wannacry | 60a44dcf4c9a41135b71f0fe7cc9543afe016d0488b2dce52986f85020de6ebb

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
resource tags

arch:x64arch:x86image:win10v2004-20220414-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2022, 07:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
360e9afeb89571426b8f82d3c34b4046.dll
Size 5.0MB
Sample220720-h3s7vsdad3
SHA256 60a44dcf4c9a41135b71f0fe7cc9543afe016d0488b2dce52986f85020de6ebb
MD5 360e9afeb89571426b8f82d3c34b4046
SHA1 3cc0548317729d168723a824c3ba6be3f617feb1
SHA512 5b50e0c6d57d044673196f7b7fdc0cf4dac582e004a783418abd4b6380b395b2d476d818db9a7b0ef8b2e4d4a4e338ce41597750765d24c2ff214487a209b204
MD5 SHA1 SHA512

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3273) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Executes dropped EXE 3 IoCs

pid	Process
4844	mssecsvc.exe
3144	mssecsvc.exe
4304	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 932 wrote to memory of 3208	932	rundll32.exe	79
PID 932 wrote to memory of 3208	932	rundll32.exe	79
PID 932 wrote to memory of 3208	932	rundll32.exe	79
PID 3208 wrote to memory of 4844	3208	rundll32.exe	80
PID 3208 wrote to memory of 4844	3208	rundll32.exe	80
PID 3208 wrote to memory of 4844	3208	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\360e9afeb89571426b8f82d3c34b4046.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:932
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\360e9afeb89571426b8f82d3c34b4046.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:3208
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:4844
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:4304

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:3144

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvc.exe

Path C:\WINDOWS\mssecsvc.exe
Size 3.6MB
SHA256 437b408e86645751ea7483ba7f213f7ea465247265add45261b69646b9f08171
MD5 ab905529025a19b63afe1c7fa0c4409b
SHA1 b5ffec5d0b1395fa74c42257208ad937dd136a53
SHA512 c17ac6157897ebcdfbfe3be8b5d0edb273ea7d26d72dac71bb14e8d398720570d0ee592b2caac993e2097b1a49fff6867a2f688c638ab122814e26bc7befb3c6
SSDEEP 49152:2nAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9PAMEc:yDqPoBhz1aRxcSUDk36SAEdhvxWa9P5
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 437b408e86645751ea7483ba7f213f7ea465247265add45261b69646b9f08171
MD5 ab905529025a19b63afe1c7fa0c4409b
SHA1 b5ffec5d0b1395fa74c42257208ad937dd136a53
SHA512 c17ac6157897ebcdfbfe3be8b5d0edb273ea7d26d72dac71bb14e8d398720570d0ee592b2caac993e2097b1a49fff6867a2f688c638ab122814e26bc7befb3c6
SSDEEP 49152:2nAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9PAMEc:yDqPoBhz1aRxcSUDk36SAEdhvxWa9P5
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 437b408e86645751ea7483ba7f213f7ea465247265add45261b69646b9f08171
MD5 ab905529025a19b63afe1c7fa0c4409b
SHA1 b5ffec5d0b1395fa74c42257208ad937dd136a53
SHA512 c17ac6157897ebcdfbfe3be8b5d0edb273ea7d26d72dac71bb14e8d398720570d0ee592b2caac993e2097b1a49fff6867a2f688c638ab122814e26bc7befb3c6
SSDEEP 49152:2nAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9PAMEc:yDqPoBhz1aRxcSUDk36SAEdhvxWa9P5
MD5 SHA1 SHA512 SSDEEP

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 6892e485fc2a4fd898133e38c7c34a18fc92d4c68fb2cb3cdfd52ec1de67d5f0
MD5 ff81cedf44767a1400a39d7315864af7
SHA1 c7873622d40a6475d0c2e3af963f3f3c7056c59b
SHA512 2dc75358c02287a89c1bb8eb20daffec882a923bd0f2fc463bc7f41fb0b4eaabda5cb0f0ef60deb2f70da392c0b98e1c860260fe03d7e08fb00902f734534073
SSDEEP 49152:nQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9PAMEc:QqPoBhz1aRxcSUDk36SAEdhvxWa9P5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads