wannacry | b2adbfde1abc1bd66a4e65f2803f9dad4e16d4a3151122e5c954d2a6bcb7e18b

Analysis

max time kernel
151s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220718-en
resource tags

arch:x64arch:x86image:win10v2004-20220718-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2022, 04:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
93c135be6d0362d349969232135ae359.dll
Size 5.0MB
Sample220720-fejmeacedj
SHA256 b2adbfde1abc1bd66a4e65f2803f9dad4e16d4a3151122e5c954d2a6bcb7e18b
MD5 93c135be6d0362d349969232135ae359
SHA1 c585e7d0bfbe0713456422925cb4b19cfcf58af9
SHA512 5237ce1ae5b700208f45b6000d0403d45edf743f7e05c7dc4c6d5b02fb2cfbccdc46a36d0cfb977ff8b12dd4ae23d80dc3fd96dc7d89fc0fba3e77e14d868009
MD5 SHA1 SHA512

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3253) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Executes dropped EXE 3 IoCs

pid	Process
964	mssecsvr.exe
768	mssecsvr.exe
820	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvr.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvr.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvr.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 3624	1152	rundll32.exe	78
PID 1152 wrote to memory of 3624	1152	rundll32.exe	78
PID 1152 wrote to memory of 3624	1152	rundll32.exe	78
PID 3624 wrote to memory of 964	3624	rundll32.exe	79
PID 3624 wrote to memory of 964	3624	rundll32.exe	79
PID 3624 wrote to memory of 964	3624	rundll32.exe	79
PID 964 wrote to memory of 820	964	mssecsvr.exe	81
PID 964 wrote to memory of 820	964	mssecsvr.exe	81
PID 964 wrote to memory of 820	964	mssecsvr.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\93c135be6d0362d349969232135ae359.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\93c135be6d0362d349969232135ae359.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:3624
- - C:\WINDOWS\mssecsvr.exe
    C:\WINDOWS\mssecsvr.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:964
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:820

C:\WINDOWS\mssecsvr.exe
C:\WINDOWS\mssecsvr.exe -m security
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:768

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvr.exe

Path C:\WINDOWS\mssecsvr.exe
Size 2.2MB
SHA256 46999e9abf82743f14e93bdaf18b2f457206a0b04ea5907ffabb06e412968239
MD5 55a0252f51c360f2078468adc6d5e08d
SHA1 6825592cb8298e7f286a90f6df1067a986f85f13
SHA512 a0515725c0ed31fd851b8164d18abefb61a8541825a5378103dc6c27182d05de42444c9aa397ccce30ee524944a5376ea06b74b609ba2c01c198d1d1cdb7281e
SSDEEP 49152:QnGeNbcBVQej/1INRx+TSqTdX1HkQo6SAgqGi:QG8oBhz1aRxcSUDk36SAgHi
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvr.exe

Path C:\Windows\mssecsvr.exe
Size 2.2MB
SHA256 46999e9abf82743f14e93bdaf18b2f457206a0b04ea5907ffabb06e412968239
MD5 55a0252f51c360f2078468adc6d5e08d
SHA1 6825592cb8298e7f286a90f6df1067a986f85f13
SHA512 a0515725c0ed31fd851b8164d18abefb61a8541825a5378103dc6c27182d05de42444c9aa397ccce30ee524944a5376ea06b74b609ba2c01c198d1d1cdb7281e
SSDEEP 49152:QnGeNbcBVQej/1INRx+TSqTdX1HkQo6SAgqGi:QG8oBhz1aRxcSUDk36SAgHi
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvr.exe

Path C:\Windows\mssecsvr.exe
Size 2.2MB
SHA256 46999e9abf82743f14e93bdaf18b2f457206a0b04ea5907ffabb06e412968239
MD5 55a0252f51c360f2078468adc6d5e08d
SHA1 6825592cb8298e7f286a90f6df1067a986f85f13
SHA512 a0515725c0ed31fd851b8164d18abefb61a8541825a5378103dc6c27182d05de42444c9aa397ccce30ee524944a5376ea06b74b609ba2c01c198d1d1cdb7281e
SSDEEP 49152:QnGeNbcBVQej/1INRx+TSqTdX1HkQo6SAgqGi:QG8oBhz1aRxcSUDk36SAgHi
MD5 SHA1 SHA512 SSDEEP

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 2.0MB
SHA256 333b4351bd0ec3547cb88330581c8a0537eafd27847cd9c3b7fda4ccfd729441
MD5 8898f3f3c6f1ad0a3ad4d95dc027a7c6
SHA1 7d4ccf6c123089e3ec4bf3c8944a9b68ada1f069
SHA512 fd0fd17b50d367cc2ea0102d736bd71128201b258fa42c3bb3a7adc9a11ddf6174df855bc246ec876afcbef2ff9eb58a28bf3fc8cf125334db456e627f192f94
SSDEEP 49152:EeNbcBVQej/1INRx+TSqTdX1HkQo6SAgq9:E8oBhz1aRxcSUDk36SAgw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads