wannacry | 5527e5ed8fb971e705ebfe16f68e7a1175d80bdbfa92af672223fdc556f4fa9d

General

Target

66da6bd2b703134d7b74901f8a059419.dll
Size

5.0MB
MD5

66da6bd2b703134d7b74901f8a059419
SHA1

6ccd5843205e31b34fecdc53ca8917abe70e961c
SHA256

5527e5ed8fb971e705ebfe16f68e7a1175d80bdbfa92af672223fdc556f4fa9d
SHA512

76af3d35d378a412e9e00c0baaf9897b6cfac945107f980b8768cab90e614499d724a87de05d3a6ea1195acc1eba45cfeb9ee6871b93e672c36c56fafd1d44b2

Score

10^/10

wannacry ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Executes dropped EXE 2 IoCs

Processes:

mssecsvc.exemssecsvc.exe

pid process

1516 mssecsvc.exe
1972 mssecsvc.exe

Drops file in System32 directory 3 IoCs

Processes:

mssecsvc.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	mssecsvc.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\DRDI3DZ4.txt	mssecsvc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\DRDI3DZ4.txt	mssecsvc.exe

Drops file in Windows directory 2 IoCs

Processes:

rundll32.exemssecsvc.exe

description ioc process

File created C:\WINDOWS\mssecsvc.exe rundll32.exe
File created C:\WINDOWS\tasksche.exe mssecsvc.exe

description	ioc	process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 24 IoCs

Processes:

mssecsvc.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}\WpadDecisionReason = "1"	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}\WpadDecisionTime = 8009b5fd29d2d601	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}\WpadNetworkName = "Network"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}\32-e2-17-db-d2-77	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a070040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}\WpadDecision = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionReason = "1"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecision = "0"	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionTime = 8009b5fd29d2d601	mssecsvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

mssecsvc.exemssecsvc.exe

pid process

1516 mssecsvc.exe
1972 mssecsvc.exe

Suspicious behavior: MapViewOfSection 40 IoCs

Processes:

mssecsvc.exemssecsvc.exe

pid	process
1516	mssecsvc.exe
1516	mssecsvc.exe
1516	mssecsvc.exe
1516	mssecsvc.exe
1516	mssecsvc.exe
1516	mssecsvc.exe
1516	mssecsvc.exe
1516	mssecsvc.exe
1516	mssecsvc.exe
1516	mssecsvc.exe
1516	mssecsvc.exe
1516	mssecsvc.exe
1516	mssecsvc.exe
1516	mssecsvc.exe
1516	mssecsvc.exe
1516	mssecsvc.exe
1516	mssecsvc.exe
1516	mssecsvc.exe
1516	mssecsvc.exe
1972	mssecsvc.exe
1972	mssecsvc.exe
1972	mssecsvc.exe
1972	mssecsvc.exe
1972	mssecsvc.exe
1972	mssecsvc.exe
1972	mssecsvc.exe
1972	mssecsvc.exe
1972	mssecsvc.exe
1972	mssecsvc.exe
1972	mssecsvc.exe
1972	mssecsvc.exe
1972	mssecsvc.exe
1972	mssecsvc.exe
1972	mssecsvc.exe
1972	mssecsvc.exe
1972	mssecsvc.exe
1972	mssecsvc.exe
1972	mssecsvc.exe
1972	mssecsvc.exe
1972	mssecsvc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

mssecsvc.exemssecsvc.exe

description pid process

Token: SeDebugPrivilege 1516 mssecsvc.exe
Token: SeDebugPrivilege 1972 mssecsvc.exe

description	pid	process
Token: SeDebugPrivilege	1516	mssecsvc.exe
Token: SeDebugPrivilege	1972	mssecsvc.exe

Suspicious use of WriteProcessMemory 291 IoCs

Processes:

rundll32.exerundll32.exemssecsvc.exe

description	pid	process	target process
PID 644 wrote to memory of 1904	644	rundll32.exe	rundll32.exe
PID 644 wrote to memory of 1904	644	rundll32.exe	rundll32.exe
PID 644 wrote to memory of 1904	644	rundll32.exe	rundll32.exe
PID 644 wrote to memory of 1904	644	rundll32.exe	rundll32.exe
PID 644 wrote to memory of 1904	644	rundll32.exe	rundll32.exe
PID 644 wrote to memory of 1904	644	rundll32.exe	rundll32.exe
PID 644 wrote to memory of 1904	644	rundll32.exe	rundll32.exe
PID 1904 wrote to memory of 1516	1904	rundll32.exe	mssecsvc.exe
PID 1904 wrote to memory of 1516	1904	rundll32.exe	mssecsvc.exe
PID 1904 wrote to memory of 1516	1904	rundll32.exe	mssecsvc.exe
PID 1904 wrote to memory of 1516	1904	rundll32.exe	mssecsvc.exe
PID 1516 wrote to memory of 368	1516	mssecsvc.exe	csrss.exe
PID 1516 wrote to memory of 368	1516	mssecsvc.exe	csrss.exe
PID 1516 wrote to memory of 368	1516	mssecsvc.exe	csrss.exe
PID 1516 wrote to memory of 368	1516	mssecsvc.exe	csrss.exe
PID 1516 wrote to memory of 368	1516	mssecsvc.exe	csrss.exe
PID 1516 wrote to memory of 368	1516	mssecsvc.exe	csrss.exe
PID 1516 wrote to memory of 368	1516	mssecsvc.exe	csrss.exe
PID 1516 wrote to memory of 376	1516	mssecsvc.exe	wininit.exe
PID 1516 wrote to memory of 376	1516	mssecsvc.exe	wininit.exe
PID 1516 wrote to memory of 376	1516	mssecsvc.exe	wininit.exe
PID 1516 wrote to memory of 376	1516	mssecsvc.exe	wininit.exe
PID 1516 wrote to memory of 376	1516	mssecsvc.exe	wininit.exe
PID 1516 wrote to memory of 376	1516	mssecsvc.exe	wininit.exe
PID 1516 wrote to memory of 376	1516	mssecsvc.exe	wininit.exe
PID 1516 wrote to memory of 408	1516	mssecsvc.exe	winlogon.exe
PID 1516 wrote to memory of 408	1516	mssecsvc.exe	winlogon.exe
PID 1516 wrote to memory of 408	1516	mssecsvc.exe	winlogon.exe
PID 1516 wrote to memory of 408	1516	mssecsvc.exe	winlogon.exe
PID 1516 wrote to memory of 408	1516	mssecsvc.exe	winlogon.exe
PID 1516 wrote to memory of 408	1516	mssecsvc.exe	winlogon.exe
PID 1516 wrote to memory of 408	1516	mssecsvc.exe	winlogon.exe
PID 1516 wrote to memory of 464	1516	mssecsvc.exe	services.exe
PID 1516 wrote to memory of 464	1516	mssecsvc.exe	services.exe
PID 1516 wrote to memory of 464	1516	mssecsvc.exe	services.exe
PID 1516 wrote to memory of 464	1516	mssecsvc.exe	services.exe
PID 1516 wrote to memory of 464	1516	mssecsvc.exe	services.exe
PID 1516 wrote to memory of 464	1516	mssecsvc.exe	services.exe
PID 1516 wrote to memory of 464	1516	mssecsvc.exe	services.exe
PID 1516 wrote to memory of 472	1516	mssecsvc.exe	lsass.exe
PID 1516 wrote to memory of 472	1516	mssecsvc.exe	lsass.exe
PID 1516 wrote to memory of 472	1516	mssecsvc.exe	lsass.exe
PID 1516 wrote to memory of 472	1516	mssecsvc.exe	lsass.exe
PID 1516 wrote to memory of 472	1516	mssecsvc.exe	lsass.exe
PID 1516 wrote to memory of 472	1516	mssecsvc.exe	lsass.exe
PID 1516 wrote to memory of 472	1516	mssecsvc.exe	lsass.exe
PID 1516 wrote to memory of 480	1516	mssecsvc.exe	lsm.exe
PID 1516 wrote to memory of 480	1516	mssecsvc.exe	lsm.exe
PID 1516 wrote to memory of 480	1516	mssecsvc.exe	lsm.exe
PID 1516 wrote to memory of 480	1516	mssecsvc.exe	lsm.exe
PID 1516 wrote to memory of 480	1516	mssecsvc.exe	lsm.exe
PID 1516 wrote to memory of 480	1516	mssecsvc.exe	lsm.exe
PID 1516 wrote to memory of 480	1516	mssecsvc.exe	lsm.exe
PID 1516 wrote to memory of 580	1516	mssecsvc.exe	svchost.exe
PID 1516 wrote to memory of 580	1516	mssecsvc.exe	svchost.exe
PID 1516 wrote to memory of 580	1516	mssecsvc.exe	svchost.exe
PID 1516 wrote to memory of 580	1516	mssecsvc.exe	svchost.exe
PID 1516 wrote to memory of 580	1516	mssecsvc.exe	svchost.exe
PID 1516 wrote to memory of 580	1516	mssecsvc.exe	svchost.exe
PID 1516 wrote to memory of 580	1516	mssecsvc.exe	svchost.exe
PID 1516 wrote to memory of 660	1516	mssecsvc.exe	svchost.exe
PID 1516 wrote to memory of 660	1516	mssecsvc.exe	svchost.exe
PID 1516 wrote to memory of 660	1516	mssecsvc.exe	svchost.exe
PID 1516 wrote to memory of 660	1516	mssecsvc.exe	svchost.exe

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:472

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
2⤵
PID:580

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
3⤵
PID:2024

C:\Windows\system32\taskhost.exe
"taskhost.exe"
2⤵
PID:1124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
2⤵
PID:1048

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
2⤵
PID:932

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService
2⤵
PID:108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
2⤵
PID:856

C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
3⤵
PID:1844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
2⤵
PID:832

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
2⤵
PID:804

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
2⤵
PID:732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS
2⤵
PID:660

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1972

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:408

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:376

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
2⤵
PID:480

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:368

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1264

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\66da6bd2b703134d7b74901f8a059419.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:644

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\66da6bd2b703134d7b74901f8a059419.dll,#1
3⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1904

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe
4⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1516

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1208

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\MSSECSVC.EXE
MD5
07251eabca6cea8e9cb4ad38395c3a03

SHA1
a3a786c9bc65ee4669eafa57dff21576034c5f8b

SHA256
36271570082f46c90e4f0f6045d95c5df42bdefc0f9d437983634586c8a87949

SHA512
9e0eb7d289163865ac61838b883a87b0de65b6be92fc1666f5fd9534a46f1e1cbb219a14735a4fe5b94b798e438cb0334bb9d2ebbd2b7b4c247eecbf3df88c7b

Download Submit
C:\Windows\mssecsvc.exe
MD5
07251eabca6cea8e9cb4ad38395c3a03

SHA1
a3a786c9bc65ee4669eafa57dff21576034c5f8b

SHA256
36271570082f46c90e4f0f6045d95c5df42bdefc0f9d437983634586c8a87949

SHA512
9e0eb7d289163865ac61838b883a87b0de65b6be92fc1666f5fd9534a46f1e1cbb219a14735a4fe5b94b798e438cb0334bb9d2ebbd2b7b4c247eecbf3df88c7b

Download Submit
C:\Windows\mssecsvc.exe
MD5
07251eabca6cea8e9cb4ad38395c3a03

SHA1
a3a786c9bc65ee4669eafa57dff21576034c5f8b

SHA256
36271570082f46c90e4f0f6045d95c5df42bdefc0f9d437983634586c8a87949

SHA512
9e0eb7d289163865ac61838b883a87b0de65b6be92fc1666f5fd9534a46f1e1cbb219a14735a4fe5b94b798e438cb0334bb9d2ebbd2b7b4c247eecbf3df88c7b

Download Submit
memory/1516-3-0x0000000000000000-mapping.dmp

Download
memory/1904-2-0x0000000000000000-mapping.dmp

Download
memory/2024-5-0x000007FEF6350000-0x000007FEF65CA000-memory.dmp

Filesize
2.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads