wannacry | 3d9a477aa76920034d190f65bf86c197558e723b5526eec2ee6e9248d80c4d7b

Analysis

max time kernel
151s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
resource tags

arch:x64arch:x86image:win10v2004-20220414-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2022, 06:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e12d0c0ba668e1592c5de9390f3005dc.dll
Size 5.0MB
Sample220720-hr3l6achd8
SHA256 3d9a477aa76920034d190f65bf86c197558e723b5526eec2ee6e9248d80c4d7b
MD5 e12d0c0ba668e1592c5de9390f3005dc
SHA1 d66a836c9360fc0d796b044b4db533feb4e2839f
SHA512 76f70018ace5b3407dc9b77631fcd1c37597e0c023d317af090a5cb557953ffd57ab827b6965ac166b7462e18cd671ff6be0c540ca03906df371fab964e571b7
MD5 SHA1 SHA512

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3085) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Executes dropped EXE 3 IoCs

pid	Process
1828	mssecsvc.exe
5068	mssecsvc.exe
436	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 4340	2352	rundll32.exe	84
PID 2352 wrote to memory of 4340	2352	rundll32.exe	84
PID 2352 wrote to memory of 4340	2352	rundll32.exe	84
PID 4340 wrote to memory of 1828	4340	rundll32.exe	85
PID 4340 wrote to memory of 1828	4340	rundll32.exe	85
PID 4340 wrote to memory of 1828	4340	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e12d0c0ba668e1592c5de9390f3005dc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e12d0c0ba668e1592c5de9390f3005dc.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:4340
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:1828
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:436

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:5068

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvc.exe

Path C:\WINDOWS\mssecsvc.exe
Size 3.6MB
SHA256 c864a0f43b7085d5514ec0efa8c8bc1006aa3d51cb84aa43838c56da725f1b2f
MD5 796da4e9000dc40c066553f371f9d2a3
SHA1 12c852e8f548df9f5d723d21f44f4d404e82f955
SHA512 773a99202e485ecccbf45a6dae4f8dbae3927a9fb54a4a010e3319e37ab6ca590bddd5ac47c1fefcf2b5a783a41a0e711e67026e726e688b6867e3205f2ceae8
SSDEEP 49152:2nAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnv:yDqPoBhz1aRxcSUDk36SAEdhv
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 c864a0f43b7085d5514ec0efa8c8bc1006aa3d51cb84aa43838c56da725f1b2f
MD5 796da4e9000dc40c066553f371f9d2a3
SHA1 12c852e8f548df9f5d723d21f44f4d404e82f955
SHA512 773a99202e485ecccbf45a6dae4f8dbae3927a9fb54a4a010e3319e37ab6ca590bddd5ac47c1fefcf2b5a783a41a0e711e67026e726e688b6867e3205f2ceae8
SSDEEP 49152:2nAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnv:yDqPoBhz1aRxcSUDk36SAEdhv
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 c864a0f43b7085d5514ec0efa8c8bc1006aa3d51cb84aa43838c56da725f1b2f
MD5 796da4e9000dc40c066553f371f9d2a3
SHA1 12c852e8f548df9f5d723d21f44f4d404e82f955
SHA512 773a99202e485ecccbf45a6dae4f8dbae3927a9fb54a4a010e3319e37ab6ca590bddd5ac47c1fefcf2b5a783a41a0e711e67026e726e688b6867e3205f2ceae8
SSDEEP 49152:2nAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnv:yDqPoBhz1aRxcSUDk36SAEdhv
MD5 SHA1 SHA512 SSDEEP

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 e3825cad783a302902576ca4cfae9fdfc8640a012876402c89e7dd22475cda91
MD5 ba8922fceaeed80297c3c391c8844b70
SHA1 2ef2a451fbcd42a938ae3d7bfad93dbc8ebe144f
SHA512 faee2d00623ab8a0db455a4b26074faed6da189220630f5260c331ed3d7f633f4cb253efaae25101c64ca836bea92b2de9e8c18614da483d4614b2e176d159bb
SSDEEP 49152:nQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnv:QqPoBhz1aRxcSUDk36SAEdhv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads