wannacry | 44e7f44b6edf55d6a96cf66d9d75f65acc9cd2db54760e20729d5d9d09877537

General

Target

44e7f44b6edf55d6a96cf66d9d75f65acc9cd2db54760e20729d5d9d09877537.dll
Size

5.0MB
MD5

4af86c6c774337fab08e425232aa046d
SHA1

3d496391ade070cc84b0db60c96bbacef6489934
SHA256

44e7f44b6edf55d6a96cf66d9d75f65acc9cd2db54760e20729d5d9d09877537
SHA512

5fcf35d5f052f00773e19a152cef794f84a5a8671b3fc7770a2a435775144ea11720bd2ebfc3f142cafd9bf8251d153155e3be2a44615d5de62ee3824286d1d6

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (2724) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Executes dropped EXE 3 IoCs

Processes:

mssecsvc.exemssecsvc.exetasksche.exe

pid process

3684 mssecsvc.exe
1596 mssecsvc.exe
1784 tasksche.exe
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Drops file in Windows directory 2 IoCs

Processes:

mssecsvc.exerundll32.exe

description ioc process

File created C:\WINDOWS\tasksche.exe mssecsvc.exe
File created C:\WINDOWS\mssecsvc.exe rundll32.exe

pid	process
3684	mssecsvc.exe
1596	mssecsvc.exe
1784	tasksche.exe

description	ioc	process
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1724 wrote to memory of 1424	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 1424	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 1424	1724	rundll32.exe	rundll32.exe
PID 1424 wrote to memory of 3684	1424	rundll32.exe	mssecsvc.exe
PID 1424 wrote to memory of 3684	1424	rundll32.exe	mssecsvc.exe
PID 1424 wrote to memory of 3684	1424	rundll32.exe	mssecsvc.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\44e7f44b6edf55d6a96cf66d9d75f65acc9cd2db54760e20729d5d9d09877537.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1724

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\44e7f44b6edf55d6a96cf66d9d75f65acc9cd2db54760e20729d5d9d09877537.dll,#1
2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1424

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe
3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3684

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
4⤵
- Executes dropped EXE
PID:1784

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
PID:1596

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

2

T1046

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\mssecsvc.exe
Filesize
3.6MB

MD5
cb7a9129ae6518f3f378d672229052f0

SHA1
26e4d0fba843167a28b1e8db9046ef6b4c553659

SHA256
14460c2734302669df5ac4fdf91560b4bf093c842d186091d02a29fa5ffa2d4b

SHA512
dc3d5489a6d290c516d5cc93c07e70be2a3d0f47f34e3b0515e11a502951c3e3995cdd533d0397f30128a0f2032247c17a87e3cfd630f37e428d60258c557fd4

Download Submit
C:\Windows\mssecsvc.exe
Filesize
3.6MB

MD5
cb7a9129ae6518f3f378d672229052f0

SHA1
26e4d0fba843167a28b1e8db9046ef6b4c553659

SHA256
14460c2734302669df5ac4fdf91560b4bf093c842d186091d02a29fa5ffa2d4b

SHA512
dc3d5489a6d290c516d5cc93c07e70be2a3d0f47f34e3b0515e11a502951c3e3995cdd533d0397f30128a0f2032247c17a87e3cfd630f37e428d60258c557fd4

Download Submit
C:\Windows\mssecsvc.exe
Filesize
3.6MB

MD5
cb7a9129ae6518f3f378d672229052f0

SHA1
26e4d0fba843167a28b1e8db9046ef6b4c553659

SHA256
14460c2734302669df5ac4fdf91560b4bf093c842d186091d02a29fa5ffa2d4b

SHA512
dc3d5489a6d290c516d5cc93c07e70be2a3d0f47f34e3b0515e11a502951c3e3995cdd533d0397f30128a0f2032247c17a87e3cfd630f37e428d60258c557fd4

Download Submit
C:\Windows\tasksche.exe
Filesize
3.4MB

MD5
406f9ceecb41efc50fdf702de6814eb1

SHA1
0dd973d6250f0365446f5daeefd3147eb1b7b1c0

SHA256
81f39955fec2ad2ca51c12acfe24222a86c46ddcc85ed73d99081891130c244f

SHA512
f37b16cbf6888f6b58aa6577d9b578d7ac125c1d4221e82bdf8aea3347469c8cf13fcefb41fa5db25629312be31c1ea39302a8ef2cbb99edb5734163c2bf1820

Download Submit
memory/1424-130-0x0000000000000000-mapping.dmp

Download
memory/3684-131-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing