wannacry | 3a6a46d70b600988f8f809db8b6a8e812416ab138d58381a79363882df3999f0

Analysis

Target

Windows/MSSECSVC.exe
Size

3.6MB
MD5

03baffc5d9239b588a88d52978448db6
SHA1

c9b9062f1fa1681481f0a787fbe1fe8b6b6d6486
SHA256

09d086a2f16d620a4c4fd823651fa652f22eb27bb563b682d9372afa69f7662c
SHA512

ae8eabb41df5a4d2cdf04929269e822e8d8911c5e891244d257e85b6013b6a8028938e3287132b2e1ec2edc8e2113f51f52ff2d4d77e54b83f9a730582abccf3

Score

10^/10

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (1265) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Executes dropped EXE 1 IoCs

Processes:

tasksche.exe

pid process

1976 tasksche.exe

pid	process
1976	tasksche.exe

Drops file in System32 directory 1 IoCs

Processes:

MSSECSVC.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	MSSECSVC.exe

Drops file in Windows directory 1 IoCs

Processes:

MSSECSVC.exe

description ioc process

File created C:\WINDOWS\tasksche.exe MSSECSVC.exe
Modifies data under HKEY_USERS 1 IoCs

Processes:

MSSECSVC.exe

description ioc process

Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings MSSECSVC.exe

description	ioc	process
File created	C:\WINDOWS\tasksche.exe	MSSECSVC.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	MSSECSVC.exe

C:\Users\Admin\AppData\Local\Temp\Windows\MSSECSVC.exe
"C:\Users\Admin\AppData\Local\Temp\Windows\MSSECSVC.exe"
1⤵
- Drops file in Windows directory
PID:1836

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
2⤵
- Executes dropped EXE
PID:1976

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Windows\tasksche.exe
Filesize
3.4MB

MD5
bc098c445c7a7bafbebb45d800754fba

SHA1
1d43eb2eda999ce9171b222b9a4934d660eb97c8

SHA256
7cb8c18228d47d6765dda8cf34b3b6acbdb91808fdf714b49d2eed8148354594

SHA512
7309b5d2daea8671a8670a73350bc4e35e6cf4cc1364210082428676615f509c4abb904baa60b4e2fdaf97998a14979232f6b439f2373505bc2f43d91f29c101

Download Submit
memory/1836-54-0x0000000076421000-0x0000000076423000-memory.dmp

Filesize
8KB

Download