Overview

overview

10

Static

static

3

Win32.Wannacry.dll

windows7-x64

10

Win32.Wannacry.dll

windows10-1703-x64

10

Win32.Wannacry.dll

windows10-2004-x64

10

Win32.Wannacry.dll

windows11-21h2-x64

Resubmissions

03-02-2024 16:18

240203-tsdj7sffem 10

03-02-2024 16:16

240203-tq495sffcp 10

02-02-2024 12:22

240202-pkafcsfgbj 10

Analysis

  • max time kernel
    72s
  • max time network
    73s
  • platform
    windows11-21h2_x64
  • resource
    win11-20231222-en
  • resource tags

    arch:x64arch:x86image:win11-20231222-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    03-02-2024 16:16

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    Win32.Wannacry.dll

  • Size

    5.0MB

  • MD5

    30fe2f9a048d7a734c8d9233f64810ba

  • SHA1

    2027a053de21bd5c783c3f823ed1d36966780ed4

  • SHA256

    55504677f82981962d85495231695d3a92aa0b31ec35a957bd9cbbef618658e3

  • SHA512

    b657b02506f768db3255293b0c86452b4dfdd30804629c323aaa9510a3b637b0906e5963179ef7d4aaedc14646f2be2b4292e6584a6c55c6ddb596cff7f20e2a

  • SSDEEP

    49152:SnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9:+DqPoBhz1aRxcSUDk36SAEdhvxWa9

Score
10/10
wannacrydiscoveryransomwareworm

Malware Config

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry
  • Contacts a large (1154) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Executes dropped EXE 3 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 64 IoCs
  • Checks SCSI registry key(s) 3 TTPs 43 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 20 IoCs
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of FindShellTrayWindow 41 IoCs
  • Suspicious use of SendNotifyMessage 41 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\Win32.Wannacry.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3216
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\Win32.Wannacry.dll,#1
      2⤵
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:4932
      • C:\WINDOWS\mssecsvc.exe
        C:\WINDOWS\mssecsvc.exe
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        PID:3252
        • C:\WINDOWS\tasksche.exe
          C:\WINDOWS\tasksche.exe /i
          4⤵
          • Executes dropped EXE
          PID:3012
  • C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe -m security
    1⤵
    • Executes dropped EXE
    • Modifies data under HKEY_USERS
    PID:4672
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /0
    1⤵
    • Checks SCSI registry key(s)
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1032
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
    1⤵
      PID:4652
    • C:\Windows\System32\oobe\UserOOBEBroker.exe
      C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
      1⤵
      • Drops file in Windows directory
      PID:3644
    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
      C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
      1⤵
        PID:3888
      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
        C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
        1⤵
          PID:4484
        • C:\Windows\SysWOW64\DllHost.exe
          C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
          1⤵
            PID:4256
          • C:\Windows\system32\mmc.exe
            "C:\Windows\system32\mmc.exe" C:\Windows\system32\devmgmt.msc
            1⤵
            • Drops file in System32 directory
            • Drops file in Windows directory
            • Checks SCSI registry key(s)
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:3228
          • C:\Windows\system32\AUDIODG.EXE
            C:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004D8
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:5072
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
            1⤵
              PID:924
            • C:\Windows\system32\LogonUI.exe
              "LogonUI.exe" /flags:0x4 /state0:0xa39ec855 /state1:0x41c64e6d
              1⤵
              • Modifies data under HKEY_USERS
              • Suspicious use of SetWindowsHookEx
              PID:3956

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2024-2-3.1620.3888.1.odl
              Filesize

              706B

              MD5

              26acad5161bb6be1ec691d7151dbfa60

              SHA1

              f959267c59254581d1d6f76c60cb1fc4a9f22f42

              SHA256

              4f3b6e37f8d57ea1f0d30088cc796f39855e345264fec1df6bc354f64707297c

              SHA512

              e90aff416894a7c6e9fd97e8719957ce9f062439b134cc44e077cb2a9b4b2aa290b9a733164841386811552ba85bbd1da31b528d90ed8d0efa30fee651821a83

              Download Submit

            • C:\WINDOWS\mssecsvc.exe
              Filesize

              735KB

              MD5

              3803d65041d487fc155388c66e889a5a

              SHA1

              d4baef6ffa4381aa95eafc0ed2e6353319cff1c8

              SHA256

              c9e1ec8ddb2d774c2a64d641a9ff235440f234c121cb2539c1c295bc6dba1b2c

              SHA512

              06cfb73800634cf5c76bafafa6600f730ade7db2a6dcab0f30a04a1ac39e89e80fd0aa9ed8e72e14b80941a3e503b572e76b5d376b8fa2b7227a3fbf63e153b0

              Download Submit

            • C:\Windows\mssecsvc.exe
              Filesize

              816KB

              MD5

              43eedb7305c907b84787a07862a2d2c8

              SHA1

              15d7cf5fbd6d00edc64a885e52a2c0ce6e2b72c2

              SHA256

              343e40595bf34e37ef3f2712ae535837588fa32d512e95e1ee35b17029853c68

              SHA512

              672bb10b0f6823879c690801daef5aa36bcbe203a385e22ef1ee76a437f1b8d7a4f16d0b37724e779352520384a8f81373540554cba4c0056e80cc97ed62affb

              Download Submit

            • C:\Windows\mssecsvc.exe
              Filesize

              785KB

              MD5

              5bc1f5c2a7a8ab0eaae2866bd47a5626

              SHA1

              01a88e259c040291725538b7f4c0f0eea9cb3bc3

              SHA256

              6bc6f45770a56f77393ab88cba1789369be1fc043521e5a43b319a100cfd23f6

              SHA512

              79fcbcdb5cd26c45257c1d35d29bf18cf0152f2e57463c4ad3e0365390d2305efbf657b63830a3f7fc0a2d09d474ee244edd75fcc681017abc227f35553aec8b

              Download Submit

            • C:\Windows\tasksche.exe
              Filesize

              408KB

              MD5

              abd0a6f21e8e8a274178c20de5c499e1

              SHA1

              75d19c2310b33a6ceb9754645a4deab536ba1053

              SHA256

              cc5c950e053fe002fb59ee4545460911fbab3d43be81a9200b65733fcb5ac8f6

              SHA512

              bf1ed4a627dd8deb62ed93faa0cc64bd54992fbb4eaee9326868569138782563c9080124f8cf50142443de36497988b6a73fd380276dddaf8ad5d2df86f61bec

              Download Submit

            • memory/1032-10-0x000001490B520000-0x000001490B521000-memory.dmp

              Filesize

              4KB

              Download

            • memory/1032-9-0x000001490B520000-0x000001490B521000-memory.dmp

              Filesize

              4KB

              Download

            • memory/1032-14-0x000001490B520000-0x000001490B521000-memory.dmp

              Filesize

              4KB

              Download

            • memory/1032-15-0x000001490B520000-0x000001490B521000-memory.dmp

              Filesize

              4KB

              Download

            • memory/1032-16-0x000001490B520000-0x000001490B521000-memory.dmp

              Filesize

              4KB

              Download

            • memory/1032-17-0x000001490B520000-0x000001490B521000-memory.dmp

              Filesize

              4KB

              Download

            • memory/1032-18-0x000001490B520000-0x000001490B521000-memory.dmp

              Filesize

              4KB

              Download

            • memory/1032-19-0x000001490B520000-0x000001490B521000-memory.dmp

              Filesize

              4KB

              Download

            • memory/1032-20-0x000001490B520000-0x000001490B521000-memory.dmp

              Filesize

              4KB

              Download

            • memory/1032-8-0x000001490B520000-0x000001490B521000-memory.dmp

              Filesize

              4KB

              Download