wannacry | 67f6f410bae46991e5d723beb5c4ace6416ee4ae5483e9d56935b57fa61862bc

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2023, 02:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mssecsvc.exe
Size

3.6MB
MD5

ec9b56e13d643ea6151c0e3ab9efef42
SHA1

158c911049e2cef105d8f3c84d66db9b7fef3971
SHA256

67f6f410bae46991e5d723beb5c4ace6416ee4ae5483e9d56935b57fa61862bc
SHA512

8c13724cd9ba6dae92ab66b9bd69e9256ba58945f0d8e2bd5fa283558f1c85ab72ce9ddb2d6ff3a90afa3131683e55777231c096cc60ae92e1844b8602d55bdc
SSDEEP

12288:GvbLgPlu+QhMbaIMu7L5NVErCA4z2g6rTc:2bLgddQhfdmMSirY

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3240) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Executes dropped EXE 1 IoCs

pid	Process
4124	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe

C:\Users\Admin\AppData\Local\Temp\mssecsvc.exe
"C:\Users\Admin\AppData\Local\Temp\mssecsvc.exe"
1⤵
- Drops file in Windows directory
PID:4776
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:4124

C:\Users\Admin\AppData\Local\Temp\mssecsvc.exe
C:\Users\Admin\AppData\Local\Temp\mssecsvc.exe -m security
1⤵
- Modifies data under HKEY_USERS
PID:3540

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
3dabf2eee320f9d0d3aee2ffe6cab816

SHA1
6d3f778de0b393eed45a522df15f57f58d33ef5d

SHA256
1df8c62f5259c0e8cc503490f760376bfd3830a07a213c3b2fe5d6d63809fec3

SHA512
dca20f52876bed9722afe2f770bb390d2da8bee560476ee8de02e2c70723a182aded62f99ae5f2b51df57c059d071aa5bfb2b11cecf9b99be2593969851c38ae

Download Submit