wannacry | 85edc3417897d2ce22bf400b9b150e11880ee4900aeb4942e42cb093d91e9d87

Analysis

max time kernel
151s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2023, 05:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
85edc3417897d2ce22bf400b9b150e11880ee4900aeb4942e42cb093d91e9d87.dll
Size 5.0MB
Sample230404-gp398sdc38
SHA256 85edc3417897d2ce22bf400b9b150e11880ee4900aeb4942e42cb093d91e9d87
MD5 60e13232ce1353aec7877377e16da14f
SHA1 21b13e3025aa5559e2b67e08899144b15ad2818c
SHA512 d12f50e18a907fc00c770909813d3f025e52be9349e4e473451d9836a9514f08eeb3560fb0ea8d0c719147954d1ccc30412142007b4cafa7d1baf3629054736e
SSDEEP 12288:yvbLgPlu+QhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7:SbLgddQhfdmMSirYbcMNge
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3167) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Executes dropped EXE 3 IoCs

pid	Process
412	mssecsvc.exe
1248	mssecsvc.exe
1056	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4228 wrote to memory of 4460	4228	rundll32.exe	83
PID 4228 wrote to memory of 4460	4228	rundll32.exe	83
PID 4228 wrote to memory of 4460	4228	rundll32.exe	83
PID 4460 wrote to memory of 412	4460	rundll32.exe	84
PID 4460 wrote to memory of 412	4460	rundll32.exe	84
PID 4460 wrote to memory of 412	4460	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\85edc3417897d2ce22bf400b9b150e11880ee4900aeb4942e42cb093d91e9d87.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\85edc3417897d2ce22bf400b9b150e11880ee4900aeb4942e42cb093d91e9d87.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:4460
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:412
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:1056

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:1248

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvc.exe

Path C:\WINDOWS\mssecsvc.exe
Size 3.6MB
SHA256 a92c16fbf108c896b5689148904f7e7d73968ac637acfc26d617c55b17de2c5f
MD5 3192780de6dcd830fd833876b74b7578
SHA1 0e1e7aae8e94805755f81790c84a9371ca598b1a
SHA512 e1e33d992015902fdd7b89016b074a8777917c626609ec6ade0edeea7e1007fee10dd5b4354484baeb43f773f6b57a2ede95801b9cd7bc0a5c729861f929cbc6
SSDEEP 12288:GvbLgPlu+QhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7:2bLgddQhfdmMSirYbcMNge
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 a92c16fbf108c896b5689148904f7e7d73968ac637acfc26d617c55b17de2c5f
MD5 3192780de6dcd830fd833876b74b7578
SHA1 0e1e7aae8e94805755f81790c84a9371ca598b1a
SHA512 e1e33d992015902fdd7b89016b074a8777917c626609ec6ade0edeea7e1007fee10dd5b4354484baeb43f773f6b57a2ede95801b9cd7bc0a5c729861f929cbc6
SSDEEP 12288:GvbLgPlu+QhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7:2bLgddQhfdmMSirYbcMNge
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 a92c16fbf108c896b5689148904f7e7d73968ac637acfc26d617c55b17de2c5f
MD5 3192780de6dcd830fd833876b74b7578
SHA1 0e1e7aae8e94805755f81790c84a9371ca598b1a
SHA512 e1e33d992015902fdd7b89016b074a8777917c626609ec6ade0edeea7e1007fee10dd5b4354484baeb43f773f6b57a2ede95801b9cd7bc0a5c729861f929cbc6
SSDEEP 12288:GvbLgPlu+QhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7:2bLgddQhfdmMSirYbcMNge
MD5 SHA1 SHA512 SSDEEP

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 ba506ecc5212c5c7451a38bed1de25578d51d711631b2249b54216f74ef163f7
MD5 b423507025201d67687db1ed1f4923f2
SHA1 785f97fca6af5a350b4b2ea64be1c802aca49226
SHA512 ba2bedd628e87caf2eb4903cb0f08f232da5ae58421e945a7cf1e09e952631d612beab718df3441cb87bc74778ddaeeabe1233c8f4903de3d74a4f366ac6a205
SSDEEP 12288:nQhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7:nQhfdmMSirYbcMNge
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads