wannacry | 3efcdb3cd177306f741832cfe8c0d2190d7182b566322c4a5fae83e71fbb3666

General

Target

3efcdb3cd177306f741832cfe8c0d2190d7182b566322c4a5fae83e71fbb3666.dll
Size

5.0MB
MD5

f86d9b9e04f2926f2e0e322376a83a50
SHA1

abc20652bdbd9a45eb4c0be6a4f6d4973d085c5f
SHA256

3efcdb3cd177306f741832cfe8c0d2190d7182b566322c4a5fae83e71fbb3666
SHA512

ce3d1b926c692f9f18394ac73b1919c300f197fc72824abd482de69aa6f88c5b25b40655964fd1279540aafe976b41ef43ca62ae16dbf27d446b0a94712b4e37

Score

10^/10

wannacry ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Executes dropped EXE 3 IoCs

Processes:

mssecsvr.exemssecsvr.exemssecsvr.exe

pid process

1096 mssecsvr.exe
1812 mssecsvr.exe
1280 mssecsvr.exe

pid	process
1096	mssecsvr.exe
1812	mssecsvr.exe
1280	mssecsvr.exe

Drops file in System32 directory 6 IoCs

Processes:

mssecsvr.exemssecsvr.exe

description	ioc	process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\IBF1HUG9.txt	mssecsvr.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\IBF1HUG9.txt	mssecsvr.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	mssecsvr.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\4IKY210O.txt	mssecsvr.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\4IKY210O.txt	mssecsvr.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	mssecsvr.exe

Drops file in Windows directory 2 IoCs

Processes:

rundll32.exemssecsvr.exe

description ioc process

File created C:\WINDOWS\mssecsvr.exe rundll32.exe
File created C:\WINDOWS\tasksche.exe mssecsvr.exe
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

1080 1812 WerFault.exe mssecsvr.exe
876 1280 WerFault.exe mssecsvr.exe

description	ioc	process
File created	C:\WINDOWS\mssecsvr.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvr.exe

pid	pid_target	process	target process
1080	1812	WerFault.exe	mssecsvr.exe
876	1280	WerFault.exe	mssecsvr.exe

Modifies data under HKEY_USERS 49 IoCs

Processes:

mssecsvr.exemssecsvr.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a07001f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	mssecsvr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecisionTime = 00baf65c9d4ad701	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecision = "0"	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionReason = "1"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77	mssecsvr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionTime = 00baf65c9d4ad701	mssecsvr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a07001f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionTime = 406c7a8c9d4ad701	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	mssecsvr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecision = "0"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	mssecsvr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadNetworkName = "Network"	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	mssecsvr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecisionReason = "1"	mssecsvr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecisionTime = 406c7a8c9d4ad701	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecision = "0"	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	mssecsvr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a07001f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecisionReason = "1"	mssecsvr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionTime = 00baf65c9d4ad701	mssecsvr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDetectedUrl	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\32-e2-17-db-d2-77	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecision = "0"	mssecsvr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\32-e2-17-db-d2-77	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	mssecsvr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	mssecsvr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	mssecsvr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadNetworkName = "Network"	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionReason = "1"	mssecsvr.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

WerFault.exeWerFault.exe

pid	process
1080	WerFault.exe
1080	WerFault.exe
1080	WerFault.exe
1080	WerFault.exe
1080	WerFault.exe
876	WerFault.exe
876	WerFault.exe
876	WerFault.exe
876	WerFault.exe
876	WerFault.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

WerFault.exeWerFault.exe

description pid process

Token: SeDebugPrivilege 1080 WerFault.exe
Token: SeDebugPrivilege 876 WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1080	WerFault.exe
Token: SeDebugPrivilege	876	WerFault.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

rundll32.exerundll32.exemssecsvr.exemssecsvr.exe

description	pid	process	target process
PID 1080 wrote to memory of 1252	1080	rundll32.exe	rundll32.exe
PID 1080 wrote to memory of 1252	1080	rundll32.exe	rundll32.exe
PID 1080 wrote to memory of 1252	1080	rundll32.exe	rundll32.exe
PID 1080 wrote to memory of 1252	1080	rundll32.exe	rundll32.exe
PID 1080 wrote to memory of 1252	1080	rundll32.exe	rundll32.exe
PID 1080 wrote to memory of 1252	1080	rundll32.exe	rundll32.exe
PID 1080 wrote to memory of 1252	1080	rundll32.exe	rundll32.exe
PID 1252 wrote to memory of 1096	1252	rundll32.exe	mssecsvr.exe
PID 1252 wrote to memory of 1096	1252	rundll32.exe	mssecsvr.exe
PID 1252 wrote to memory of 1096	1252	rundll32.exe	mssecsvr.exe
PID 1252 wrote to memory of 1096	1252	rundll32.exe	mssecsvr.exe
PID 1812 wrote to memory of 1080	1812	mssecsvr.exe	WerFault.exe
PID 1812 wrote to memory of 1080	1812	mssecsvr.exe	WerFault.exe
PID 1812 wrote to memory of 1080	1812	mssecsvr.exe	WerFault.exe
PID 1812 wrote to memory of 1080	1812	mssecsvr.exe	WerFault.exe
PID 1280 wrote to memory of 876	1280	mssecsvr.exe	WerFault.exe
PID 1280 wrote to memory of 876	1280	mssecsvr.exe	WerFault.exe
PID 1280 wrote to memory of 876	1280	mssecsvr.exe	WerFault.exe
PID 1280 wrote to memory of 876	1280	mssecsvr.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3efcdb3cd177306f741832cfe8c0d2190d7182b566322c4a5fae83e71fbb3666.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1080

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3efcdb3cd177306f741832cfe8c0d2190d7182b566322c4a5fae83e71fbb3666.dll,#1
2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1252

C:\WINDOWS\mssecsvr.exe
C:\WINDOWS\mssecsvr.exe
3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1096

C:\WINDOWS\mssecsvr.exe
C:\WINDOWS\mssecsvr.exe -m security
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 1096
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1080

C:\WINDOWS\mssecsvr.exe
C:\WINDOWS\mssecsvr.exe -m security
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1280 -s 1268
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\mssecsvr.exe
MD5
ad94a65306935ebc8bbde28d485a75fc

SHA1
7c814f1ce21de080411de2af4c2869c3d11cdc70

SHA256
d12e5d757f82a003f60103efd543d3f04c08674ce15697fe40d939a4c3224a2f

SHA512
d2b50482a92d81f37ecb2628c4450c43246cb3d1513dfdaeadc461ff3a94442a3ca5b4ffdc0a73fbee477c59e5c88305b8360420579745d7273ac68cd8ec215c

Download Submit
C:\Windows\mssecsvr.exe
MD5
ad94a65306935ebc8bbde28d485a75fc

SHA1
7c814f1ce21de080411de2af4c2869c3d11cdc70

SHA256
d12e5d757f82a003f60103efd543d3f04c08674ce15697fe40d939a4c3224a2f

SHA512
d2b50482a92d81f37ecb2628c4450c43246cb3d1513dfdaeadc461ff3a94442a3ca5b4ffdc0a73fbee477c59e5c88305b8360420579745d7273ac68cd8ec215c

Download Submit
C:\Windows\mssecsvr.exe
MD5
ad94a65306935ebc8bbde28d485a75fc

SHA1
7c814f1ce21de080411de2af4c2869c3d11cdc70

SHA256
d12e5d757f82a003f60103efd543d3f04c08674ce15697fe40d939a4c3224a2f

SHA512
d2b50482a92d81f37ecb2628c4450c43246cb3d1513dfdaeadc461ff3a94442a3ca5b4ffdc0a73fbee477c59e5c88305b8360420579745d7273ac68cd8ec215c

Download Submit
C:\Windows\mssecsvr.exe
MD5
ad94a65306935ebc8bbde28d485a75fc

SHA1
7c814f1ce21de080411de2af4c2869c3d11cdc70

SHA256
d12e5d757f82a003f60103efd543d3f04c08674ce15697fe40d939a4c3224a2f

SHA512
d2b50482a92d81f37ecb2628c4450c43246cb3d1513dfdaeadc461ff3a94442a3ca5b4ffdc0a73fbee477c59e5c88305b8360420579745d7273ac68cd8ec215c

Download Submit
memory/876-71-0x0000000000000000-mapping.dmp

Download
memory/1080-68-0x0000000000000000-mapping.dmp

Download
memory/1096-62-0x0000000000000000-mapping.dmp

Download
memory/1252-60-0x0000000000000000-mapping.dmp

Download
memory/1252-61-0x00000000757D1000-0x00000000757D3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads