wannacry | 72a0be8dd079e30f7ff7adf7aa5885a5df11a637ae04549baca73f79d6f3f175

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
resource tags

arch:x64arch:x86image:win10v2004-20220414-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2022, 05:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ed5ba72fd6e92a9ccba7aa2d88922f71.dll
Size 5.0MB
Sample220720-f1fsmscbf3
SHA256 72a0be8dd079e30f7ff7adf7aa5885a5df11a637ae04549baca73f79d6f3f175
MD5 ed5ba72fd6e92a9ccba7aa2d88922f71
SHA1 b3dded1b78cc7e40d713b498c4fc0fe5b298f40d
SHA512 eab8e84bdf80c9590ddfb5255e10915f45bec07c9bbb5d475ff98571b27016d0a38db46fd91a76cf351ca4a92f31acc35a998477909915e8cf27fef5b2ded767
MD5 SHA1 SHA512

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3255) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Executes dropped EXE 2 IoCs

pid	Process
2528	mssecsvr.exe
4968	mssecsvr.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvr.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvr.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvr.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4620 wrote to memory of 1316	4620	rundll32.exe	80
PID 4620 wrote to memory of 1316	4620	rundll32.exe	80
PID 4620 wrote to memory of 1316	4620	rundll32.exe	80
PID 1316 wrote to memory of 2528	1316	rundll32.exe	81
PID 1316 wrote to memory of 2528	1316	rundll32.exe	81
PID 1316 wrote to memory of 2528	1316	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ed5ba72fd6e92a9ccba7aa2d88922f71.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4620
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ed5ba72fd6e92a9ccba7aa2d88922f71.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1316
- - C:\WINDOWS\mssecsvr.exe
    C:\WINDOWS\mssecsvr.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:2528

C:\WINDOWS\mssecsvr.exe
C:\WINDOWS\mssecsvr.exe -m security
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4968

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvr.exe

Path C:\WINDOWS\mssecsvr.exe
Size 2.2MB
SHA256 5b4d62a8ad6ec6882c750874e27fe976036aae8b92fe9f3a0445b681cfc1cc31
MD5 67c3a7d68b68207d6bd9f8da7abe86d3
SHA1 fd04d22e909135e23f5bd31b5c336e81424e4862
SHA512 c1e9dfd34ce8655d71eba9990b3bf85884e1ab3c9832694a0baf2027ca68fed0304dff8f5eecd9319fc47500c2f1f33d2c431d793691c4393b2e7c66920e0d80
SSDEEP 24576:VbLguVQhfdmMSirYbcMNgef0QeQjGCz6626c00Qg6eX6SASk+RdhAdmvn:VnFQqMSPbcBVQejds0Qo6SAARdhnvn
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvr.exe

Path C:\Windows\mssecsvr.exe
Size 2.2MB
SHA256 5b4d62a8ad6ec6882c750874e27fe976036aae8b92fe9f3a0445b681cfc1cc31
MD5 67c3a7d68b68207d6bd9f8da7abe86d3
SHA1 fd04d22e909135e23f5bd31b5c336e81424e4862
SHA512 c1e9dfd34ce8655d71eba9990b3bf85884e1ab3c9832694a0baf2027ca68fed0304dff8f5eecd9319fc47500c2f1f33d2c431d793691c4393b2e7c66920e0d80
SSDEEP 24576:VbLguVQhfdmMSirYbcMNgef0QeQjGCz6626c00Qg6eX6SASk+RdhAdmvn:VnFQqMSPbcBVQejds0Qo6SAARdhnvn
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvr.exe

Path C:\Windows\mssecsvr.exe
Size 2.2MB
SHA256 5b4d62a8ad6ec6882c750874e27fe976036aae8b92fe9f3a0445b681cfc1cc31
MD5 67c3a7d68b68207d6bd9f8da7abe86d3
SHA1 fd04d22e909135e23f5bd31b5c336e81424e4862
SHA512 c1e9dfd34ce8655d71eba9990b3bf85884e1ab3c9832694a0baf2027ca68fed0304dff8f5eecd9319fc47500c2f1f33d2c431d793691c4393b2e7c66920e0d80
SSDEEP 24576:VbLguVQhfdmMSirYbcMNgef0QeQjGCz6626c00Qg6eX6SASk+RdhAdmvn:VnFQqMSPbcBVQejds0Qo6SAARdhnvn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads