wannacry | 4c52ef702d12e6b58aa6077ac96b3354488adc711b8fd11489546a46b86f0c48

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
20-05-2024 02:52

Target

6d5b8b99056a0b2e5700472f3edfcaf6.dll
Size

5.0MB
MD5

6d5b8b99056a0b2e5700472f3edfcaf6
SHA1

d17e4bdfc3aeacd46959c5fca60b51c4563648c4
SHA256

9debc5e72e428bf4bab1de706af71d56297db1fb0647c4f7afb0ab445d3f7807
SHA512

59975e14be89dbc7152f864bef0a8ce232076dd40aebda159ee1193ce1832454f6219bd685c54a78de5a9820e217b04ccc949fb8d72d6e0ec5b2ecdf23031b26
SSDEEP

98304:+8cPoBhz+aRxcSUDk36SAEdhvxWa9P593R8yAVp2H:+8cPe+Cxcxk3ZAEUadzR8yc4H

Score

10^/10

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3313) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Executes dropped EXE 3 IoCs

Processes:

mssecsvc.exemssecsvc.exetasksche.exe

pid process

1436 mssecsvc.exe
1232 mssecsvc.exe
3564 tasksche.exe
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Drops file in Windows directory 2 IoCs

Processes:

mssecsvc.exerundll32.exe

description ioc process

File created C:\WINDOWS\tasksche.exe mssecsvc.exe
File created C:\WINDOWS\mssecsvc.exe rundll32.exe

description	ioc	process
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 3944 wrote to memory of 1744	3944	rundll32.exe	rundll32.exe
PID 3944 wrote to memory of 1744	3944	rundll32.exe	rundll32.exe
PID 3944 wrote to memory of 1744	3944	rundll32.exe	rundll32.exe
PID 1744 wrote to memory of 1436	1744	rundll32.exe	mssecsvc.exe
PID 1744 wrote to memory of 1436	1744	rundll32.exe	mssecsvc.exe
PID 1744 wrote to memory of 1436	1744	rundll32.exe	mssecsvc.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6d5b8b99056a0b2e5700472f3edfcaf6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3944

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
4⤵
- Executes dropped EXE
PID:3564

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
PID:1232

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

C:\Windows\mssecsvc.exe
Filesize
3.6MB

MD5
52106ec28b42c45f1fa6f47490caf074

SHA1
737c65bb1a7b44c35aee735ab4a552a1db406d4a

SHA256
57991b108c95a9b89dc8b791a4acbde0f733400ada952872e0df32dbe2ceac18

SHA512
d348dd6b961a6509c350cab09fc831f764816abf414b5ba566812195f6a0b53b38c2e0157eea01ec200f71c5ce6e62642123f621ab4f04569920c115b55c2e1d

Download Submit
C:\Windows\tasksche.exe
Filesize
3.4MB

MD5
27b97c24e767ff1d1b9302c89e4ff007

SHA1
fcbe2979b6fe94b483914e3527f7f3fc84516170

SHA256
95613a93ce9f940b9cd828efdce24001e222e4265419d4a01119015875228f28

SHA512
8f4cafd0656c2745cefdacaf84f07736ec3d012fa4cade43a3bb2a035447e9b8805e37c3000e5f6498f7691f2445548bf9372744421d754d52a9033ecbdca3fb

Download Submit