wannacry | 68c3bede98e8a2c5dfecea4e932078337c700b73e6e9cfc0925d13e93f2163fd

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220718-en
resource tags

arch:x64arch:x86image:win10v2004-20220718-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2022, 04:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bcba09e4a9bf78cd5a4336c6a6bc9ea3.dll
Size 5.0MB
Sample220720-ex4vmabgc2
SHA256 68c3bede98e8a2c5dfecea4e932078337c700b73e6e9cfc0925d13e93f2163fd
MD5 bcba09e4a9bf78cd5a4336c6a6bc9ea3
SHA1 5bb97151b3efb9ae3918ee994904269f37f4899d
SHA512 1382c13e5a458bca7eeeb8f8d92b79d8ccb783af6ade12866e391c7315eaa9db4d9e795f520aee754f2ad1073e83f9aacbfa0951ebbf9190c7a395197222f621
MD5 SHA1 SHA512

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (2685) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Executes dropped EXE 3 IoCs

pid	Process
2852	mssecsvc.exe
3524	mssecsvc.exe
4796	tasksche.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4092 wrote to memory of 3104	4092	rundll32.exe	77
PID 4092 wrote to memory of 3104	4092	rundll32.exe	77
PID 4092 wrote to memory of 3104	4092	rundll32.exe	77
PID 3104 wrote to memory of 2852	3104	rundll32.exe	78
PID 3104 wrote to memory of 2852	3104	rundll32.exe	78
PID 3104 wrote to memory of 2852	3104	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bcba09e4a9bf78cd5a4336c6a6bc9ea3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bcba09e4a9bf78cd5a4336c6a6bc9ea3.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:3104
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:2852
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:4796

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:3524

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvc.exe

Path C:\WINDOWS\mssecsvc.exe
Size 3.6MB
SHA256 450e48a019622398d825d2e6e0b8b174f584b0950485567a3e2648a1d0136708
MD5 98e833799a16c9e0f7be81a67932cf4c
SHA1 8bbe449fb6b17276dff759b2bc0b7c1a2bbf3230
SHA512 834d33c43ad0bfec607bf1dc083a6016ec0a35998ffff73848f82982876593f22793950208750d20b328cc2538922978e619a6030f5c92d5a5d7c6df4ae1ee7b
SSDEEP 49152:2nAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9:yDqPoBhz1aRxcSUDk36SAEdhvxWa9
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 450e48a019622398d825d2e6e0b8b174f584b0950485567a3e2648a1d0136708
MD5 98e833799a16c9e0f7be81a67932cf4c
SHA1 8bbe449fb6b17276dff759b2bc0b7c1a2bbf3230
SHA512 834d33c43ad0bfec607bf1dc083a6016ec0a35998ffff73848f82982876593f22793950208750d20b328cc2538922978e619a6030f5c92d5a5d7c6df4ae1ee7b
SSDEEP 49152:2nAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9:yDqPoBhz1aRxcSUDk36SAEdhvxWa9
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 450e48a019622398d825d2e6e0b8b174f584b0950485567a3e2648a1d0136708
MD5 98e833799a16c9e0f7be81a67932cf4c
SHA1 8bbe449fb6b17276dff759b2bc0b7c1a2bbf3230
SHA512 834d33c43ad0bfec607bf1dc083a6016ec0a35998ffff73848f82982876593f22793950208750d20b328cc2538922978e619a6030f5c92d5a5d7c6df4ae1ee7b
SSDEEP 49152:2nAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9:yDqPoBhz1aRxcSUDk36SAEdhvxWa9
MD5 SHA1 SHA512 SSDEEP

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 52efab62b01da6fd4870c1064d7b326a284403d68dd627b434f1eb4a6194d4a3
MD5 f8c47c599d3ede4372209ee11c5978a8
SHA1 b34db2c2ef0b2567ce870e267860b513de45228a
SHA512 9f93a1e06bd15435b9363dc5734be8861783d19cc01ae32d3b66f8271a8fc394d650ad63fa37fd1ed7f6b023f71ccd3ee1f2cfd37fe550903a95d6059f4e5353
SSDEEP 49152:nQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9:QqPoBhz1aRxcSUDk36SAEdhvxWa9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads