wannacry | 922022bf489a915d2e75c58619fffdd0b6b8003833886554eec87b88746753dd

Analysis

max time kernel
187s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2022, 08:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
922022bf489a915d2e75c58619fffdd0b6b8003833886554eec87b88746753dd.dll
Size 5.0MB
Sample221012-jzd47sdaak
SHA256 922022bf489a915d2e75c58619fffdd0b6b8003833886554eec87b88746753dd
MD5 00f6f68aef14d7e633718fd98c5849bf
SHA1 d1ecadafb4afad7e8d68f5e569a42ab62dfcccf0
SHA512 09ef586365e8fb959370ccb9462e560352a9ce1f33957ab97d1403d8d69143b11e0eedb96d49aeb7a1c95e76ee8ac0745ddd79952b8373c931afce8ffc23e04b
SSDEEP 24576:SbLgdriwhfdmMSirYbcMNgef0QeQjGomS:SnQqMSPbcBVQejomS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (2108) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Executes dropped EXE 2 IoCs

pid	Process
3772	mssecsvc.exe
3548	mssecsvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe

Modifies data under HKEY_USERS 12 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 4788	4888	rundll32.exe	81
PID 4888 wrote to memory of 4788	4888	rundll32.exe	81
PID 4888 wrote to memory of 4788	4888	rundll32.exe	81
PID 4788 wrote to memory of 3772	4788	rundll32.exe	82
PID 4788 wrote to memory of 3772	4788	rundll32.exe	82
PID 4788 wrote to memory of 3772	4788	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\922022bf489a915d2e75c58619fffdd0b6b8003833886554eec87b88746753dd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\922022bf489a915d2e75c58619fffdd0b6b8003833886554eec87b88746753dd.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:4788
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:3772

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:3548

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvc.exe

Path C:\WINDOWS\mssecsvc.exe
Size 3.6MB
SHA256 e6beb330b820b9bad2b842ffa43e86b459203ecb9033ae2ca5945d203fc19ddc
MD5 8fedce5651a3fd362c8f593da8395b37
SHA1 02a1e007e175db799f5a0fd363523839b31c7185
SHA512 34eb8d17b52aa779b46feb38b596aa841a0dadb2f2f54e68ca66107a7b8d0a000208b1ed13c5f9aa2ce73a8ef538b713866ab0e90e6fdeb2e3a2d4475f13c421
SSDEEP 24576:2bLgdriwhfdmMSirYbcMNgef0QeQjGomSS:2nQqMSPbcBVQejomSS
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 e6beb330b820b9bad2b842ffa43e86b459203ecb9033ae2ca5945d203fc19ddc
MD5 8fedce5651a3fd362c8f593da8395b37
SHA1 02a1e007e175db799f5a0fd363523839b31c7185
SHA512 34eb8d17b52aa779b46feb38b596aa841a0dadb2f2f54e68ca66107a7b8d0a000208b1ed13c5f9aa2ce73a8ef538b713866ab0e90e6fdeb2e3a2d4475f13c421
SSDEEP 24576:2bLgdriwhfdmMSirYbcMNgef0QeQjGomSS:2nQqMSPbcBVQejomSS
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 e6beb330b820b9bad2b842ffa43e86b459203ecb9033ae2ca5945d203fc19ddc
MD5 8fedce5651a3fd362c8f593da8395b37
SHA1 02a1e007e175db799f5a0fd363523839b31c7185
SHA512 34eb8d17b52aa779b46feb38b596aa841a0dadb2f2f54e68ca66107a7b8d0a000208b1ed13c5f9aa2ce73a8ef538b713866ab0e90e6fdeb2e3a2d4475f13c421
SSDEEP 24576:2bLgdriwhfdmMSirYbcMNgef0QeQjGomSS:2nQqMSPbcBVQejomSS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads