wannacry | c9768c9506ed4d5eeef91ddf32960eb44a799f834da43922d78e5e1273b37b04

Analysis

max time kernel
155s
max time network
166s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
20/07/2022, 07:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
da0b5e3dfc4db0229bcd2e827b5d03a6.dll
Size 5.0MB
Sample220720-hwjd3sddfp
SHA256 c9768c9506ed4d5eeef91ddf32960eb44a799f834da43922d78e5e1273b37b04
MD5 da0b5e3dfc4db0229bcd2e827b5d03a6
SHA1 d5f56fcde1a25da0c46d1fc00ef70740a2333f27
SHA512 57b4afaadf4cbc218db8cf2d3345be12999d089edf843889eeb35ab418eb6261bb6fb05bc31f12068c4d4255a8cde5c31c1366facefc019300e8f88e3c3c8079
MD5 SHA1 SHA512

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (1240) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Executes dropped EXE 3 IoCs

pid	Process
968	mssecsvc.exe
1608	mssecsvc.exe
2024	tasksche.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	mssecsvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvc.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 1616	1892	rundll32.exe	27
PID 1892 wrote to memory of 1616	1892	rundll32.exe	27
PID 1892 wrote to memory of 1616	1892	rundll32.exe	27
PID 1892 wrote to memory of 1616	1892	rundll32.exe	27
PID 1892 wrote to memory of 1616	1892	rundll32.exe	27
PID 1892 wrote to memory of 1616	1892	rundll32.exe	27
PID 1892 wrote to memory of 1616	1892	rundll32.exe	27
PID 1616 wrote to memory of 968	1616	rundll32.exe	28
PID 1616 wrote to memory of 968	1616	rundll32.exe	28
PID 1616 wrote to memory of 968	1616	rundll32.exe	28
PID 1616 wrote to memory of 968	1616	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\da0b5e3dfc4db0229bcd2e827b5d03a6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\da0b5e3dfc4db0229bcd2e827b5d03a6.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1616
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:968
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:2024

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1608

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvc.exe

Path C:\WINDOWS\mssecsvc.exe
Size 3.6MB
SHA256 b93231a8b512a2638d567a81b7dbd6c441c96cd86b35d17e141e1c4b5a74365b
MD5 8bcb8db8819386dcd00e296417129c68
SHA1 05f0f019b49495c2a4340614c0f88dae7d56fd79
SHA512 0e268f2190e12a29b48209aea2a5597e00f268181848577b0fe24e1baed2eefb2aab20d0be44983eca3e96ec61c06cf157a90f24618ba3004d2796dcaf280a01
SSDEEP 6144:GE9l9yNqIYVTH5DgSg8ajldktM0XXrs2QhMV9qbBLIwYQuy8DLq1eNVDvMrHC+V4:GwbLgPluxQhMbaIMu7L5NVErCA4
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 b93231a8b512a2638d567a81b7dbd6c441c96cd86b35d17e141e1c4b5a74365b
MD5 8bcb8db8819386dcd00e296417129c68
SHA1 05f0f019b49495c2a4340614c0f88dae7d56fd79
SHA512 0e268f2190e12a29b48209aea2a5597e00f268181848577b0fe24e1baed2eefb2aab20d0be44983eca3e96ec61c06cf157a90f24618ba3004d2796dcaf280a01
SSDEEP 6144:GE9l9yNqIYVTH5DgSg8ajldktM0XXrs2QhMV9qbBLIwYQuy8DLq1eNVDvMrHC+V4:GwbLgPluxQhMbaIMu7L5NVErCA4
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 b93231a8b512a2638d567a81b7dbd6c441c96cd86b35d17e141e1c4b5a74365b
MD5 8bcb8db8819386dcd00e296417129c68
SHA1 05f0f019b49495c2a4340614c0f88dae7d56fd79
SHA512 0e268f2190e12a29b48209aea2a5597e00f268181848577b0fe24e1baed2eefb2aab20d0be44983eca3e96ec61c06cf157a90f24618ba3004d2796dcaf280a01
SSDEEP 6144:GE9l9yNqIYVTH5DgSg8ajldktM0XXrs2QhMV9qbBLIwYQuy8DLq1eNVDvMrHC+V4:GwbLgPluxQhMbaIMu7L5NVErCA4
MD5 SHA1 SHA512 SSDEEP

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 4d25922a089cdbd0efd2bc89a2a1a703a55c4115a4b17f6682a585ba5556034f
MD5 a278f4d7686fd957aac7348d702753b2
SHA1 5ba292e4a219c22bb01ad21ee08eea0293a5fd9f
SHA512 cce260bda4228745b7c6a2fa2c29cfeec21fe97b03c507c45358ac1229399abcf0523af51e0174c4fa0280aa198256c92e319744fa0f03e9106eb98061511d8e
SSDEEP 6144:W2QhMV9qbBLIwYQuy8DLq1eNVDvMrHC+V4:nQhMbaIMu7L5NVErCA4
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1616-55-0x00000000753E1000-0x00000000753E3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads