wannacry | edd1fbcf42000838a7cb6bc32d4f41d8c2f894c0e749f0239b238d0432d0bf92

Analysis

Target

WannaCry/Trojan-Ransom.Win32.Wanna.m.1147f2c00d4bfd70169fe034c5965066.dll
Size

5.0MB
MD5

1147f2c00d4bfd70169fe034c5965066
SHA1

9980fd5980bd588e0208b3bfd369ce2736a808b8
SHA256

9b96dfe280eea60d7b0c309cdf41828f486f4f4d541953874763fdd81d5fb2ef
SHA512

2e16bdf113d151397b3b4ffe1cdba6c4dbe9fdfc126e9095c2d2c97cf4261d45354dccfc6ceaa0b4a46e58b54d8b4ccd607f536b324af7c155e2564a315b7081

Score

10^/10

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Executes dropped EXE 2 IoCs

Processes:

mssecsvr.exemssecsvr.exe

pid process

3292 mssecsvr.exe
4236 mssecsvr.exe

pid	process
3292	mssecsvr.exe
4236	mssecsvr.exe

Drops file in System32 directory 7 IoCs

Processes:

mssecsvr.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	mssecsvr.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	mssecsvr.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	mssecsvr.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\L835DOUO.cookie	mssecsvr.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\L835DOUO.cookie	mssecsvr.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	mssecsvr.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	mssecsvr.exe

Drops file in Windows directory 2 IoCs

Processes:

rundll32.exemssecsvr.exe

description ioc process

File created C:\WINDOWS\mssecsvr.exe rundll32.exe
File created C:\WINDOWS\tasksche.exe mssecsvr.exe

description	ioc	process
File created	C:\WINDOWS\mssecsvr.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvr.exe

Modifies data under HKEY_USERS 8 IoCs

Processes:

mssecsvr.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	mssecsvr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	mssecsvr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvr.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 3572 wrote to memory of 3684	3572	rundll32.exe	rundll32.exe
PID 3572 wrote to memory of 3684	3572	rundll32.exe	rundll32.exe
PID 3572 wrote to memory of 3684	3572	rundll32.exe	rundll32.exe
PID 3684 wrote to memory of 3292	3684	rundll32.exe	mssecsvr.exe
PID 3684 wrote to memory of 3292	3684	rundll32.exe	mssecsvr.exe
PID 3684 wrote to memory of 3292	3684	rundll32.exe	mssecsvr.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\WannaCry\Trojan-Ransom.Win32.Wanna.m.1147f2c00d4bfd70169fe034c5965066.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3572

C:\WINDOWS\mssecsvr.exe
MD5
036522081b0d51b7e9861497e09bf8b5

SHA1
2930963e13ba378503094565a13ea28af99cdc2f

SHA256
1389d6cc21e4e3c4ce70190e2fc03d75b3592c6a147e5ab882c1fa1f6cd5985b

SHA512
8017c4476877f23eb49d7119de3358b42db5a26a0121a56652158b8e4aee69d017e2046f65e81f490a14b146d9998f89cc9a3bfecfefe418cd8020945ca6c50e

Download Submit
C:\Windows\mssecsvr.exe
MD5
036522081b0d51b7e9861497e09bf8b5

SHA1
2930963e13ba378503094565a13ea28af99cdc2f

SHA256
1389d6cc21e4e3c4ce70190e2fc03d75b3592c6a147e5ab882c1fa1f6cd5985b

SHA512
8017c4476877f23eb49d7119de3358b42db5a26a0121a56652158b8e4aee69d017e2046f65e81f490a14b146d9998f89cc9a3bfecfefe418cd8020945ca6c50e

Download Submit
C:\Windows\mssecsvr.exe
MD5
036522081b0d51b7e9861497e09bf8b5

SHA1
2930963e13ba378503094565a13ea28af99cdc2f

SHA256
1389d6cc21e4e3c4ce70190e2fc03d75b3592c6a147e5ab882c1fa1f6cd5985b

SHA512
8017c4476877f23eb49d7119de3358b42db5a26a0121a56652158b8e4aee69d017e2046f65e81f490a14b146d9998f89cc9a3bfecfefe418cd8020945ca6c50e

Download Submit
memory/3292-3-0x0000000000000000-mapping.dmp

Download
memory/3684-2-0x0000000000000000-mapping.dmp

Download