wannacry | c90e821a05d8f49992ce932bdd50d6cd619915023c9f52d3ba5822fc6adcf7c3

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2022, 00:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9ff0e934b9828f8a0cc6199a5209ae65.dll
Size 5.0MB
Sample220723-aaa7ksafg3
SHA256 c90e821a05d8f49992ce932bdd50d6cd619915023c9f52d3ba5822fc6adcf7c3
MD5 9ff0e934b9828f8a0cc6199a5209ae65
SHA1 9bd4901c2873303fccd00f153709c4b1b2468b03
SHA512 45b0fd5ca3d668a34d7126e3b3818febafc8345ee4fa6a3ae47cfa64b5192238b7a9760e05ee11843431aa7e6e5e1ef1e227de3c8eb1a47927c549b62030e9ac
MD5 SHA1 SHA512

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3262) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Executes dropped EXE 3 IoCs

pid	Process
4636	mssecsvc.exe
3256	mssecsvc.exe
3344	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1412 wrote to memory of 3496	1412	rundll32.exe	78
PID 1412 wrote to memory of 3496	1412	rundll32.exe	78
PID 1412 wrote to memory of 3496	1412	rundll32.exe	78
PID 3496 wrote to memory of 4636	3496	rundll32.exe	79
PID 3496 wrote to memory of 4636	3496	rundll32.exe	79
PID 3496 wrote to memory of 4636	3496	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9ff0e934b9828f8a0cc6199a5209ae65.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9ff0e934b9828f8a0cc6199a5209ae65.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:3496
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:4636
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:3344

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
PID:3256

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvc.exe

Path C:\WINDOWS\mssecsvc.exe
Size 3.6MB
SHA256 75a6c9ceb0cdecc5e77070fe5e7ff9e46a9bc89daff271857c769b7144e886d9
MD5 b0b91495c548b8ad4c3e4de3068a56a5
SHA1 11d776f31c34a4e12d3b92638fe566ba0aee8efc
SHA512 c497aff54498335ac72d27948417693a79882cef17cf6618d8b09b8fe2417dfb06cd7cdb5f191fa5fb10627d987296a51f766e893ecfa6f8feacdcc3bfc30584
SSDEEP 98304:Z8qPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp:Z8qPe1Cxcxk3ZAEUadzR8yc
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 75a6c9ceb0cdecc5e77070fe5e7ff9e46a9bc89daff271857c769b7144e886d9
MD5 b0b91495c548b8ad4c3e4de3068a56a5
SHA1 11d776f31c34a4e12d3b92638fe566ba0aee8efc
SHA512 c497aff54498335ac72d27948417693a79882cef17cf6618d8b09b8fe2417dfb06cd7cdb5f191fa5fb10627d987296a51f766e893ecfa6f8feacdcc3bfc30584
SSDEEP 98304:Z8qPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp:Z8qPe1Cxcxk3ZAEUadzR8yc
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 75a6c9ceb0cdecc5e77070fe5e7ff9e46a9bc89daff271857c769b7144e886d9
MD5 b0b91495c548b8ad4c3e4de3068a56a5
SHA1 11d776f31c34a4e12d3b92638fe566ba0aee8efc
SHA512 c497aff54498335ac72d27948417693a79882cef17cf6618d8b09b8fe2417dfb06cd7cdb5f191fa5fb10627d987296a51f766e893ecfa6f8feacdcc3bfc30584
SSDEEP 98304:Z8qPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp:Z8qPe1Cxcxk3ZAEUadzR8yc
MD5 SHA1 SHA512 SSDEEP

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 09456a069108a04536678906458396fda5350e01e72e8eb5a21bd200b5738896
MD5 01696ec28fe6eb2c030d6b8cb56394b7
SHA1 9d8a3431b7f1e729914d4c0be092330e5a1ff843
SHA512 dda0a9c01b43d72ebe67dbd2445e2237d07427befd8df104f01a9ea62542f908fcfc04e866185d422ab5d9f04a86ca8e5c59c6b87629be0696bbe4fc1c9ec1ef
SSDEEP 98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp:QqPe1Cxcxk3ZAEUadzR8yc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads