wannacry | c22c6c6c6c3b346ac81f07fbeb0fd2117d3e7d0179173bd4b58b9a6bec980fb8

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220718-en
resource tags

arch:x64arch:x86image:win10v2004-20220718-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2022, 06:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
12b05042dd727f16751ac5fb898bed1c.dll
Size 5.0MB
Sample220720-hqzh4schd4
SHA256 c22c6c6c6c3b346ac81f07fbeb0fd2117d3e7d0179173bd4b58b9a6bec980fb8
MD5 12b05042dd727f16751ac5fb898bed1c
SHA1 8bf7b52dbaf6bb39399e38e75b700559f2de7133
SHA512 7461dc1f60bc0a8ab10072934c42c9fee87fe4bd257e28403322dd9b63280742262a2f711d2a3c641775510dd2737e424286c16847b49821a2c6f1876bb252f3
MD5 SHA1 SHA512

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3126) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Executes dropped EXE 3 IoCs

pid	Process
1360	mssecsvc.exe
3872	mssecsvc.exe
628	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3968 wrote to memory of 2416	3968	rundll32.exe	77
PID 3968 wrote to memory of 2416	3968	rundll32.exe	77
PID 3968 wrote to memory of 2416	3968	rundll32.exe	77
PID 2416 wrote to memory of 1360	2416	rundll32.exe	78
PID 2416 wrote to memory of 1360	2416	rundll32.exe	78
PID 2416 wrote to memory of 1360	2416	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\12b05042dd727f16751ac5fb898bed1c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\12b05042dd727f16751ac5fb898bed1c.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2416
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:1360
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:628

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:3872

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvc.exe

Path C:\WINDOWS\mssecsvc.exe
Size 3.6MB
SHA256 af49d94b9ff4ad328d9110771fa832071bb900319f5cf184634ca7af2dd79eca
MD5 7d77221a8824641616d27031f1b58272
SHA1 b1e0fc0ec93ab885fdb628ca18fdf0b033217023
SHA512 d0f5cf550957ea364cb348d275cd1986e9a7f3c3e9ed530d617c5404c966d44b4140714d6511226f080f7acecd58ef72b272c14160ef87e60ca2f992445075a8
SSDEEP 98304:XDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2H:XDqPe1Cxcxk3ZAEUadzR8yc4H
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 af49d94b9ff4ad328d9110771fa832071bb900319f5cf184634ca7af2dd79eca
MD5 7d77221a8824641616d27031f1b58272
SHA1 b1e0fc0ec93ab885fdb628ca18fdf0b033217023
SHA512 d0f5cf550957ea364cb348d275cd1986e9a7f3c3e9ed530d617c5404c966d44b4140714d6511226f080f7acecd58ef72b272c14160ef87e60ca2f992445075a8
SSDEEP 98304:XDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2H:XDqPe1Cxcxk3ZAEUadzR8yc4H
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 af49d94b9ff4ad328d9110771fa832071bb900319f5cf184634ca7af2dd79eca
MD5 7d77221a8824641616d27031f1b58272
SHA1 b1e0fc0ec93ab885fdb628ca18fdf0b033217023
SHA512 d0f5cf550957ea364cb348d275cd1986e9a7f3c3e9ed530d617c5404c966d44b4140714d6511226f080f7acecd58ef72b272c14160ef87e60ca2f992445075a8
SSDEEP 98304:XDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2H:XDqPe1Cxcxk3ZAEUadzR8yc4H
MD5 SHA1 SHA512 SSDEEP

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 4750d24b79c769495ad84f406ea05f89af76a6fd88bd9cd32a200eb02f135f89
MD5 f79269cd6e70be419c2d72e7083f62df
SHA1 4bbebfd46c5bb0b6e5610b4699e9b121bf9b1330
SHA512 e2fb8b87d876f6b8c717ea3dd50d388f3429350b5d8cc99c74a8b175615cf204b793541acfa7156d43f7217f448faf9aa121332385d8ca96809ac47e4548d0f4
SSDEEP 98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2H:QqPe1Cxcxk3ZAEUadzR8yc4H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads