wannacry | f7e7b1fdd816b045c91493cd86c981cad0a6991dd723ebbadd5e5b939c11e75e

Analysis

max time kernel
146s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220718-en
resource tags

arch:x64arch:x86image:win10v2004-20220718-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2022, 07:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0dd3b9c8506a31c892afd67ad8ae4877.dll
Size 5.0MB
Sample220720-hzy9psdaa6
SHA256 f7e7b1fdd816b045c91493cd86c981cad0a6991dd723ebbadd5e5b939c11e75e
MD5 0dd3b9c8506a31c892afd67ad8ae4877
SHA1 d889f5a34f147116f73859c9920305a4fc97265b
SHA512 4cf1c0dcf9e9c2f5d473cdefb2d7bda3ca1d659ca7921b8aaa977bed86d49bb6e1810705c5ab506e1677a65f13c25772ff2d038132797c02b79e400a84efd07a
MD5 SHA1 SHA512

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3220) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Executes dropped EXE 3 IoCs

pid	Process
1588	mssecsvc.exe
1864	mssecsvc.exe
2840	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 1476	1368	rundll32.exe	77
PID 1368 wrote to memory of 1476	1368	rundll32.exe	77
PID 1368 wrote to memory of 1476	1368	rundll32.exe	77
PID 1476 wrote to memory of 1588	1476	rundll32.exe	78
PID 1476 wrote to memory of 1588	1476	rundll32.exe	78
PID 1476 wrote to memory of 1588	1476	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0dd3b9c8506a31c892afd67ad8ae4877.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0dd3b9c8506a31c892afd67ad8ae4877.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1476
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:1588
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:2840

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
PID:1864

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvc.exe

Path C:\WINDOWS\mssecsvc.exe
Size 3.6MB
SHA256 b5a1e0366fff18a94361c453a2edbc54026b64ab2d3f56599d88d6af5fd4ada8
MD5 838818ca64d97af5aa029f36e7ac0498
SHA1 1e99ee84ca27b639abe13b6418b8b383790047d1
SHA512 733ee70b648ce38a74239b1d882eabfc1cbda4f5f390cadf9eccff4ae0b563b724e600a7eaade1a2c35d67500f34a6ee5d51441e16a3b183ff60163488076e57
SSDEEP 98304:y8qPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp26f:y8qPe1Cxcxk3ZAEUadzR8yc4Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 b5a1e0366fff18a94361c453a2edbc54026b64ab2d3f56599d88d6af5fd4ada8
MD5 838818ca64d97af5aa029f36e7ac0498
SHA1 1e99ee84ca27b639abe13b6418b8b383790047d1
SHA512 733ee70b648ce38a74239b1d882eabfc1cbda4f5f390cadf9eccff4ae0b563b724e600a7eaade1a2c35d67500f34a6ee5d51441e16a3b183ff60163488076e57
SSDEEP 98304:y8qPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp26f:y8qPe1Cxcxk3ZAEUadzR8yc4Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 b5a1e0366fff18a94361c453a2edbc54026b64ab2d3f56599d88d6af5fd4ada8
MD5 838818ca64d97af5aa029f36e7ac0498
SHA1 1e99ee84ca27b639abe13b6418b8b383790047d1
SHA512 733ee70b648ce38a74239b1d882eabfc1cbda4f5f390cadf9eccff4ae0b563b724e600a7eaade1a2c35d67500f34a6ee5d51441e16a3b183ff60163488076e57
SSDEEP 98304:y8qPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp26f:y8qPe1Cxcxk3ZAEUadzR8yc4Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 e5148da49c5755b4e88a2f11101a5bb67ffca366350f21117566a8c307a6b16f
MD5 c3a6646c0f98ff2ac9b5403b61a108aa
SHA1 b36814bba84790aadc5f0963b8505c247af90ba1
SHA512 a1c31fcde807e47f9b9f90616a1eed73d14cdd0e55683cc9020c652dc005712569e5e3dcbab500ccc637c2c2765d0659593bfefb487399b21d960c9e1e02b95b
SSDEEP 98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp26r:QqPe1Cxcxk3ZAEUadzR8yc40
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads