wannacry | dd2bb76584e930dc992a014ed61af03f22a224f30e9263e0372bb323e08405c3

Analysis

max time kernel
151s
max time network
154s
platform
windows7_x64
resource
win7-20220715-en
resource tags

arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
submitted
20/07/2022, 06:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0fdec92a10f6f59cdf9e965a85d29a21.dll
Size 5.0MB
Sample220720-hal8vacfh6
SHA256 dd2bb76584e930dc992a014ed61af03f22a224f30e9263e0372bb323e08405c3
MD5 0fdec92a10f6f59cdf9e965a85d29a21
SHA1 6d9bee0ef3587177e72500863cb71ccf6a49a4c2
SHA512 73485ded2b841c0245b928520b671f52f058ae40bc04c63bf9d5e2cec69c32f5d75b05508a37debea7b24b70be1047f2a9009257abfd2ed8174ec01f2fd0bc7d
MD5 SHA1 SHA512

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (1276) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Executes dropped EXE 3 IoCs

pid	Process
1704	mssecsvc.exe
796	mssecsvc.exe
1648	tasksche.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	mssecsvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvc.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 828	1680	rundll32.exe	27
PID 1680 wrote to memory of 828	1680	rundll32.exe	27
PID 1680 wrote to memory of 828	1680	rundll32.exe	27
PID 1680 wrote to memory of 828	1680	rundll32.exe	27
PID 1680 wrote to memory of 828	1680	rundll32.exe	27
PID 1680 wrote to memory of 828	1680	rundll32.exe	27
PID 1680 wrote to memory of 828	1680	rundll32.exe	27
PID 828 wrote to memory of 1704	828	rundll32.exe	28
PID 828 wrote to memory of 1704	828	rundll32.exe	28
PID 828 wrote to memory of 1704	828	rundll32.exe	28
PID 828 wrote to memory of 1704	828	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0fdec92a10f6f59cdf9e965a85d29a21.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0fdec92a10f6f59cdf9e965a85d29a21.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:828
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:1704
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:1648

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:796

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvc.exe

Path C:\WINDOWS\mssecsvc.exe
Size 3.6MB
SHA256 eeb5a71b76d8f5aa3619420fa26040d41cd7e9d341c888608e7198de3d301717
MD5 c4970ef8207cb4f7ea8e8a2faa68bdd8
SHA1 dcf4c7e2e93ff51b0f0ff384e7747db388d29a50
SHA512 434f55684c64c43dae67d38f70532d95cbe97b5b4d9ca5d832b25d474179f2dc5285d026953e0fcc992680ad179c935b29b0d370a976cf8209323b10f4235647
SSDEEP 49152:WnjQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAAN:S8qPoBhz1aRxcSUDk36SA
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 eeb5a71b76d8f5aa3619420fa26040d41cd7e9d341c888608e7198de3d301717
MD5 c4970ef8207cb4f7ea8e8a2faa68bdd8
SHA1 dcf4c7e2e93ff51b0f0ff384e7747db388d29a50
SHA512 434f55684c64c43dae67d38f70532d95cbe97b5b4d9ca5d832b25d474179f2dc5285d026953e0fcc992680ad179c935b29b0d370a976cf8209323b10f4235647
SSDEEP 49152:WnjQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAAN:S8qPoBhz1aRxcSUDk36SA
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 eeb5a71b76d8f5aa3619420fa26040d41cd7e9d341c888608e7198de3d301717
MD5 c4970ef8207cb4f7ea8e8a2faa68bdd8
SHA1 dcf4c7e2e93ff51b0f0ff384e7747db388d29a50
SHA512 434f55684c64c43dae67d38f70532d95cbe97b5b4d9ca5d832b25d474179f2dc5285d026953e0fcc992680ad179c935b29b0d370a976cf8209323b10f4235647
SSDEEP 49152:WnjQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAAN:S8qPoBhz1aRxcSUDk36SA
MD5 SHA1 SHA512 SSDEEP

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 3eac88e6e9f0fc9b3ec441b99937dd26ce7bfcb964c879dcaa33b78630eab780
MD5 ffbd7c711745643ebb631938d978f358
SHA1 8154e3aa39f42a8b8fb6fded42efad29b6570a51
SHA512 76e9ca6963a086c595592829ed2254c2bb94fc128fe22055a0265d9a3306d1b8e83c80ddc8bbf70895e34fa686d80ba75a9b0394c56580a72418747ae1ec0d36
SSDEEP 49152:nQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAA5:QqPoBhz1aRxcSUDk36SAu
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/796-65-0x0000000000400000-0x0000000000A72000-memory.dmp

Download

memory/796-66-0x0000000000400000-0x0000000000A72000-memory.dmp

Download

memory/828-55-0x0000000076901000-0x0000000076903000-memory.dmp

Download

memory/1704-59-0x0000000000400000-0x0000000000A72000-memory.dmp

Download

memory/1704-64-0x0000000000400000-0x0000000000A72000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads