wannacry | 519f67c3afa0e5ed5df612420e2fac6562aa45f0dc9c110652bab58c5653b3cf

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220718-en
resource tags

arch:x64arch:x86image:win10v2004-20220718-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2022, 07:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5bca628e115e0abf2b9535cc4b45aef5.dll
Size 5.0MB
Sample220720-hzdb8schh9
SHA256 519f67c3afa0e5ed5df612420e2fac6562aa45f0dc9c110652bab58c5653b3cf
MD5 5bca628e115e0abf2b9535cc4b45aef5
SHA1 afea6eab259ea22007ab5bd3b861029ba8afa022
SHA512 a2dbddee544ca5f9ad39c4d50458620ccfd971510618f0c18094ca1c4d36c12d16d72d3f27bdca463e5f07e4c8894699f4bbffbe5f1101cb2ead1e17ee346b22
MD5 SHA1 SHA512

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3055) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Executes dropped EXE 2 IoCs

pid	Process
508	mssecsvr.exe
1844	mssecsvr.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvr.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvr.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvr.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 5076	1216	rundll32.exe	77
PID 1216 wrote to memory of 5076	1216	rundll32.exe	77
PID 1216 wrote to memory of 5076	1216	rundll32.exe	77
PID 5076 wrote to memory of 508	5076	rundll32.exe	78
PID 5076 wrote to memory of 508	5076	rundll32.exe	78
PID 5076 wrote to memory of 508	5076	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5bca628e115e0abf2b9535cc4b45aef5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5bca628e115e0abf2b9535cc4b45aef5.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:5076
- - C:\WINDOWS\mssecsvr.exe
    C:\WINDOWS\mssecsvr.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:508

C:\WINDOWS\mssecsvr.exe
C:\WINDOWS\mssecsvr.exe -m security
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:1844

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvr.exe

Path C:\WINDOWS\mssecsvr.exe
Size 3.6MB
SHA256 cc156331634ebb7fefe03db31cdd4aa6be1ffba65d4a8907d8e8e28201fd1ccf
MD5 83a149789af41d52c7f37f20ce9985a2
SHA1 75c3f184fff9f57ac37d574aa457330a95ecc1d8
SHA512 7192c978601ea0bd95d7b84866f783a288d30878e4061cf695bcaed48f1d191220836954a329474856181092fcdf1294cda2184e1257a4f255efc8edfd506db8
SSDEEP 24576:tbLgurgDdmMSirYbcMNgef0QeQjG/D8kIqnLKz6626M+:tnsEMSPbcBVQej/TRx+
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvr.exe

Path C:\Windows\mssecsvr.exe
Size 3.6MB
SHA256 cc156331634ebb7fefe03db31cdd4aa6be1ffba65d4a8907d8e8e28201fd1ccf
MD5 83a149789af41d52c7f37f20ce9985a2
SHA1 75c3f184fff9f57ac37d574aa457330a95ecc1d8
SHA512 7192c978601ea0bd95d7b84866f783a288d30878e4061cf695bcaed48f1d191220836954a329474856181092fcdf1294cda2184e1257a4f255efc8edfd506db8
SSDEEP 24576:tbLgurgDdmMSirYbcMNgef0QeQjG/D8kIqnLKz6626M+:tnsEMSPbcBVQej/TRx+
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvr.exe

Path C:\Windows\mssecsvr.exe
Size 3.6MB
SHA256 cc156331634ebb7fefe03db31cdd4aa6be1ffba65d4a8907d8e8e28201fd1ccf
MD5 83a149789af41d52c7f37f20ce9985a2
SHA1 75c3f184fff9f57ac37d574aa457330a95ecc1d8
SHA512 7192c978601ea0bd95d7b84866f783a288d30878e4061cf695bcaed48f1d191220836954a329474856181092fcdf1294cda2184e1257a4f255efc8edfd506db8
SSDEEP 24576:tbLgurgDdmMSirYbcMNgef0QeQjG/D8kIqnLKz6626M+:tnsEMSPbcBVQej/TRx+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads