wannacry | 36dde0acce43dac1e5baa8e4b121a96f9aa0315c4386a203f6ea4e56534c7859

General

Target

36dde0acce43dac1e5baa8e4b121a96f9aa0315c4386a203f6ea4e56534c7859.dll
Size

5.0MB
MD5

59e0d7e76406e4c90cba5d6be0fc6902
SHA1

f564280d12b7da6b0063243fc649ce95d3e89705
SHA256

36dde0acce43dac1e5baa8e4b121a96f9aa0315c4386a203f6ea4e56534c7859
SHA512

b66eaf5ce643d90f8b2266d0cc26508b55d98458e140b13db24d1ca82a54d67f0c009ac8173753fca30f873e07cfd1e08d7100ed1a2e99d59374271834149413

Score

10^/10

wannacry discovery ransomware suricata worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
suricata: ET MALWARE Known Sinkhole Response Kryptos Logic
suricata: ET MALWARE Known Sinkhole Response Kryptos Logic
suricata
suricata: ET MALWARE W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1
suricata: ET MALWARE W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1
suricata
Contacts a large (3159) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Executes dropped EXE 3 IoCs

Processes:

mssecsvc.exemssecsvc.exetasksche.exe

pid process

904 mssecsvc.exe
4980 mssecsvc.exe
4204 tasksche.exe
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Drops file in Windows directory 2 IoCs

Processes:

rundll32.exemssecsvc.exe

description ioc process

File created C:\WINDOWS\mssecsvc.exe rundll32.exe
File created C:\WINDOWS\tasksche.exe mssecsvc.exe

pid	process
904	mssecsvc.exe
4980	mssecsvc.exe
4204	tasksche.exe

description	ioc	process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

mssecsvc.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2668 wrote to memory of 1488	2668	rundll32.exe	rundll32.exe
PID 2668 wrote to memory of 1488	2668	rundll32.exe	rundll32.exe
PID 2668 wrote to memory of 1488	2668	rundll32.exe	rundll32.exe
PID 1488 wrote to memory of 904	1488	rundll32.exe	mssecsvc.exe
PID 1488 wrote to memory of 904	1488	rundll32.exe	mssecsvc.exe
PID 1488 wrote to memory of 904	1488	rundll32.exe	mssecsvc.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\36dde0acce43dac1e5baa8e4b121a96f9aa0315c4386a203f6ea4e56534c7859.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\36dde0acce43dac1e5baa8e4b121a96f9aa0315c4386a203f6ea4e56534c7859.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1488
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:904
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:4204

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4980

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

2

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\mssecsvc.exe

Filesize
3.6MB

MD5
7a4c08417e33187bd51b354c687f51ae

SHA1
726ee8ffa094281bacd63e71f302173814626214

SHA256
fd03e6334108f9b589f222e98becfb6a4fc6fa178240c3c1efaa15454047c0b3

SHA512
f1db9c8d502ffe8804003cb9d5d02ede30d7e5c49dc1457c28abed3ea9735df29ac62a0a3a5cdec4e705a4bd6ad84c540c24ffc528dbfaca1f5ebb802c144bb7

Download Submit
C:\Windows\mssecsvc.exe

Filesize
3.6MB

MD5
7a4c08417e33187bd51b354c687f51ae

SHA1
726ee8ffa094281bacd63e71f302173814626214

SHA256
fd03e6334108f9b589f222e98becfb6a4fc6fa178240c3c1efaa15454047c0b3

SHA512
f1db9c8d502ffe8804003cb9d5d02ede30d7e5c49dc1457c28abed3ea9735df29ac62a0a3a5cdec4e705a4bd6ad84c540c24ffc528dbfaca1f5ebb802c144bb7

Download Submit
C:\Windows\mssecsvc.exe

Filesize
3.6MB

MD5
7a4c08417e33187bd51b354c687f51ae

SHA1
726ee8ffa094281bacd63e71f302173814626214

SHA256
fd03e6334108f9b589f222e98becfb6a4fc6fa178240c3c1efaa15454047c0b3

SHA512
f1db9c8d502ffe8804003cb9d5d02ede30d7e5c49dc1457c28abed3ea9735df29ac62a0a3a5cdec4e705a4bd6ad84c540c24ffc528dbfaca1f5ebb802c144bb7

Download Submit
C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
bf8c32afc2a6180aec24492449147b68

SHA1
6cddc47e29ee84f68bf35801af8d7f8a30e6d8c4

SHA256
24aa72f614fcf3ad78e108cde2e43f1486168f1c2fdd9d7584443573521644fe

SHA512
bd300d7e0a5071c1acbf30aafe68f1aef3969c0eae5d4eed4c118bec1f301f4304d60dc129e15a8caaf16822140464790958e12a7115f52b332481fe5d16b0ac

Download Submit
memory/904-131-0x0000000000000000-mapping.dmp

Download
memory/1488-130-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing