bed322201f4b40b08547426ec6164b156fc6
SHA512 565f8ad681547947f5570844fc6d09a0c697817b0c8409ce567939ed96331dbbab263e6845b02c6b08b7f46c1de765867639895a8f5948f81881c0492eea927f
SSDEEP 24576:nQhfdA071LJMfcH9PO6LLuYAMEcpcL7nEaut/8uME7A4kqAH1pNZtA0p+9XEkj:nQ57xJM0H9PAMEcaEau3R8yAH1plAHj
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/848-55-0x0000000076291000-0x0000000076293000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads