wannacry | a5dabe33b1721f3aa144e6bd3e5364521f3793a45c7ca9a07b28073bf20eff7b

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220718-en
resource tags

arch:x64arch:x86image:win10v2004-20220718-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2022, 07:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f1c1fc835aabddc1adc200e26acd0745.dll
Size 5.0MB
Sample220720-jhkknadfhm
SHA256 a5dabe33b1721f3aa144e6bd3e5364521f3793a45c7ca9a07b28073bf20eff7b
MD5 f1c1fc835aabddc1adc200e26acd0745
SHA1 14bf8595ec6b87db66ed6ab6f5704110a0b787c6
SHA512 38230e6d7d50319dff8241b6a83e10dd50c401338b92981eee43701ab00a19c08a0dc342ea6edb5baee7e80d9d4dbe0251e291c0c73d39aed675f78edb794104
MD5 SHA1 SHA512

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3242) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Executes dropped EXE 3 IoCs

pid	Process
4308	mssecsvc.exe
3576	mssecsvc.exe
4292	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3536 wrote to memory of 3796	3536	rundll32.exe	76
PID 3536 wrote to memory of 3796	3536	rundll32.exe	76
PID 3536 wrote to memory of 3796	3536	rundll32.exe	76
PID 3796 wrote to memory of 4308	3796	rundll32.exe	77
PID 3796 wrote to memory of 4308	3796	rundll32.exe	77
PID 3796 wrote to memory of 4308	3796	rundll32.exe	77

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f1c1fc835aabddc1adc200e26acd0745.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f1c1fc835aabddc1adc200e26acd0745.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:3796
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:4308
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:4292

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:3576

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvc.exe

Path C:\WINDOWS\mssecsvc.exe
Size 3.6MB
SHA256 d166b5c75449ef64b033e97b0d8ca7f3c4d4b24b8ddf45a19643df0e5aea8e9f
MD5 f3039c7336e7f6d4328f94fa303dcced
SHA1 1677d4d93437e2d8515f35d6b26e1b00030bc03a
SHA512 3244ff12287276525595b64ca832fe8356454df6adf1a1de6cd07992a95595e6432ff85b9f9e496975fa8df4685a70fb68e18cf60fce666c6c58acd2c00c1f3c
SSDEEP 98304:yDqPoBhz1a/FMeSBijyup5j5lFra0qf6oagD3nV0rM/ZkcLEWesx/V:yDqPe1cqC4D3dZko
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 d166b5c75449ef64b033e97b0d8ca7f3c4d4b24b8ddf45a19643df0e5aea8e9f
MD5 f3039c7336e7f6d4328f94fa303dcced
SHA1 1677d4d93437e2d8515f35d6b26e1b00030bc03a
SHA512 3244ff12287276525595b64ca832fe8356454df6adf1a1de6cd07992a95595e6432ff85b9f9e496975fa8df4685a70fb68e18cf60fce666c6c58acd2c00c1f3c
SSDEEP 98304:yDqPoBhz1a/FMeSBijyup5j5lFra0qf6oagD3nV0rM/ZkcLEWesx/V:yDqPe1cqC4D3dZko
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 d166b5c75449ef64b033e97b0d8ca7f3c4d4b24b8ddf45a19643df0e5aea8e9f
MD5 f3039c7336e7f6d4328f94fa303dcced
SHA1 1677d4d93437e2d8515f35d6b26e1b00030bc03a
SHA512 3244ff12287276525595b64ca832fe8356454df6adf1a1de6cd07992a95595e6432ff85b9f9e496975fa8df4685a70fb68e18cf60fce666c6c58acd2c00c1f3c
SSDEEP 98304:yDqPoBhz1a/FMeSBijyup5j5lFra0qf6oagD3nV0rM/ZkcLEWesx/V:yDqPe1cqC4D3dZko
MD5 SHA1 SHA512 SSDEEP

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 eec16823fe58cbed7d91ac56356e17a87af9f2488753e1f200c5bf5b46151db1
MD5 435273746a63b67feb46ba53b3f57075
SHA1 1d9c9c6e3266061c6ad2a84466eec1b7153ff16c
SHA512 c5a1c46361f3b4e55f17e3d335f668b6eefb07058d64f3019c70575e890ea9dba64731a692aa7b91a4873938c5c4f2798f4cb86bb73d20df9b53ff3a0ba440a5
SSDEEP 98304:QqPoBhz1a/FMeSBijyup5j5lFra0qf6oagD3nV0rM/ZkcLEWesx/y:QqPe1cqC4D3dZkf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads