wannacry | 24aefa1fed4613907f97ff6c4e6a9376d70ea2c3ea3477d72ea5f1f28bb103cc

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220718-en
resource tags

arch:x64arch:x86image:win10v2004-20220718-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2022, 06:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
44b77eabfb7cfce407bfa935b357fd7b.dll
Size 5.0MB
Sample220720-g5gfeacfd9
SHA256 24aefa1fed4613907f97ff6c4e6a9376d70ea2c3ea3477d72ea5f1f28bb103cc
MD5 44b77eabfb7cfce407bfa935b357fd7b
SHA1 72afb73892b356f6e46732bfd270b9e0c94bf557
SHA512 d9862e1493f9eadabb8ea4e539eb99c7ad5aee0f87a8d577f8eab01e673bef3d3328011e70c18e220ba7dd31a82b95fd43025fc7ef30230a361c29ebd98b9011
MD5 SHA1 SHA512

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3218) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Executes dropped EXE 3 IoCs

pid	Process
4792	mssecsvc.exe
3116	mssecsvc.exe
592	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3432 wrote to memory of 3436	3432	rundll32.exe	76
PID 3432 wrote to memory of 3436	3432	rundll32.exe	76
PID 3432 wrote to memory of 3436	3432	rundll32.exe	76
PID 3436 wrote to memory of 4792	3436	rundll32.exe	77
PID 3436 wrote to memory of 4792	3436	rundll32.exe	77
PID 3436 wrote to memory of 4792	3436	rundll32.exe	77

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\44b77eabfb7cfce407bfa935b357fd7b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3432
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\44b77eabfb7cfce407bfa935b357fd7b.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:3436
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:4792
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:592

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:3116

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvc.exe

Path C:\WINDOWS\mssecsvc.exe
Size 3.6MB
SHA256 8efd53eb1218b5af72fc7c15cb813f551348ac4b52aa9e02344e45362e507a20
MD5 b4605ba65a63803f1a1189d6141d16f2
SHA1 257179268e3172be426b3034a472156c4a82f142
SHA512 b7a873aae69d3ce187c8ea1bd59e74c50679005b48b3a34de5da32ad6ab89d42a1114084672347e815f8cf44b819b9152f5b8c44ddbfc3b6207a257b1fb32b79
SSDEEP 24576:2bLgddQhfdmMSirYbcMNgef0QeQjG/D8kIq:2nAQqMSPbcBVQej/
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 8efd53eb1218b5af72fc7c15cb813f551348ac4b52aa9e02344e45362e507a20
MD5 b4605ba65a63803f1a1189d6141d16f2
SHA1 257179268e3172be426b3034a472156c4a82f142
SHA512 b7a873aae69d3ce187c8ea1bd59e74c50679005b48b3a34de5da32ad6ab89d42a1114084672347e815f8cf44b819b9152f5b8c44ddbfc3b6207a257b1fb32b79
SSDEEP 24576:2bLgddQhfdmMSirYbcMNgef0QeQjG/D8kIq:2nAQqMSPbcBVQej/
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 8efd53eb1218b5af72fc7c15cb813f551348ac4b52aa9e02344e45362e507a20
MD5 b4605ba65a63803f1a1189d6141d16f2
SHA1 257179268e3172be426b3034a472156c4a82f142
SHA512 b7a873aae69d3ce187c8ea1bd59e74c50679005b48b3a34de5da32ad6ab89d42a1114084672347e815f8cf44b819b9152f5b8c44ddbfc3b6207a257b1fb32b79
SSDEEP 24576:2bLgddQhfdmMSirYbcMNgef0QeQjG/D8kIq:2nAQqMSPbcBVQej/
MD5 SHA1 SHA512 SSDEEP

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 81199367ae572b5b3f975f5b2c499df6e5434f960b5bd5c882c2af00b38ac930
MD5 2811d14cecb3f419bc8474e3cae0ed45
SHA1 eb91618a18466eb587a4e28ce78d31ba10e34f13
SHA512 711323e34d835e7cb15536a4923b21c0075eb4abe4e3132a80e6703d4e4317e3ed87e2eb4b33d7411826c8d5337353601ad230844f0b4c7347b7747d5ca68fc6
SSDEEP 12288:nQhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+DHeQYSUjEXFGeXE3TUgt:nQhfdmMSirYbcMNgef0QeQjG/D8kIq
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads