wannacry | 495956157d35d72a276365fab6b4ec6387b2552d67444227dd4e1ade8336156c

Analysis

max time kernel
188s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2022, 03:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
495956157d35d72a276365fab6b4ec6387b2552d67444227dd4e1ade8336156c.dll
Size 5.0MB
Sample221012-d8dl5scchk
SHA256 495956157d35d72a276365fab6b4ec6387b2552d67444227dd4e1ade8336156c
MD5 a51beb6c0ac1650cc9161d77a7b4ffe4
SHA1 140e7d3e026ed3e9372630792966943cafdf7d8c
SHA512 6c319dc91ebb2f1808bb9e7eb3ee1beaa5357e334250802ac173fd73bbca267160b2bfac6db13b4468868b7ed05fd0e34baad54c2bb540140296d9ddb10e6030
SSDEEP 24576:ubLgurgDdmMSirYbcMNgef0QeQjG/D8kIqYmiHkQg65ASk+RdhAdmvctA0p+9XEk:unsEMSPbcBVQej/s1HkQrAARdhnvoAH
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (2587) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Executes dropped EXE 2 IoCs

pid	Process
1600	mssecsvr.exe
1120	mssecsvr.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	mssecsvr.exe
File created	C:\WINDOWS\mssecsvr.exe	rundll32.exe

Modifies data under HKEY_USERS 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvr.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3452 wrote to memory of 1296	3452	rundll32.exe	81
PID 3452 wrote to memory of 1296	3452	rundll32.exe	81
PID 3452 wrote to memory of 1296	3452	rundll32.exe	81
PID 1296 wrote to memory of 1600	1296	rundll32.exe	82
PID 1296 wrote to memory of 1600	1296	rundll32.exe	82
PID 1296 wrote to memory of 1600	1296	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\495956157d35d72a276365fab6b4ec6387b2552d67444227dd4e1ade8336156c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3452
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\495956157d35d72a276365fab6b4ec6387b2552d67444227dd4e1ade8336156c.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1296
- - C:\WINDOWS\mssecsvr.exe
    C:\WINDOWS\mssecsvr.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:1600

C:\WINDOWS\mssecsvr.exe
C:\WINDOWS\mssecsvr.exe -m security
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:1120

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvr.exe

Path C:\WINDOWS\mssecsvr.exe
Size 3.6MB
SHA256 363392deccfedda47ab0c639ffb37d5ebedb3218448ba1a8b80349382e3d2b00
MD5 b9d9625066a34cc108ca55ea141c624a
SHA1 4f51a129f39bb40a84f004997ceac9c6ac3fcd36
SHA512 63fc7643dbae65c8996b8d3713c218703f542b7add86f260e6760c4601809c79a1a750fe7291bac3c8e0e822792923277cfcf7e6e1b195c4843638014219da0b
SSDEEP 24576:tbLgurgDdmMSirYbcMNgef0QeQjG/D8kIqYmiHkQg65ASk+RdhAdmvctA0p+9XEx:tnsEMSPbcBVQej/s1HkQrAARdhnvoAHI
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvr.exe

Path C:\Windows\mssecsvr.exe
Size 3.6MB
SHA256 363392deccfedda47ab0c639ffb37d5ebedb3218448ba1a8b80349382e3d2b00
MD5 b9d9625066a34cc108ca55ea141c624a
SHA1 4f51a129f39bb40a84f004997ceac9c6ac3fcd36
SHA512 63fc7643dbae65c8996b8d3713c218703f542b7add86f260e6760c4601809c79a1a750fe7291bac3c8e0e822792923277cfcf7e6e1b195c4843638014219da0b
SSDEEP 24576:tbLgurgDdmMSirYbcMNgef0QeQjG/D8kIqYmiHkQg65ASk+RdhAdmvctA0p+9XEx:tnsEMSPbcBVQej/s1HkQrAARdhnvoAHI
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvr.exe

Path C:\Windows\mssecsvr.exe
Size 3.6MB
SHA256 363392deccfedda47ab0c639ffb37d5ebedb3218448ba1a8b80349382e3d2b00
MD5 b9d9625066a34cc108ca55ea141c624a
SHA1 4f51a129f39bb40a84f004997ceac9c6ac3fcd36
SHA512 63fc7643dbae65c8996b8d3713c218703f542b7add86f260e6760c4601809c79a1a750fe7291bac3c8e0e822792923277cfcf7e6e1b195c4843638014219da0b
SSDEEP 24576:tbLgurgDdmMSirYbcMNgef0QeQjG/D8kIqYmiHkQg65ASk+RdhAdmvctA0p+9XEx:tnsEMSPbcBVQej/s1HkQrAARdhnvoAHI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads