wannacry | 2d0095f2fefbc0f89c491e1d78d3179d22c9b0b91fd93c1b1d91d12ed40b3515

General

Target

2d0095f2fefbc0f89c491e1d78d3179d22c9b0b91fd93c1b1d91d12ed40b3515.dll
Size

5.0MB
MD5

e2fec3f5f8b0a02c8be11d256129e58c
SHA1

b0425805b0fd4218606b981e3617cc9c8fdce127
SHA256

2d0095f2fefbc0f89c491e1d78d3179d22c9b0b91fd93c1b1d91d12ed40b3515
SHA512

9075a119e9ba4c3f70589250a9ab05980607274908dd9aedb1ef2a06aafe0150cf9bfbb4218299edd505579da7820c349b12f77f2d7bdc511f5a2fac733b2073

Score

10^/10

wannacry ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Executes dropped EXE 3 IoCs

Processes:

mssecsvc.exemssecsvc.exetasksche.exe

pid process

384 mssecsvc.exe
3768 mssecsvc.exe
1016 tasksche.exe
Drops file in Windows directory 2 IoCs

Processes:

rundll32.exemssecsvc.exe

description ioc process

File created C:\WINDOWS\mssecsvc.exe rundll32.exe
File created C:\WINDOWS\tasksche.exe mssecsvc.exe

pid	process
384	mssecsvc.exe
3768	mssecsvc.exe
1016	tasksche.exe

description	ioc	process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

mssecsvc.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1372 wrote to memory of 400	1372	rundll32.exe	rundll32.exe
PID 1372 wrote to memory of 400	1372	rundll32.exe	rundll32.exe
PID 1372 wrote to memory of 400	1372	rundll32.exe	rundll32.exe
PID 400 wrote to memory of 384	400	rundll32.exe	mssecsvc.exe
PID 400 wrote to memory of 384	400	rundll32.exe	mssecsvc.exe
PID 400 wrote to memory of 384	400	rundll32.exe	mssecsvc.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d0095f2fefbc0f89c491e1d78d3179d22c9b0b91fd93c1b1d91d12ed40b3515.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1372

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d0095f2fefbc0f89c491e1d78d3179d22c9b0b91fd93c1b1d91d12ed40b3515.dll,#1
2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:400

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe
3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:384

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
4⤵
- Executes dropped EXE
PID:1016

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:3768

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\mssecsvc.exe

Filesize
3.6MB

MD5
3dec15e4d3fdde40ecbf420c7371112e

SHA1
2d6bfb1c8df87802c020dea14085d057a85e2adb

SHA256
6cf08c6e607963144927a2961d1672444a923629ae0a7cfb11ac22c8b4078cd1

SHA512
5a10e566eca50dd140e0e0ebee32b0f649185ef666e1d437172397cdd122e9ad64f40d25b7ede2e03e7b09a4ddad8a6eaa48a48735e5de984d3bb6c67057a61d

Download Submit
C:\Windows\mssecsvc.exe

Filesize
3.6MB

MD5
3dec15e4d3fdde40ecbf420c7371112e

SHA1
2d6bfb1c8df87802c020dea14085d057a85e2adb

SHA256
6cf08c6e607963144927a2961d1672444a923629ae0a7cfb11ac22c8b4078cd1

SHA512
5a10e566eca50dd140e0e0ebee32b0f649185ef666e1d437172397cdd122e9ad64f40d25b7ede2e03e7b09a4ddad8a6eaa48a48735e5de984d3bb6c67057a61d

Download Submit
C:\Windows\mssecsvc.exe

Filesize
3.6MB

MD5
3dec15e4d3fdde40ecbf420c7371112e

SHA1
2d6bfb1c8df87802c020dea14085d057a85e2adb

SHA256
6cf08c6e607963144927a2961d1672444a923629ae0a7cfb11ac22c8b4078cd1

SHA512
5a10e566eca50dd140e0e0ebee32b0f649185ef666e1d437172397cdd122e9ad64f40d25b7ede2e03e7b09a4ddad8a6eaa48a48735e5de984d3bb6c67057a61d

Download Submit
C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
fb9bd631e9f198744983a0e08ac8e7d7

SHA1
eb41fe04c75db97c0a6439f75bcb870dffdacb3f

SHA256
43e12632a26b499a82aa82b8633f52ddb7b035b323c2df474061388b88b0471f

SHA512
c35612de85d7eeee0920e979e16d711c12c24acdcc9c56390baf33d6beec8a9de6125d21292c8b21f80e53686e2587c87757ff94c76ebeaa0a34f7e44da10d42

Download Submit
memory/384-131-0x0000000000000000-mapping.dmp

Download
memory/400-130-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads