wannacry | a9fc53415ca9e17326100de8615e566cf632831a1c7e8df70399e0ee6551b333

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220718-en
resource tags

arch:x64arch:x86image:win10v2004-20220718-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2022, 07:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
91509814067b491a8d8fda0bca9858a1.dll
Size 5.0MB
Sample220720-h5htxadedm
SHA256 a9fc53415ca9e17326100de8615e566cf632831a1c7e8df70399e0ee6551b333
MD5 91509814067b491a8d8fda0bca9858a1
SHA1 bc018e1cf45f9e52401b4cefc88535324ed5016e
SHA512 02145dfc158b9ccf6f3bb3ec680a37969ea45e2ad45863d71de089807d1d250747aa5288f6eb71880dd9b38cc634ddb3dd48195839ecf458eb900aa75dc7800c
MD5 SHA1 SHA512

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3345) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Executes dropped EXE 3 IoCs

pid	Process
3492	mssecsvc.exe
4112	mssecsvc.exe
1128	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4432 wrote to memory of 1596	4432	rundll32.exe	77
PID 4432 wrote to memory of 1596	4432	rundll32.exe	77
PID 4432 wrote to memory of 1596	4432	rundll32.exe	77
PID 1596 wrote to memory of 3492	1596	rundll32.exe	78
PID 1596 wrote to memory of 3492	1596	rundll32.exe	78
PID 1596 wrote to memory of 3492	1596	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\91509814067b491a8d8fda0bca9858a1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4432
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\91509814067b491a8d8fda0bca9858a1.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1596
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:3492
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:1128

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
PID:4112

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvc.exe

Path C:\WINDOWS\mssecsvc.exe
Size 3.6MB
SHA256 e9265d0a058462ac9431c847e591f716aaeb7a1efde7d9b9f04654897348de4e
MD5 d640ca6f77a3bd25c71d136800f18265
SHA1 0946a908a9cff9f0727c844ddc506395026bfb88
SHA512 73d2bdb3650133f135dcd7e4b8b80aa3eae212794732208d5094fcf7d3942bd6138295afa6ecf2f6ca6b23b6c79419952cbd49a755ece8d6453799c71fc30275
SSDEEP 12288:GvbLgPluxQhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+D2rt2W:2bLgdeQhfdmMSirYbcMNgef0zrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 e9265d0a058462ac9431c847e591f716aaeb7a1efde7d9b9f04654897348de4e
MD5 d640ca6f77a3bd25c71d136800f18265
SHA1 0946a908a9cff9f0727c844ddc506395026bfb88
SHA512 73d2bdb3650133f135dcd7e4b8b80aa3eae212794732208d5094fcf7d3942bd6138295afa6ecf2f6ca6b23b6c79419952cbd49a755ece8d6453799c71fc30275
SSDEEP 12288:GvbLgPluxQhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+D2rt2W:2bLgdeQhfdmMSirYbcMNgef0zrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 e9265d0a058462ac9431c847e591f716aaeb7a1efde7d9b9f04654897348de4e
MD5 d640ca6f77a3bd25c71d136800f18265
SHA1 0946a908a9cff9f0727c844ddc506395026bfb88
SHA512 73d2bdb3650133f135dcd7e4b8b80aa3eae212794732208d5094fcf7d3942bd6138295afa6ecf2f6ca6b23b6c79419952cbd49a755ece8d6453799c71fc30275
SSDEEP 12288:GvbLgPluxQhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+D2rt2W:2bLgdeQhfdmMSirYbcMNgef0zrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 eb1a6d808f76f64717917505effe95d05258a7e883c92aee0ffad722568d0886
MD5 85a3754387ad5efff62ab832853540bf
SHA1 4ea2af2d3f38ffc24b5e23ecd1b66bb75848eb0d
SHA512 ebd2c71fc9a84a1d135e9de9262b89785320c1b189fc5290d28ee3f2cba0463ea20758671b6768eebcc9a58765ac4bbea0c2af14078046a0829347fea4ef5ac4
SSDEEP 12288:nQhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+D2rt2W:nQhfdmMSirYbcMNgef0zrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads