wannacry | 55504677f82981962d85495231695d3a92aa0b31ec35a957bd9cbbef618658e3

Resubmissions

14/05/2024, 12:30

240514-ppzk2sff7610

28/03/2024, 15:38

240328-s3g5psag4510

28/03/2024, 15:37

240328-s2jbdahg8s10

Analysis

max time kernel
65s
max time network
65s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WannaCryDLL.dll
Size 5.0MB
Sample240514-ppzk2sff76
SHA256 55504677f82981962d85495231695d3a92aa0b31ec35a957bd9cbbef618658e3
MD5 30fe2f9a048d7a734c8d9233f64810ba
SHA1 2027a053de21bd5c783c3f823ed1d36966780ed4
SHA512 b657b02506f768db3255293b0c86452b4dfdd30804629c323aaa9510a3b637b0906e5963179ef7d4aaedc14646f2be2b4292e6584a6c55c6ddb596cff7f20e2a
SSDEEP 49152:SnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9:+DqPoBhz1aRxcSUDk36SAEdhvxWa9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (948) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 3 IoCs

pid	Process
4424	mssecsvc.exe
4324	mssecsvc.exe
60	tasksche.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133601634886418341"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe

Modifies registry class 38 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 5000310000000000a8586c5f100041646d696e003c0009000400efbea858c653ae58e6632e0000006fe101000000010000000000000000000000000000007bb30301410064006d0069006e00000014000000	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 7e00310000000000a858c85e11004465736b746f7000680009000400efbea858c653ae58ed632e00000079e101000000010000000000000000003e0000000000a0c20b014400650073006b0074006f007000000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370036003900000016000000	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\NodeSlot = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 7800310000000000a858c6531100557365727300640009000400efbe874f7748ae58e6632e000000c70500000000010000000000000000003a0000000000b177d70055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = ffffffff	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2444	WINWORD.EXE
2444	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1812	chrome.exe
1812	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1812	chrome.exe
1812	chrome.exe
1812	chrome.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1812	chrome.exe
Token: SeCreatePagefilePrivilege	1812	chrome.exe
Token: SeShutdownPrivilege	1812	chrome.exe
Token: SeCreatePagefilePrivilege	1812	chrome.exe
Token: SeShutdownPrivilege	1812	chrome.exe
Token: SeCreatePagefilePrivilege	1812	chrome.exe
Token: SeShutdownPrivilege	1812	chrome.exe
Token: SeCreatePagefilePrivilege	1812	chrome.exe
Token: SeShutdownPrivilege	1812	chrome.exe
Token: SeCreatePagefilePrivilege	1812	chrome.exe
Token: SeShutdownPrivilege	1812	chrome.exe
Token: SeCreatePagefilePrivilege	1812	chrome.exe
Token: SeShutdownPrivilege	1812	chrome.exe
Token: SeCreatePagefilePrivilege	1812	chrome.exe
Token: SeShutdownPrivilege	1812	chrome.exe
Token: SeCreatePagefilePrivilege	1812	chrome.exe
Token: SeShutdownPrivilege	1812	chrome.exe
Token: SeCreatePagefilePrivilege	1812	chrome.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
1812	chrome.exe
1812	chrome.exe
1812	chrome.exe
1812	chrome.exe
1812	chrome.exe
1812	chrome.exe
1812	chrome.exe
1812	chrome.exe
1812	chrome.exe
1812	chrome.exe
1812	chrome.exe
1812	chrome.exe
1812	chrome.exe
1812	chrome.exe
1812	chrome.exe
1812	chrome.exe
1812	chrome.exe
1812	chrome.exe
1812	chrome.exe
1812	chrome.exe
1812	chrome.exe
1812	chrome.exe
1812	chrome.exe
1812	chrome.exe
1812	chrome.exe
1812	chrome.exe
1812	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1812	chrome.exe
1812	chrome.exe
1812	chrome.exe
1812	chrome.exe
1812	chrome.exe
1812	chrome.exe
1812	chrome.exe
1812	chrome.exe
1812	chrome.exe
1812	chrome.exe
1812	chrome.exe
1812	chrome.exe
1812	chrome.exe
1812	chrome.exe
1812	chrome.exe
1812	chrome.exe
1812	chrome.exe
1812	chrome.exe
1812	chrome.exe
1812	chrome.exe
1812	chrome.exe
1812	chrome.exe
1812	chrome.exe
1812	chrome.exe

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
2444	WINWORD.EXE
2444	WINWORD.EXE
2444	WINWORD.EXE
2444	WINWORD.EXE
2444	WINWORD.EXE
2444	WINWORD.EXE
2444	WINWORD.EXE
2444	WINWORD.EXE
2444	WINWORD.EXE
2444	WINWORD.EXE
2444	WINWORD.EXE
2444	WINWORD.EXE
2444	WINWORD.EXE
2444	WINWORD.EXE
2444	WINWORD.EXE
3004	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 4332	4736	rundll32.exe	83
PID 4736 wrote to memory of 4332	4736	rundll32.exe	83
PID 4736 wrote to memory of 4332	4736	rundll32.exe	83
PID 4332 wrote to memory of 4424	4332	rundll32.exe	85
PID 4332 wrote to memory of 4424	4332	rundll32.exe	85
PID 4332 wrote to memory of 4424	4332	rundll32.exe	85
PID 1812 wrote to memory of 1072	1812	chrome.exe	94
PID 1812 wrote to memory of 1072	1812	chrome.exe	94
PID 1812 wrote to memory of 5036	1812	chrome.exe	95
PID 1812 wrote to memory of 5036	1812	chrome.exe	95
PID 1812 wrote to memory of 5036	1812	chrome.exe	95
PID 1812 wrote to memory of 5036	1812	chrome.exe	95
PID 1812 wrote to memory of 5036	1812	chrome.exe	95
PID 1812 wrote to memory of 5036	1812	chrome.exe	95
PID 1812 wrote to memory of 5036	1812	chrome.exe	95
PID 1812 wrote to memory of 5036	1812	chrome.exe	95
PID 1812 wrote to memory of 5036	1812	chrome.exe	95
PID 1812 wrote to memory of 5036	1812	chrome.exe	95
PID 1812 wrote to memory of 5036	1812	chrome.exe	95
PID 1812 wrote to memory of 5036	1812	chrome.exe	95
PID 1812 wrote to memory of 5036	1812	chrome.exe	95
PID 1812 wrote to memory of 5036	1812	chrome.exe	95
PID 1812 wrote to memory of 5036	1812	chrome.exe	95
PID 1812 wrote to memory of 5036	1812	chrome.exe	95
PID 1812 wrote to memory of 5036	1812	chrome.exe	95
PID 1812 wrote to memory of 5036	1812	chrome.exe	95
PID 1812 wrote to memory of 5036	1812	chrome.exe	95
PID 1812 wrote to memory of 5036	1812	chrome.exe	95
PID 1812 wrote to memory of 5036	1812	chrome.exe	95
PID 1812 wrote to memory of 5036	1812	chrome.exe	95
PID 1812 wrote to memory of 5036	1812	chrome.exe	95
PID 1812 wrote to memory of 5036	1812	chrome.exe	95
PID 1812 wrote to memory of 5036	1812	chrome.exe	95
PID 1812 wrote to memory of 5036	1812	chrome.exe	95
PID 1812 wrote to memory of 5036	1812	chrome.exe	95
PID 1812 wrote to memory of 5036	1812	chrome.exe	95
PID 1812 wrote to memory of 5036	1812	chrome.exe	95
PID 1812 wrote to memory of 5036	1812	chrome.exe	95
PID 1812 wrote to memory of 5036	1812	chrome.exe	95
PID 1812 wrote to memory of 3936	1812	chrome.exe	96
PID 1812 wrote to memory of 3936	1812	chrome.exe	96
PID 1812 wrote to memory of 3700	1812	chrome.exe	97
PID 1812 wrote to memory of 3700	1812	chrome.exe	97
PID 1812 wrote to memory of 3700	1812	chrome.exe	97
PID 1812 wrote to memory of 3700	1812	chrome.exe	97
PID 1812 wrote to memory of 3700	1812	chrome.exe	97
PID 1812 wrote to memory of 3700	1812	chrome.exe	97
PID 1812 wrote to memory of 3700	1812	chrome.exe	97
PID 1812 wrote to memory of 3700	1812	chrome.exe	97
PID 1812 wrote to memory of 3700	1812	chrome.exe	97
PID 1812 wrote to memory of 3700	1812	chrome.exe	97
PID 1812 wrote to memory of 3700	1812	chrome.exe	97
PID 1812 wrote to memory of 3700	1812	chrome.exe	97
PID 1812 wrote to memory of 3700	1812	chrome.exe	97
PID 1812 wrote to memory of 3700	1812	chrome.exe	97
PID 1812 wrote to memory of 3700	1812	chrome.exe	97
PID 1812 wrote to memory of 3700	1812	chrome.exe	97
PID 1812 wrote to memory of 3700	1812	chrome.exe	97
PID 1812 wrote to memory of 3700	1812	chrome.exe	97
PID 1812 wrote to memory of 3700	1812	chrome.exe	97
PID 1812 wrote to memory of 3700	1812	chrome.exe	97
PID 1812 wrote to memory of 3700	1812	chrome.exe	97
PID 1812 wrote to memory of 3700	1812	chrome.exe	97
PID 1812 wrote to memory of 3700	1812	chrome.exe	97

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\WannaCryDLL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\WannaCryDLL.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:4332
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:4424
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:60

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4324

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa6d8bab58,0x7ffa6d8bab68,0x7ffa6d8bab78
  2⤵
  PID:1072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1628 --field-trial-handle=1936,i,9682800511504149881,2255145693884835060,131072 /prefetch:2
  2⤵
  PID:5036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1936,i,9682800511504149881,2255145693884835060,131072 /prefetch:8
  2⤵
  PID:3936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2276 --field-trial-handle=1936,i,9682800511504149881,2255145693884835060,131072 /prefetch:8
  2⤵
  PID:3700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2944 --field-trial-handle=1936,i,9682800511504149881,2255145693884835060,131072 /prefetch:1
  2⤵
  PID:2984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2964 --field-trial-handle=1936,i,9682800511504149881,2255145693884835060,131072 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4212 --field-trial-handle=1936,i,9682800511504149881,2255145693884835060,131072 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4452 --field-trial-handle=1936,i,9682800511504149881,2255145693884835060,131072 /prefetch:8
  2⤵
  PID:3096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4568 --field-trial-handle=1936,i,9682800511504149881,2255145693884835060,131072 /prefetch:8
  2⤵
  PID:4700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4692 --field-trial-handle=1936,i,9682800511504149881,2255145693884835060,131072 /prefetch:8
  2⤵
  PID:4348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4704 --field-trial-handle=1936,i,9682800511504149881,2255145693884835060,131072 /prefetch:8
  2⤵
  PID:976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4824 --field-trial-handle=1936,i,9682800511504149881,2255145693884835060,131072 /prefetch:8
  2⤵
  PID:4032
- C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --reenable-autoupdates --system-level
  2⤵
  PID:1952
- - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x7ff6ea1aae48,0x7ff6ea1aae58,0x7ff6ea1aae68
    3⤵
    PID:3048

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:3832

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Documents\These.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2444

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 2b8902cc624b0b7f677a0c9de4283be7ed0b8b6957a29f49ffbba64b11fcf7d6
MD5 48bd06968ea75ea276dba4e6052dd4d4
SHA1 2ac28fd07a42169905cf8e96dffc1fb68d114f70
SHA512 3d33a83a8a07bfd07c885af83a5209310e9b78561256298604732fff48d327efc237e9951409bd732be933c77793d30e349c86d6cf97875b077e2ae5028cec8d
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 356B
SHA256 d7d842b105524a02866a45944b4f31434f1157ba2eb2d33ca7ce0313a19ab2cb
MD5 3f85491b95728cb59d6ef16b0fc82b3d
SHA1 d912e71fa258a201114dacbfab8a3de3bb195f21
SHA512 c5e0dbf5dc9d283740a1237e8e8d6f0aaf27894f3d902ac0306f12308bf557aa03c07486f11fa3f47365bccb973f152e64790ec71727966a2f3207f35fb99227
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 1d39f5fde4b9c272279395789ed5a4c40b884fcb9e580194e9a0665bc2b4f3d7
MD5 cedaf218fe5d3b5f65dc39b824816152
SHA1 a9d543120b3cc48482196399221a6884e3ddd046
SHA512 8ee3de7d53219fe0caa810c4a83b0200db5db46620ee9c6338a6ad4b6c08c640d90c7da8050ae9eb9effca8d382d0ad82b6c89149ab4baa3d6f8ca0bd3437a71
SSDEEP 96:K2VKpAXAipL8KIkJdEV8iZRy7Dx+6MSmuexIOtZhheJqeIMEVhYtjEsXt0/cgVup:Km8AppL8aJ88syh+FBF/Md5tjEsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 16KB
SHA256 37ca41d97e89442dbe4a303b27ac1a6d8c0aa90e91210d7ca8fabf53ee25d418
MD5 1ee72b54024e8fe69a40f89abc1cd315
SHA1 ee89109798ac7279ba1e0a4cc993eec0dfbd8f0a
SHA512 61a5e49505b4c2e553763ef640e204a2fdf69bd4f28be7ab0058aa784903104d6e732be2df89d7e960143a83e5c5e8bccfa711c4e2b79df6b02b7f0b9536aaf7
SSDEEP 384:YY2WLPLezJXhL1kXqKf/pUZNCgVLH2Hf9w5rUkuHGNuWdbTE:YnWLPLuNhL1kXqKf/pUZNCgVLH2Hfq5u
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 256KB
SHA256 be3cbee0988634424d1041cd359f5973314df1091c1df6867e2ca2877408f6e5
MD5 e3014140f0e081b6e700eeb55ba27eb0
SHA1 e5eab9f12b31451c1127f3467fb2c71847f6ef73
SHA512 e167403c9e2a7893da605949953f1cd9e9680e22bc7c194ce3c565fdf8d359fafabf6e256ea7d72e38bf63c38cad52aa411290a3661f44d247f5700b6101179e
SSDEEP 6144:eFNMbA+MCpmFZ6swHKH/U+osQYRPILxZnhLMJjX0EeGzY2rLq:eYbA9s4jwHyM+osQ5fnReEFsLLq
MD5 SHA1 SHA512 SSDEEP

Submit Download

1143E95A-B1D0-4611-8B80-C0CCB0125DC9

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\odc.officeapps.live.com\1143E95A-B1D0-4611-8B80-C0CCB0125DC9
Size 1KB
SHA256 2fb3e7ca57b5ec8657ff2b909c74dee246e7ed2b30abd60dec96fc4fb88bd165
MD5 85ad173999ed440af6120f3b4fd436fa
SHA1 eebe3bae40b0c82db581b905e2a4c4a90055c9b3
SHA512 3c506252a27bc4a3d718fc2ad89036850ee3c9d5fd79966fc5e28debe1844d96e8d2777e160e8537034129fd8109dff027bf5eb4a082c99d0db93730ec31427e
MD5 SHA1 SHA512

Submit Download

D48CB35F-0CC3-4877-ADB7-E8C456C8C3CB

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\odc.officeapps.live.com\D48CB35F-0CC3-4877-ADB7-E8C456C8C3CB
Size 397B
SHA256 57d6315a8f1f11aaa111a9956ddd0d560f791f757c379ed77bbb5a1b5b577f52
MD5 2f82426450332b558a61ae9ca551abd9
SHA1 abdbf8f8bdd7572bcdefbd1e0b7da8d3cf17144d
SHA512 dbc43dab6cbde98647c5a88cd508a1528ef79c030286cf82cb4cb03c4af81930ad1c3b2644ead9eceea27cd5772324f42a51f04f1693102254567205a6abf0b5
MD5 SHA1 SHA512

Submit Download

iso690.xsl

Path C:\Users\Admin\AppData\Local\Temp\TCD1033.tmp\iso690.xsl
Size 263KB
SHA256 3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
MD5 ff0e07eff1333cdf9fc2523d323dd654
SHA1 77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA512 b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
SSDEEP 6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
MD5 SHA1 SHA512 SSDEEP

Submit Download

index.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Size 202B
SHA256 fe33f57205e2ebb981c4744d5a4ddc231f587a9a0589e6565c52e1051eadb0c0
MD5 4566d1d70073cd75fe35acb78ff9d082
SHA1 f602ecc057a3c19aa07671b34b4fdd662aa033cc
SHA512 b9584ebfdd25cc588162dd6525a399c72ac03bf0c61709b96a19feba7217d840ae2c60d7b0d3b43307a2776f497a388e79ef8a646c12ae59a7f5cc4789bbf3c8
MD5 SHA1 SHA512

Submit Download

index.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Size 217B
SHA256 a714488530c3a75cbebbd4c282ae333b50610911dbfa484152901f79842d7b39
MD5 84c4cc02627d8fadcf52a8fd7dee6f29
SHA1 956c77c8d6ed3273b4b3ab9b82732a37635d1bf8
SHA512 0aa17309fdd971632ff3c420eac3f6a3e967ce1dcfb3aa50a83fa78303b16c3cc9715b3756f4c5734164e81d07e1de82aebd4027f3c3b5040c25eefcb2dcd461
MD5 SHA1 SHA512

Submit Download

index.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Size 232B
SHA256 010853825fdbb02180240426682217ee5bfbab0cda5ff7d9c7833827484ba622
MD5 747f98c59e5f61ef23e6b9ce97ace5c1
SHA1 b090b4c8c985b0d0e8d5d35936cb896252047c43
SHA512 54fcb85be9328a3487107634c6650913ced026e6d39dd632c4c03a2c19f300321ae78076302445feaefa1747b3a573022e85e9f2a6e314af01af09ad396e681e
MD5 SHA1 SHA512

Submit Download

fb3b0dbfee58fac8.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Size 3KB
SHA256 5e739bed77eb13dd26ad8fce712db88412e10e522307df7f0885af85ee0a5c9d
MD5 99e47410fff13caa2875637d215e044a
SHA1 34936f008848e5b1fa37f6bc7b86579f7a3e7b4f
SHA512 350e06cd01eb66e0a0cc85589a483b1ef85677256e40e13ee74d3c34c8c768d73d6a413a22779b092e092e9b4095e1a167d338fbcf9ececfd90c1e556aec873b
MD5 SHA1 SHA512

Submit Download

~WRD0000.tmp

Path C:\Users\Admin\Desktop\~WRD0000.tmp
Size 11KB
SHA256 0c1f8425896dacc2ec0c048a46c967acc46282e5d1dadba402bf300b89ff5d18
MD5 83af256c1e804047ad4bb318113d8755
SHA1 d97085808c23e2d07a27698b18332d165e3ce5f8
SHA512 3257438ae6eb6ef1013280dafefca32fa9720fe132f37de669a22d8b7ba368da9487c47bbc84a4be4d717532958a188143884f5f732f87ac4b0573ec4a109291
SSDEEP 192:CtPTktISXC43S7Ok0Z15/SekFk5MhCl5ebfj711VY:aP6ISXxC78JSuMhCMjVY
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 e1bee0f7a7cd0ac8659033d9e67bfc83ae03843ed30dff8ca590f916604a6de7
MD5 90a1e06d78737b9a87e8ea42f76e2544
SHA1 785ddf8bd3add2da415cbc7c39aab7eb21407d20
SHA512 40ee623eb975b3890d3e8260e76963d078a7734c040d4151fa0cf11fd6e2421f5ea609f67922a51c6df7a09f077087361586d5f40208bc97ee70531e2a3df5be
SSDEEP 49152:2nAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9:yDqPoBhz1aRxcSUDk36SAEdhvxWa9
MD5 SHA1 SHA512 SSDEEP

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 10111f53da4181d548ea77cc91f02a15b9ede3f111f074230761f2afee7cd637
MD5 0df2ae526d7350c2e3d1383c07a6be04
SHA1 06c4d41c60736ea1e0bb1b095536499e05068442
SHA512 9ca1ca36dcefdb1eba3152bc2d14c9dceb3360960338d13db5f8a02327aef80cb0ab238c2c1f3d2dbd7fd75124d4199b5cd63f173a09a0dea212ebb265f8453d
SSDEEP 49152:nQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9:QqPoBhz1aRxcSUDk36SAEdhvxWa9
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2444-138-0x00007FFA4B0D0000-0x00007FFA4B0E0000-memory.dmp

Download

memory/2444-136-0x00007FFA4B0D0000-0x00007FFA4B0E0000-memory.dmp

Download

memory/2444-142-0x00007FFA48DD0000-0x00007FFA48DE0000-memory.dmp

Download

memory/2444-141-0x00007FFA48DD0000-0x00007FFA48DE0000-memory.dmp

Download

memory/2444-140-0x00007FFA4B0D0000-0x00007FFA4B0E0000-memory.dmp

Download

memory/2444-139-0x00007FFA4B0D0000-0x00007FFA4B0E0000-memory.dmp

Download

memory/2444-137-0x00007FFA4B0D0000-0x00007FFA4B0E0000-memory.dmp

Download

memory/2444-659-0x00007FFA4B0D0000-0x00007FFA4B0E0000-memory.dmp

Download

memory/2444-658-0x00007FFA4B0D0000-0x00007FFA4B0E0000-memory.dmp

Download

memory/2444-657-0x00007FFA4B0D0000-0x00007FFA4B0E0000-memory.dmp

Download

memory/2444-656-0x00007FFA4B0D0000-0x00007FFA4B0E0000-memory.dmp

Download