wannacry | 4c52ef702d12e6b58aa6077ac96b3354488adc711b8fd11489546a46b86f0c48

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
20/05/2024, 02:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6d5b8b99056a0b2e5700472f3edfcaf6.dll
Size 5.0MB
Sample240520-dc2dbsgd35
SHA256 9debc5e72e428bf4bab1de706af71d56297db1fb0647c4f7afb0ab445d3f7807
MD5 6d5b8b99056a0b2e5700472f3edfcaf6
SHA1 d17e4bdfc3aeacd46959c5fca60b51c4563648c4
SHA512 59975e14be89dbc7152f864bef0a8ce232076dd40aebda159ee1193ce1832454f6219bd685c54a78de5a9820e217b04ccc949fb8d72d6e0ec5b2ecdf23031b26
SSDEEP 98304:+8cPoBhz+aRxcSUDk36SAEdhvxWa9P593R8yAVp2H:+8cPe+Cxcxk3ZAEUadzR8yc4H
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3313) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 3 IoCs

pid	Process
1436	mssecsvc.exe
1232	mssecsvc.exe
3564	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3944 wrote to memory of 1744	3944	rundll32.exe	83
PID 3944 wrote to memory of 1744	3944	rundll32.exe	83
PID 3944 wrote to memory of 1744	3944	rundll32.exe	83
PID 1744 wrote to memory of 1436	1744	rundll32.exe	84
PID 1744 wrote to memory of 1436	1744	rundll32.exe	84
PID 1744 wrote to memory of 1436	1744	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6d5b8b99056a0b2e5700472f3edfcaf6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3944
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6d5b8b99056a0b2e5700472f3edfcaf6.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1744
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:1436
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:3564

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
PID:1232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 57991b108c95a9b89dc8b791a4acbde0f733400ada952872e0df32dbe2ceac18
MD5 52106ec28b42c45f1fa6f47490caf074
SHA1 737c65bb1a7b44c35aee735ab4a552a1db406d4a
SHA512 d348dd6b961a6509c350cab09fc831f764816abf414b5ba566812195f6a0b53b38c2e0157eea01ec200f71c5ce6e62642123f621ab4f04569920c115b55c2e1d
SSDEEP 98304:y8cPoBhz+aRxcSUDk36SAEdhvxWa9P593R8yAVp2HI:y8cPe+Cxcxk3ZAEUadzR8yc4HI
MD5 SHA1 SHA512 SSDEEP

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 95613a93ce9f940b9cd828efdce24001e222e4265419d4a01119015875228f28
MD5 27b97c24e767ff1d1b9302c89e4ff007
SHA1 fcbe2979b6fe94b483914e3527f7f3fc84516170
SHA512 8f4cafd0656c2745cefdacaf84f07736ec3d012fa4cade43a3bb2a035447e9b8805e37c3000e5f6498f7691f2445548bf9372744421d754d52a9033ecbdca3fb
SSDEEP 98304:QcPoBhz+aRxcSUDk36SAEdhvxWa9P593R8yAVp2Hj:QcPe+Cxcxk3ZAEUadzR8yc4Hj
MD5 SHA1 SHA512 SSDEEP