wannacry | ba8179c3448afe4420ed0afa4eee05e8955ae8d1e10bfd5a4d3de1e12f19763d

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23/12/2022, 11:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c475b82f1e0b421e051622f034b1d5e3.dll
Size 5.0MB
Sample221223-nfzzsagd49
SHA256 ba8179c3448afe4420ed0afa4eee05e8955ae8d1e10bfd5a4d3de1e12f19763d
MD5 c475b82f1e0b421e051622f034b1d5e3
SHA1 e1cfa940659f8dcf46098f67ec3de711e7123cb5
SHA512 bbc36d925fb888af9224c1414ac2c9a9d2f6b3cdbc356983d4483a5dab3ec891481de74c55b681214d0468802b3cf49f4c9d050438bec6ad850577d167a30494
SSDEEP 98304:TDqPoBhz1aRxcSUDk36SAEdhvxWa9P593RkAVp2H:TDqPe1Cxcxk3ZAEUadzRkc4H
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry

Executes dropped EXE 3 IoCs

pid	Process
2124	mssecsvc.exe
1848	mssecsvc.exe
3924	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 4852	2732	rundll32.exe	84
PID 2732 wrote to memory of 4852	2732	rundll32.exe	84
PID 2732 wrote to memory of 4852	2732	rundll32.exe	84
PID 4852 wrote to memory of 2124	4852	rundll32.exe	85
PID 4852 wrote to memory of 2124	4852	rundll32.exe	85
PID 4852 wrote to memory of 2124	4852	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c475b82f1e0b421e051622f034b1d5e3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c475b82f1e0b421e051622f034b1d5e3.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:4852
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:2124
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:3924

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:1848

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvc.exe

Path C:\WINDOWS\mssecsvc.exe
Size 3.6MB
SHA256 36530938bbdd38fb199856ab40406c5578faa007e584ded595d86d4a5700217c
MD5 7355e73bc2532e1eb2deb79ab045a1ec
SHA1 325ce3b049bb7d5695754b384ef6ce349c67cf1b
SHA512 ff1c4c2f13bec1f86587665a826812d0c7e7d7ffce7097f03b98de757e82f3105408800d3b12acbdc62d3331bf793847540047356e23aa3c3830ae6349f0fb18
SSDEEP 98304:XDqPoBhz1aRxcSUDk36SAEdhvxWa9P593RkAVp2HI:XDqPe1Cxcxk3ZAEUadzRkc4HI
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 36530938bbdd38fb199856ab40406c5578faa007e584ded595d86d4a5700217c
MD5 7355e73bc2532e1eb2deb79ab045a1ec
SHA1 325ce3b049bb7d5695754b384ef6ce349c67cf1b
SHA512 ff1c4c2f13bec1f86587665a826812d0c7e7d7ffce7097f03b98de757e82f3105408800d3b12acbdc62d3331bf793847540047356e23aa3c3830ae6349f0fb18
SSDEEP 98304:XDqPoBhz1aRxcSUDk36SAEdhvxWa9P593RkAVp2HI:XDqPe1Cxcxk3ZAEUadzRkc4HI
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 36530938bbdd38fb199856ab40406c5578faa007e584ded595d86d4a5700217c
MD5 7355e73bc2532e1eb2deb79ab045a1ec
SHA1 325ce3b049bb7d5695754b384ef6ce349c67cf1b
SHA512 ff1c4c2f13bec1f86587665a826812d0c7e7d7ffce7097f03b98de757e82f3105408800d3b12acbdc62d3331bf793847540047356e23aa3c3830ae6349f0fb18
SSDEEP 98304:XDqPoBhz1aRxcSUDk36SAEdhvxWa9P593RkAVp2HI:XDqPe1Cxcxk3ZAEUadzRkc4HI
MD5 SHA1 SHA512 SSDEEP

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 21a2da6d4b00480ae75a70c0ecbd0915579b713f5261c389ce3c1919398046d7
MD5 55ef5240fd5040496d9bb6fc39ef7962
SHA1 cbb4e0e243654319838f8da88ac2417c84152d0a
SHA512 e472dbc52a25846498dfb61fe2f9e5c268679cf64ef8938c607de5b2be0d85c8aeb5f3673fb110cbc4429d29359833010bf2415840d0d91ba6b37c5636250bcc
SSDEEP 98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593RkAVp2Hj:QqPe1Cxcxk3ZAEUadzRkc4Hj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads