wannacry | 35c0e0c0e70565cfdc78ac708e122c2f65059ea337216418d674a343da90927e

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
18/12/2022, 12:31

Target
01bdc6fb077098f4a3b60f4b0e479a7f.dll
Size 5.0MB
Sample221218-pp2emseg5s
SHA256 35c0e0c0e70565cfdc78ac708e122c2f65059ea337216418d674a343da90927e
MD5 01bdc6fb077098f4a3b60f4b0e479a7f
SHA1 61acc362327a7df8f7672b905c62414f769beb61
SHA512 1c1adcf76854c615cd80ff489845c3261ff3de5f6dd1374527cdd5e00ecb0510a4a03df554f4299dd786d8d3abc6a3f7ad9ecda3cfed6e19b00c6cf30321bab5
SSDEEP 49152:RnvMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnv:1vPoBhz1aRxcSUDk36SAEdhv
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Executes dropped EXE 2 IoCs

pid	Process
868	mssecsvr.exe
4344	mssecsvr.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	mssecsvr.exe
File created	C:\WINDOWS\mssecsvr.exe	rundll32.exe

Modifies data under HKEY_USERS 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvr.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 756	2912	rundll32.exe	81
PID 2912 wrote to memory of 756	2912	rundll32.exe	81
PID 2912 wrote to memory of 756	2912	rundll32.exe	81
PID 756 wrote to memory of 868	756	rundll32.exe	82
PID 756 wrote to memory of 868	756	rundll32.exe	82
PID 756 wrote to memory of 868	756	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\01bdc6fb077098f4a3b60f4b0e479a7f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\01bdc6fb077098f4a3b60f4b0e479a7f.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:756
- - C:\WINDOWS\mssecsvr.exe
    C:\WINDOWS\mssecsvr.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:868

mssecsvr.exe

Path C:\WINDOWS\mssecsvr.exe
Size 2.2MB
SHA256 46988f6a24d131166de061d95bad9ab9de3a53ab0286e7c9cb39333eaea562f7
MD5 ad8aa6668838b6d869f81fb289b636b1
SHA1 cc3643cd70f59854e492369b7e580a298fb7ad31
SHA512 1bf2b56ba5a84a0232d80855e9df52e844eb751fc5953d09fce9263648ecc62a580fd4bf72890e0d1528c008547596ad91376a8a25b65dddaabb6a2708a6da44
SSDEEP 49152:QnvMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvn:QvPoBhz1aRxcSUDk36SAEdhvn
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvr.exe

Path C:\Windows\mssecsvr.exe
Size 2.2MB
SHA256 46988f6a24d131166de061d95bad9ab9de3a53ab0286e7c9cb39333eaea562f7
MD5 ad8aa6668838b6d869f81fb289b636b1
SHA1 cc3643cd70f59854e492369b7e580a298fb7ad31
SHA512 1bf2b56ba5a84a0232d80855e9df52e844eb751fc5953d09fce9263648ecc62a580fd4bf72890e0d1528c008547596ad91376a8a25b65dddaabb6a2708a6da44
SSDEEP 49152:QnvMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvn:QvPoBhz1aRxcSUDk36SAEdhvn
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvr.exe

Path C:\Windows\mssecsvr.exe
Size 2.2MB
SHA256 46988f6a24d131166de061d95bad9ab9de3a53ab0286e7c9cb39333eaea562f7
MD5 ad8aa6668838b6d869f81fb289b636b1
SHA1 cc3643cd70f59854e492369b7e580a298fb7ad31
SHA512 1bf2b56ba5a84a0232d80855e9df52e844eb751fc5953d09fce9263648ecc62a580fd4bf72890e0d1528c008547596ad91376a8a25b65dddaabb6a2708a6da44
SSDEEP 49152:QnvMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvn:QvPoBhz1aRxcSUDk36SAEdhvn
MD5 SHA1 SHA512 SSDEEP

Submit Download