wannacry | 33947a48eb1a1d6cda016fb2259046a88a422af43f66f8ec5fcb6b23244240b7

General

Target

b53c92219431e5c5e3e6874936b4aeff.dll
Size

5.0MB
MD5

b53c92219431e5c5e3e6874936b4aeff
SHA1

34a247ba360172b5ef0d0d5788f70dcd0bad179d
SHA256

33947a48eb1a1d6cda016fb2259046a88a422af43f66f8ec5fcb6b23244240b7
SHA512

91f87bd6971954747d8d1c57a693f165217e5de5de4b877f0cfe2a870fe1cbb203498b267771499f3139de4abc55953d7cd7eedc451d2a028bcc1c1ce81a449c

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (1345) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Executes dropped EXE 2 IoCs

Processes:

mssecsvr.exemssecsvr.exe

pid process

740 mssecsvr.exe
1740 mssecsvr.exe

pid	process
740	mssecsvr.exe
1740	mssecsvr.exe

Drops file in System32 directory 1 IoCs

Processes:

mssecsvr.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	mssecsvr.exe

Drops file in Windows directory 2 IoCs

Processes:

rundll32.exemssecsvr.exe

description ioc process

File created C:\WINDOWS\mssecsvr.exe rundll32.exe
File created C:\WINDOWS\tasksche.exe mssecsvr.exe

description	ioc	process
File created	C:\WINDOWS\mssecsvr.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvr.exe

Modifies data under HKEY_USERS 24 IoCs

Processes:

mssecsvr.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	mssecsvr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{42F4AA43-5DAA-4852-8984-E8353ECD8AE0}\WpadDecisionTime = 60761a3ed39bd801	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	mssecsvr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	mssecsvr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00f1000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{42F4AA43-5DAA-4852-8984-E8353ECD8AE0}	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{42F4AA43-5DAA-4852-8984-E8353ECD8AE0}\WpadDecision = "0"	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	mssecsvr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{42F4AA43-5DAA-4852-8984-E8353ECD8AE0}\WpadNetworkName = "Network 3"	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{42F4AA43-5DAA-4852-8984-E8353ECD8AE0}\2e-26-67-67-fb-e5	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\2e-26-67-67-fb-e5\WpadDecisionReason = "1"	mssecsvr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\2e-26-67-67-fb-e5\WpadDecisionTime = 60761a3ed39bd801	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\2e-26-67-67-fb-e5\WpadDecision = "0"	mssecsvr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	mssecsvr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{42F4AA43-5DAA-4852-8984-E8353ECD8AE0}\WpadDecisionReason = "1"	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\2e-26-67-67-fb-e5	mssecsvr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	mssecsvr.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 288 wrote to memory of 736	288	rundll32.exe	rundll32.exe
PID 288 wrote to memory of 736	288	rundll32.exe	rundll32.exe
PID 288 wrote to memory of 736	288	rundll32.exe	rundll32.exe
PID 288 wrote to memory of 736	288	rundll32.exe	rundll32.exe
PID 288 wrote to memory of 736	288	rundll32.exe	rundll32.exe
PID 288 wrote to memory of 736	288	rundll32.exe	rundll32.exe
PID 288 wrote to memory of 736	288	rundll32.exe	rundll32.exe
PID 736 wrote to memory of 740	736	rundll32.exe	mssecsvr.exe
PID 736 wrote to memory of 740	736	rundll32.exe	mssecsvr.exe
PID 736 wrote to memory of 740	736	rundll32.exe	mssecsvr.exe
PID 736 wrote to memory of 740	736	rundll32.exe	mssecsvr.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b53c92219431e5c5e3e6874936b4aeff.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:288

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b53c92219431e5c5e3e6874936b4aeff.dll,#1
2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:736

C:\WINDOWS\mssecsvr.exe
C:\WINDOWS\mssecsvr.exe
3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:740

C:\WINDOWS\mssecsvr.exe
C:\WINDOWS\mssecsvr.exe -m security
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1740

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

1

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\mssecsvr.exe
Filesize
2.2MB

MD5
9d9421955e54b5e9f60bf0880495487a

SHA1
c245b14b8e9ba2e9102ad0d92aa27bccb3b086b2

SHA256
1b1651c7d2c36a04094ecc704769834a803cd216aa59aa576d7f51dc20f44131

SHA512
b55462718fe98ee608c2505643cc5a92a0034702b64034f0385964d70669c08f838af5c3718e950c400065abd4df13653cb123117cf9858839213d2b0a414438

Download Submit
C:\Windows\mssecsvr.exe
Filesize
2.2MB

MD5
9d9421955e54b5e9f60bf0880495487a

SHA1
c245b14b8e9ba2e9102ad0d92aa27bccb3b086b2

SHA256
1b1651c7d2c36a04094ecc704769834a803cd216aa59aa576d7f51dc20f44131

SHA512
b55462718fe98ee608c2505643cc5a92a0034702b64034f0385964d70669c08f838af5c3718e950c400065abd4df13653cb123117cf9858839213d2b0a414438

Download Submit
C:\Windows\mssecsvr.exe
Filesize
2.2MB

MD5
9d9421955e54b5e9f60bf0880495487a

SHA1
c245b14b8e9ba2e9102ad0d92aa27bccb3b086b2

SHA256
1b1651c7d2c36a04094ecc704769834a803cd216aa59aa576d7f51dc20f44131

SHA512
b55462718fe98ee608c2505643cc5a92a0034702b64034f0385964d70669c08f838af5c3718e950c400065abd4df13653cb123117cf9858839213d2b0a414438

Download Submit
memory/736-54-0x0000000000000000-mapping.dmp

Download
memory/736-55-0x0000000076191000-0x0000000076193000-memory.dmp

Filesize
8KB

Download
memory/740-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads