wannacry | ff95f0d81247ca01a46e54ccbe1154e9f5cfbb3e854bc6460882d9ecce2abc83

Analysis

max time kernel
120s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11-07-2024 23:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

16067c78a3393c4604b7a2ad4e908a90N.dll
Size

5.0MB
MD5

16067c78a3393c4604b7a2ad4e908a90
SHA1

47c0864838a0e172249ed4dc2947fa24435b34c9
SHA256

ff95f0d81247ca01a46e54ccbe1154e9f5cfbb3e854bc6460882d9ecce2abc83
SHA512

fab51fea0f7a2763f5605a8982eb19f5490a2ac0120161cbd3a6a34348f3b63bb2b635c72c994d8cbf9465b55dd5c199f32dd5946f360dbb80a4a41cc254ac4a
SSDEEP

49152:RnpENbcBVQe01INRx+TSqTdX1HkQo6SAARdhnv:1p+oBh01aRxcSUDk36SAEdhv

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (1317) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 3 IoCs

pid	Process
612	mssecsvr.exe
2856	mssecsvr.exe
1960	tasksche.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	mssecsvr.exe
File created	C:\Windows\__tmp_rar_sfx_access_check_240669375	tasksche.exe
File created	C:\Windows\eee.exe	tasksche.exe
File created	C:\WINDOWS\mssecsvr.exe	rundll32.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvr.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 4516	4636	rundll32.exe	83
PID 4636 wrote to memory of 4516	4636	rundll32.exe	83
PID 4636 wrote to memory of 4516	4636	rundll32.exe	83
PID 4516 wrote to memory of 612	4516	rundll32.exe	85
PID 4516 wrote to memory of 612	4516	rundll32.exe	85
PID 4516 wrote to memory of 612	4516	rundll32.exe	85
PID 612 wrote to memory of 1960	612	mssecsvr.exe	92
PID 612 wrote to memory of 1960	612	mssecsvr.exe	92
PID 612 wrote to memory of 1960	612	mssecsvr.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\16067c78a3393c4604b7a2ad4e908a90N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\16067c78a3393c4604b7a2ad4e908a90N.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:4516
- - C:\WINDOWS\mssecsvr.exe
    C:\WINDOWS\mssecsvr.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:612
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      PID:1960

C:\WINDOWS\mssecsvr.exe
C:\WINDOWS\mssecsvr.exe -m security
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\mssecsvr.exe

Filesize
2.2MB

MD5
53db41c9b29c1ef8242d21dc33b9f81b

SHA1
999fbe2d2ba609e5f3dc4a244a4737654336addb

SHA256
249d0c7a79ee1b2bc0170d43b6eb24f87b045d617a87a563ec0f474d88b8f122

SHA512
e070356d033ec0409a13bdea060e2c7e449f9d40ef54df0d76bf050d2a6d013a2de615b057e24a6a11112df6921ab43f03ab56281f9919b5cdc1ea3cc8aba8d8

Download Submit
C:\Windows\tasksche.exe

Filesize
2.0MB

MD5
90b4050408a6daf42b0fe666b2f1b41b

SHA1
8b2d64befe94ab1c692b3d9218764560bfd7ad05

SHA256
99a622faf7fa1f73c8c2df50589cfb917fdb093e7336675e8d2e51b449d3e7e9

SHA512
2f8113a333be1e4c57e99b223ad6f8d9609e97ae4be5a1f155714d3a65f0c0c6dc6e51a9f4bf3237492c751e9ff0f36fce391e0661c70781f234e618c993674b

Download Submit