wannacry | 97bf7d0702003951c415111c4da37f6aa191036bb655d10b42b57af68091dc72

General

Target

97bf7d0702003951c415111c4da37f6aa191036bb655d10b42b57af68091dc72.dll
Size

5.0MB
MD5

1268458a18c26e706de45533e36221a4
SHA1

dcb8138eb87be9fd2bf7b5e6cf90d084408c49c2
SHA256

97bf7d0702003951c415111c4da37f6aa191036bb655d10b42b57af68091dc72
SHA512

6ededc34a7b3c16c6ab116456de97adc88052f608fd9927019db47467a0935c0032935a1659ec754d7f0a4abdaae0b4d013cc12e8f99515365bfefc7e5305275

Score

10^/10

wannacry discovery ransomware suricata worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
suricata: ET MALWARE Known Sinkhole Response Kryptos Logic
suricata: ET MALWARE Known Sinkhole Response Kryptos Logic
suricata
suricata: ET MALWARE W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1
suricata: ET MALWARE W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1
suricata
Contacts a large (1017) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Executes dropped EXE 3 IoCs

Processes:

mssecsvc.exemssecsvc.exetasksche.exe

pid process

108 mssecsvc.exe
1660 mssecsvc.exe
340 tasksche.exe

pid	process
108	mssecsvc.exe
1660	mssecsvc.exe
340	tasksche.exe

Drops file in System32 directory 1 IoCs

Processes:

mssecsvc.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	mssecsvc.exe

Drops file in Windows directory 2 IoCs

Processes:

rundll32.exemssecsvc.exe

description ioc process

File created C:\WINDOWS\mssecsvc.exe rundll32.exe
File created C:\WINDOWS\tasksche.exe mssecsvc.exe

description	ioc	process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 24 IoCs

Processes:

mssecsvc.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{8CCF2B33-683E-4220-94AC-20FAC7255C74}	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{8CCF2B33-683E-4220-94AC-20FAC7255C74}\WpadDecisionTime = e0e394636888d801	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{8CCF2B33-683E-4220-94AC-20FAC7255C74}\WpadNetworkName = "Network 2"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{8CCF2B33-683E-4220-94AC-20FAC7255C74}\fe-e1-a2-8e-f2-24	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-e1-a2-8e-f2-24\WpadDecision = "0"	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f009a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-e1-a2-8e-f2-24	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{8CCF2B33-683E-4220-94AC-20FAC7255C74}\WpadDecisionReason = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-e1-a2-8e-f2-24\WpadDecisionReason = "1"	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-e1-a2-8e-f2-24\WpadDecisionTime = e0e394636888d801	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{8CCF2B33-683E-4220-94AC-20FAC7255C74}\WpadDecision = "0"	mssecsvc.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1380 wrote to memory of 580	1380	rundll32.exe	rundll32.exe
PID 1380 wrote to memory of 580	1380	rundll32.exe	rundll32.exe
PID 1380 wrote to memory of 580	1380	rundll32.exe	rundll32.exe
PID 1380 wrote to memory of 580	1380	rundll32.exe	rundll32.exe
PID 1380 wrote to memory of 580	1380	rundll32.exe	rundll32.exe
PID 1380 wrote to memory of 580	1380	rundll32.exe	rundll32.exe
PID 1380 wrote to memory of 580	1380	rundll32.exe	rundll32.exe
PID 580 wrote to memory of 108	580	rundll32.exe	mssecsvc.exe
PID 580 wrote to memory of 108	580	rundll32.exe	mssecsvc.exe
PID 580 wrote to memory of 108	580	rundll32.exe	mssecsvc.exe
PID 580 wrote to memory of 108	580	rundll32.exe	mssecsvc.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\97bf7d0702003951c415111c4da37f6aa191036bb655d10b42b57af68091dc72.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\97bf7d0702003951c415111c4da37f6aa191036bb655d10b42b57af68091dc72.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:580
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:108
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:340

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1660

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

1

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\mssecsvc.exe

Filesize
3.6MB

MD5
e9bf450d371870712d5618ac1a5e97a4

SHA1
e19f2346cdb0e8322b772bd9227f5a3d69770aa0

SHA256
060de46ae61af278d142cec447de35b5ba5038e9f4e49a971544573a027549a3

SHA512
e7c240d05faf2323ba78f1d285e8496bb9f74683a4626023de3ce9c42e36c10f3ebb949f1ae0dbf58694ef21d916c9ad80ee868573dd76f3dbe6f0ceaab4fac9

Download Submit
C:\Windows\mssecsvc.exe

Filesize
3.6MB

MD5
e9bf450d371870712d5618ac1a5e97a4

SHA1
e19f2346cdb0e8322b772bd9227f5a3d69770aa0

SHA256
060de46ae61af278d142cec447de35b5ba5038e9f4e49a971544573a027549a3

SHA512
e7c240d05faf2323ba78f1d285e8496bb9f74683a4626023de3ce9c42e36c10f3ebb949f1ae0dbf58694ef21d916c9ad80ee868573dd76f3dbe6f0ceaab4fac9

Download Submit
C:\Windows\mssecsvc.exe

Filesize
3.6MB

MD5
e9bf450d371870712d5618ac1a5e97a4

SHA1
e19f2346cdb0e8322b772bd9227f5a3d69770aa0

SHA256
060de46ae61af278d142cec447de35b5ba5038e9f4e49a971544573a027549a3

SHA512
e7c240d05faf2323ba78f1d285e8496bb9f74683a4626023de3ce9c42e36c10f3ebb949f1ae0dbf58694ef21d916c9ad80ee868573dd76f3dbe6f0ceaab4fac9

Download Submit
C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
00b4a7d116c478228ff07bd3994467e6

SHA1
87de035f85814f561bd58ed901a0b5894c48494c

SHA256
5490f926af93a862c26e042d350b73585e9da7f4390cc39679258082c7d55918

SHA512
49d97adde33345df2ab763d800adf3adf449c6a470808e5294e9938b441cd33b452d63437b93d34b7c70bd7bcf056e9cc4c3f1c4fd97498476fa867fbba80c16

Download Submit
memory/108-56-0x0000000000000000-mapping.dmp

Download
memory/580-54-0x0000000000000000-mapping.dmp

Download
memory/580-55-0x0000000075AE1000-0x0000000075AE3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads