wannacry | 3c501b11bd3e666d09edcfcecb259167717164f195a07668b7000a51644ec2ee

Analysis

max time kernel
151s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
resource tags

arch:x64arch:x86image:win10v2004-20220414-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2022, 05:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8f89425d85b4554bf9c317e7ed15e05d.dll
Size 5.0MB
Sample220720-gmffdscde8
SHA256 3c501b11bd3e666d09edcfcecb259167717164f195a07668b7000a51644ec2ee
MD5 8f89425d85b4554bf9c317e7ed15e05d
SHA1 e4c84d231f31e2e3cf9177d9320fe4c63cabc7f3
SHA512 b04a5517778c6c0e5e378dc15d19bf74ecb2859de4bbc503d7280bad13573b0a36df73b9eaf613c81bdb2b569f2ed0568f67fd09835a830cf380c3cc6955fc04
MD5 SHA1 SHA512

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3151) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Executes dropped EXE 3 IoCs

pid	Process
2116	mssecsvc.exe
1284	mssecsvc.exe
1488	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 1188	2160	rundll32.exe	80
PID 2160 wrote to memory of 1188	2160	rundll32.exe	80
PID 2160 wrote to memory of 1188	2160	rundll32.exe	80
PID 1188 wrote to memory of 2116	1188	rundll32.exe	81
PID 1188 wrote to memory of 2116	1188	rundll32.exe	81
PID 1188 wrote to memory of 2116	1188	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8f89425d85b4554bf9c317e7ed15e05d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8f89425d85b4554bf9c317e7ed15e05d.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1188
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:2116
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:1488

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:1284

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvc.exe

Path C:\WINDOWS\mssecsvc.exe
Size 3.6MB
SHA256 0bb495907499807d6a1fbb6cef62753c33d2d5d097a9b26490449c90b128a005
MD5 333e41b63a57dc9e9e8ddf87d869db99
SHA1 a2f20f8527541de578c875784eabaa4a0507f90e
SHA512 f17014f949be1e26eb18ec8a9bbc5b9bb696137c00d6a87ff12107446cb4bfb9e63e42d8a13abbea1c30bbf0627a68f56cd63b91e231bef1ce99b9898334bb4e
SSDEEP 98304:yDqPoBhz1aRxcSUDk36SAEdhvxWa9P5w63R8yAVp2HI:yDqPe1Cxcxk3ZAEUadHR8yc4HI
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 0bb495907499807d6a1fbb6cef62753c33d2d5d097a9b26490449c90b128a005
MD5 333e41b63a57dc9e9e8ddf87d869db99
SHA1 a2f20f8527541de578c875784eabaa4a0507f90e
SHA512 f17014f949be1e26eb18ec8a9bbc5b9bb696137c00d6a87ff12107446cb4bfb9e63e42d8a13abbea1c30bbf0627a68f56cd63b91e231bef1ce99b9898334bb4e
SSDEEP 98304:yDqPoBhz1aRxcSUDk36SAEdhvxWa9P5w63R8yAVp2HI:yDqPe1Cxcxk3ZAEUadHR8yc4HI
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 0bb495907499807d6a1fbb6cef62753c33d2d5d097a9b26490449c90b128a005
MD5 333e41b63a57dc9e9e8ddf87d869db99
SHA1 a2f20f8527541de578c875784eabaa4a0507f90e
SHA512 f17014f949be1e26eb18ec8a9bbc5b9bb696137c00d6a87ff12107446cb4bfb9e63e42d8a13abbea1c30bbf0627a68f56cd63b91e231bef1ce99b9898334bb4e
SSDEEP 98304:yDqPoBhz1aRxcSUDk36SAEdhvxWa9P5w63R8yAVp2HI:yDqPe1Cxcxk3ZAEUadHR8yc4HI
MD5 SHA1 SHA512 SSDEEP

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 7917160d78c21b926fd92418d55d14a5bf4ed03bee958f0d716bd5a37b754dd0
MD5 939a10925488f6a884d9425add7b61fb
SHA1 c84d622cfac74d3c1bb5e10709d66fe08b5c48ab
SHA512 980a59247155625f4bdf43931efeec612d8e8bd1b75918387dd8d1764fd67083add188a2c353890d6a3e1bb8741510a6920873e87724f2f8ea7ec5bb3d5f9619
SSDEEP 98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P5w63R8yAVp2Hj:QqPe1Cxcxk3ZAEUadHR8yc4Hj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads