wannacry | 296fccacfe9dc19812f6f2ff01587c6bab1305f8317ee4eb0e0384ef314c8bfc

General

Target

296fccacfe9dc19812f6f2ff01587c6bab1305f8317ee4eb0e0384ef314c8bfc.dll
Size

5.0MB
MD5

66094df09dd3e3ec8ff1c5fc6ff8d4f5
SHA1

84c6d3bfbe28ce3baebe7c1880db1dd798b8e522
SHA256

296fccacfe9dc19812f6f2ff01587c6bab1305f8317ee4eb0e0384ef314c8bfc
SHA512

476a35314e1695bd4e3163d2a1e0c21304623e46afdd03b3ff2dad05027c16a5121c7ebe7efc67035717bb35a594caf1dfa4108f0cb03d8de7b8ed1709c59d69

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (765) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Executes dropped EXE 2 IoCs

Processes:

mssecsvr.exemssecsvr.exe

pid process

1652 mssecsvr.exe
1172 mssecsvr.exe

pid	process
1652	mssecsvr.exe
1172	mssecsvr.exe

Drops file in System32 directory 1 IoCs

Processes:

mssecsvr.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	mssecsvr.exe

Drops file in Windows directory 2 IoCs

Processes:

rundll32.exemssecsvr.exe

description ioc process

File created C:\WINDOWS\mssecsvr.exe rundll32.exe
File created C:\WINDOWS\tasksche.exe mssecsvr.exe

description	ioc	process
File created	C:\WINDOWS\mssecsvr.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvr.exe

Modifies data under HKEY_USERS 24 IoCs

Processes:

mssecsvr.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3a-63-1f-98-77-74\WpadDecisionReason = "1"	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	mssecsvr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D9F8B1FA-94B9-4643-AE29-BDEA5AEDC3C0}\WpadDecisionReason = "1"	mssecsvr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D9F8B1FA-94B9-4643-AE29-BDEA5AEDC3C0}\WpadDecisionTime = 0048234efa80d801	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D9F8B1FA-94B9-4643-AE29-BDEA5AEDC3C0}\WpadDecision = "0"	mssecsvr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D9F8B1FA-94B9-4643-AE29-BDEA5AEDC3C0}\WpadNetworkName = "Network 3"	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3a-63-1f-98-77-74	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3a-63-1f-98-77-74\WpadDecision = "0"	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	mssecsvr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f009f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D9F8B1FA-94B9-4643-AE29-BDEA5AEDC3C0}	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D9F8B1FA-94B9-4643-AE29-BDEA5AEDC3C0}\3a-63-1f-98-77-74	mssecsvr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3a-63-1f-98-77-74\WpadDecisionTime = 0048234efa80d801	mssecsvr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvr.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1944 wrote to memory of 1968	1944	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 1968	1944	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 1968	1944	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 1968	1944	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 1968	1944	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 1968	1944	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 1968	1944	rundll32.exe	rundll32.exe
PID 1968 wrote to memory of 1652	1968	rundll32.exe	mssecsvr.exe
PID 1968 wrote to memory of 1652	1968	rundll32.exe	mssecsvr.exe
PID 1968 wrote to memory of 1652	1968	rundll32.exe	mssecsvr.exe
PID 1968 wrote to memory of 1652	1968	rundll32.exe	mssecsvr.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\296fccacfe9dc19812f6f2ff01587c6bab1305f8317ee4eb0e0384ef314c8bfc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1944

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\296fccacfe9dc19812f6f2ff01587c6bab1305f8317ee4eb0e0384ef314c8bfc.dll,#1
2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1968

C:\WINDOWS\mssecsvr.exe
C:\WINDOWS\mssecsvr.exe
3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1652

C:\WINDOWS\mssecsvr.exe
C:\WINDOWS\mssecsvr.exe -m security
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1172

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

1

T1046

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\mssecsvr.exe
Filesize
2.2MB

MD5
8568b85f3076d91bb778396580f23d83

SHA1
a8e07cd5c89b6e79576c7d6414ccac5dd297dca6

SHA256
7df2767923b8accfa055d45206fe2a2d46d10bd4c8e56a245fda879181ff5482

SHA512
9afef8e1b2cfee9575e58e67817eb1a9cb0ec54309919bca6df253d68d2ab5e5cb8fbe0da0171128f994f96f345d92219af4a715a8e818e3e036cb97cbea4625

Download Submit
C:\Windows\mssecsvr.exe
Filesize
2.2MB

MD5
8568b85f3076d91bb778396580f23d83

SHA1
a8e07cd5c89b6e79576c7d6414ccac5dd297dca6

SHA256
7df2767923b8accfa055d45206fe2a2d46d10bd4c8e56a245fda879181ff5482

SHA512
9afef8e1b2cfee9575e58e67817eb1a9cb0ec54309919bca6df253d68d2ab5e5cb8fbe0da0171128f994f96f345d92219af4a715a8e818e3e036cb97cbea4625

Download Submit
C:\Windows\mssecsvr.exe
Filesize
2.2MB

MD5
8568b85f3076d91bb778396580f23d83

SHA1
a8e07cd5c89b6e79576c7d6414ccac5dd297dca6

SHA256
7df2767923b8accfa055d45206fe2a2d46d10bd4c8e56a245fda879181ff5482

SHA512
9afef8e1b2cfee9575e58e67817eb1a9cb0ec54309919bca6df253d68d2ab5e5cb8fbe0da0171128f994f96f345d92219af4a715a8e818e3e036cb97cbea4625

Download Submit
memory/1652-56-0x0000000000000000-mapping.dmp

Download
memory/1968-54-0x0000000000000000-mapping.dmp

Download
memory/1968-55-0x00000000765C1000-0x00000000765C3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads