wannacry | 35c50669ff577d92f0ffe5f21a394aa1da8e929f12b92594f1f503f9ea263e3e

General

Target

35c50669ff577d92f0ffe5f21a394aa1da8e929f12b92594f1f503f9ea263e3e.dll
Size

5.0MB
MD5

856e92809fcf1535c03dac80c00a0122
SHA1

a27d855df5fb05888023ad4dc23212878b4bfdf6
SHA256

35c50669ff577d92f0ffe5f21a394aa1da8e929f12b92594f1f503f9ea263e3e
SHA512

88b17f5c28ba5a1784cb609f002fba8f94932c47d4957917db225afef59db1313f14d63e5e16c5e0b807786d89af7f17be00d1dd94f2dea48e5585b663e4ce5f

Score

10^/10

wannacry discovery ransomware suricata worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
suricata: ET MALWARE Known Sinkhole Response Kryptos Logic
suricata: ET MALWARE Known Sinkhole Response Kryptos Logic
suricata
suricata: ET MALWARE W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1
suricata: ET MALWARE W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1
suricata
Contacts a large (3211) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Executes dropped EXE 3 IoCs

Processes:

mssecsvc.exemssecsvc.exetasksche.exe

pid process

1072 mssecsvc.exe
4412 mssecsvc.exe
4924 tasksche.exe
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Drops file in Windows directory 2 IoCs

Processes:

rundll32.exemssecsvc.exe

description ioc process

File created C:\WINDOWS\mssecsvc.exe rundll32.exe
File created C:\WINDOWS\tasksche.exe mssecsvc.exe

pid	process
1072	mssecsvc.exe
4412	mssecsvc.exe
4924	tasksche.exe

description	ioc	process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

mssecsvc.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2272 wrote to memory of 2980	2272	rundll32.exe	rundll32.exe
PID 2272 wrote to memory of 2980	2272	rundll32.exe	rundll32.exe
PID 2272 wrote to memory of 2980	2272	rundll32.exe	rundll32.exe
PID 2980 wrote to memory of 1072	2980	rundll32.exe	mssecsvc.exe
PID 2980 wrote to memory of 1072	2980	rundll32.exe	mssecsvc.exe
PID 2980 wrote to memory of 1072	2980	rundll32.exe	mssecsvc.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\35c50669ff577d92f0ffe5f21a394aa1da8e929f12b92594f1f503f9ea263e3e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2272

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\35c50669ff577d92f0ffe5f21a394aa1da8e929f12b92594f1f503f9ea263e3e.dll,#1
2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2980

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe
3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1072

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
4⤵
- Executes dropped EXE
PID:4924

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4412

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

2

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\mssecsvc.exe
Filesize
3.6MB

MD5
672fc3725d55f9d191584b98027dee35

SHA1
9b57fd801557f95c332984d38bdaa2bbde6992ac

SHA256
c4a38919712d2e69f041521eb5c486b05477aa9968abbe85e4dac47312ccf62a

SHA512
764ceccd4d235990582b7ba458f0deef8c92d62eb41c3c37dc8dd4f881fbaef1dd2336dfab71aeca37022329167f9b85f264e008e4a453092e2326d47ea0bb81

Download Submit
C:\Windows\mssecsvc.exe
Filesize
3.6MB

MD5
672fc3725d55f9d191584b98027dee35

SHA1
9b57fd801557f95c332984d38bdaa2bbde6992ac

SHA256
c4a38919712d2e69f041521eb5c486b05477aa9968abbe85e4dac47312ccf62a

SHA512
764ceccd4d235990582b7ba458f0deef8c92d62eb41c3c37dc8dd4f881fbaef1dd2336dfab71aeca37022329167f9b85f264e008e4a453092e2326d47ea0bb81

Download Submit
C:\Windows\mssecsvc.exe
Filesize
3.6MB

MD5
672fc3725d55f9d191584b98027dee35

SHA1
9b57fd801557f95c332984d38bdaa2bbde6992ac

SHA256
c4a38919712d2e69f041521eb5c486b05477aa9968abbe85e4dac47312ccf62a

SHA512
764ceccd4d235990582b7ba458f0deef8c92d62eb41c3c37dc8dd4f881fbaef1dd2336dfab71aeca37022329167f9b85f264e008e4a453092e2326d47ea0bb81

Download Submit
C:\Windows\tasksche.exe
Filesize
3.4MB

MD5
3045fdbfd3f2cbaf2def7fe118b01a95

SHA1
85e3542812ad1b40845b941e00b4b77f2434153c

SHA256
3e8e919f78df0489f288f7e15b077e008e0cc6f808619611b90b7d6e1788e1d9

SHA512
dba0203e4f9e8e9d4f1bf154aa8a891f503292a39b193d497759d94de0ad3a2166b850b65c76eaf0d3bc4342a57e691678cce60b42d3353f951449c4ff5cc58d

Download Submit
memory/1072-131-0x0000000000000000-mapping.dmp

Download
memory/2980-130-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing