wannacry | 9b5c74ff63f77cab73b48aaa13372d4da8302888c8801b0f9861e68295e50b8e

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220718-en
resource tags

arch:x64arch:x86image:win10v2004-20220718-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2022, 06:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ee409cd7153dc713c5fbbb65deb6f27a.dll
Size 5.0MB
Sample220720-gx7bvsceg8
SHA256 9b5c74ff63f77cab73b48aaa13372d4da8302888c8801b0f9861e68295e50b8e
MD5 ee409cd7153dc713c5fbbb65deb6f27a
SHA1 52c05df1408af36e6a33679d5f5b6e4148bfd0df
SHA512 61d88a0a78a3fe4ca05f5d740a08b8be560cbb5d8ae82169808e755b51535f359fd5f085913d39bcaf78b6b00ebf256f7d1382e89e2b67759dfb4719278862fc
MD5 SHA1 SHA512

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3192) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Executes dropped EXE 3 IoCs

pid	Process
2228	mssecsvc.exe
3436	mssecsvc.exe
3868	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1120 wrote to memory of 1376	1120	rundll32.exe	77
PID 1120 wrote to memory of 1376	1120	rundll32.exe	77
PID 1120 wrote to memory of 1376	1120	rundll32.exe	77
PID 1376 wrote to memory of 2228	1376	rundll32.exe	78
PID 1376 wrote to memory of 2228	1376	rundll32.exe	78
PID 1376 wrote to memory of 2228	1376	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ee409cd7153dc713c5fbbb65deb6f27a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1120
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ee409cd7153dc713c5fbbb65deb6f27a.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1376
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:2228
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:3868

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:3436

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvc.exe

Path C:\WINDOWS\mssecsvc.exe
Size 3.6MB
SHA256 64d29f044c31714f7564cb635d8dd0cb34b3d0159eac2bbb61f8af93cd60b0d8
MD5 ca9e5716947be679596e225eb1198491
SHA1 fc7795ef86742e0947a454ae3e9c924710179fc5
SHA512 9d52bd311b09ffb9242f347a49134c1c27bc9fd4842c011278e4067222f61b7a5a3da82dfa0b562fa8febc3af61a2e30f00c7464e17acbaa30bd41792d265ba5
SSDEEP 49152:XnAQqMSPbcBVsRk9PAMEcaEau3R8yAH1plAHI:XDqPoBWk9P593R8yAVp2HI
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 64d29f044c31714f7564cb635d8dd0cb34b3d0159eac2bbb61f8af93cd60b0d8
MD5 ca9e5716947be679596e225eb1198491
SHA1 fc7795ef86742e0947a454ae3e9c924710179fc5
SHA512 9d52bd311b09ffb9242f347a49134c1c27bc9fd4842c011278e4067222f61b7a5a3da82dfa0b562fa8febc3af61a2e30f00c7464e17acbaa30bd41792d265ba5
SSDEEP 49152:XnAQqMSPbcBVsRk9PAMEcaEau3R8yAH1plAHI:XDqPoBWk9P593R8yAVp2HI
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 64d29f044c31714f7564cb635d8dd0cb34b3d0159eac2bbb61f8af93cd60b0d8
MD5 ca9e5716947be679596e225eb1198491
SHA1 fc7795ef86742e0947a454ae3e9c924710179fc5
SHA512 9d52bd311b09ffb9242f347a49134c1c27bc9fd4842c011278e4067222f61b7a5a3da82dfa0b562fa8febc3af61a2e30f00c7464e17acbaa30bd41792d265ba5
SSDEEP 49152:XnAQqMSPbcBVsRk9PAMEcaEau3R8yAH1plAHI:XDqPoBWk9P593R8yAVp2HI
MD5 SHA1 SHA512 SSDEEP

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 d348d1a8c2820681aaa159af366fc241b221091451e2fbb440fad33cf9e571f9
MD5 1972c2fa78d261e0c1b8e19724b0480d
SHA1 fd99914da16c859d0eb189d320aabdbd0b1d8206
SHA512 2220ef15a5e1a1dbb6b08e9a68d5c9893ecfca8254e16c1a5d6ec8aeeab1cc99b855c03efb678e4158f019a3f414ee9f87b6beb48f4cc32abd1a933486f07a5a
SSDEEP 49152:nQqMSPbcBVsRk9PAMEcaEau3R8yAH1plAHj:QqPoBWk9P593R8yAVp2Hj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads