wannacry | 8c1ef884611f42e99c832194d6d1d446c0a99cf8070e556e6b15204327cf3d84

General

Target

ccd380345bade422de99c1adbdc7e8e3.dll
Size

5.0MB
MD5

ccd380345bade422de99c1adbdc7e8e3
SHA1

2a97a2fd1aadfca754fa7d020446545f40e2badb
SHA256

8c1ef884611f42e99c832194d6d1d446c0a99cf8070e556e6b15204327cf3d84
SHA512

cafd828eff12804eb009b56235ad6b9831e251f6560a21a4ca78cafb61333a1be4967bba8daa40b467d1176cc39ec6198a0ff8c18e7e70e36723e76a885ddeea

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (1194) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Executes dropped EXE 3 IoCs

Processes:

mssecsvc.exemssecsvc.exetasksche.exe

pid process

1080 mssecsvc.exe
1956 mssecsvc.exe
788 tasksche.exe

pid	process
1080	mssecsvc.exe
1956	mssecsvc.exe
788	tasksche.exe

Drops file in System32 directory 1 IoCs

Processes:

mssecsvc.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	mssecsvc.exe

Drops file in Windows directory 2 IoCs

Processes:

mssecsvc.exerundll32.exe

description ioc process

File created C:\WINDOWS\tasksche.exe mssecsvc.exe
File created C:\WINDOWS\mssecsvc.exe rundll32.exe

description	ioc	process
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe

Modifies data under HKEY_USERS 24 IoCs

Processes:

mssecsvc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0EEF80D3-138B-418F-AD92-0CB3E092E7FE}\WpadDecisionReason = "1"	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1a-87-9c-f9-89-17\WpadDecisionTime = a014618adf9bd801	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0EEF80D3-138B-418F-AD92-0CB3E092E7FE}	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0EEF80D3-138B-418F-AD92-0CB3E092E7FE}\WpadNetworkName = "Network 3"	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0EEF80D3-138B-418F-AD92-0CB3E092E7FE}\WpadDecisionTime = a014618adf9bd801	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0EEF80D3-138B-418F-AD92-0CB3E092E7FE}\WpadDecision = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1a-87-9c-f9-89-17	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00c6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0EEF80D3-138B-418F-AD92-0CB3E092E7FE}\1a-87-9c-f9-89-17	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1a-87-9c-f9-89-17\WpadDecisionReason = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1a-87-9c-f9-89-17\WpadDecision = "0"	mssecsvc.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 616 wrote to memory of 1144	616	rundll32.exe	rundll32.exe
PID 616 wrote to memory of 1144	616	rundll32.exe	rundll32.exe
PID 616 wrote to memory of 1144	616	rundll32.exe	rundll32.exe
PID 616 wrote to memory of 1144	616	rundll32.exe	rundll32.exe
PID 616 wrote to memory of 1144	616	rundll32.exe	rundll32.exe
PID 616 wrote to memory of 1144	616	rundll32.exe	rundll32.exe
PID 616 wrote to memory of 1144	616	rundll32.exe	rundll32.exe
PID 1144 wrote to memory of 1080	1144	rundll32.exe	mssecsvc.exe
PID 1144 wrote to memory of 1080	1144	rundll32.exe	mssecsvc.exe
PID 1144 wrote to memory of 1080	1144	rundll32.exe	mssecsvc.exe
PID 1144 wrote to memory of 1080	1144	rundll32.exe	mssecsvc.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ccd380345bade422de99c1adbdc7e8e3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:616

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ccd380345bade422de99c1adbdc7e8e3.dll,#1
2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1144

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe
3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1080

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
4⤵
- Executes dropped EXE
PID:788

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1956

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

1

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\mssecsvc.exe
Filesize
3.6MB

MD5
a7907fb78b57067e2fa968adb6ce398b

SHA1
5d2d4a0ba8b560c738792b5f83a15e44135c89d8

SHA256
c1e6c5b5428ac1ca5fce455cf500175b10197ba9847ceb75801f18b9c8b85d9a

SHA512
76f048c1ed3f6d28d3bb664797eb26697cc4b48de0206e628dc260eb7f943082b96845c56078c8bbd4f0e12e7cc87461f2062f1689aa9044c94105f1fba681f8

Download Submit
C:\Windows\mssecsvc.exe
Filesize
3.6MB

MD5
a7907fb78b57067e2fa968adb6ce398b

SHA1
5d2d4a0ba8b560c738792b5f83a15e44135c89d8

SHA256
c1e6c5b5428ac1ca5fce455cf500175b10197ba9847ceb75801f18b9c8b85d9a

SHA512
76f048c1ed3f6d28d3bb664797eb26697cc4b48de0206e628dc260eb7f943082b96845c56078c8bbd4f0e12e7cc87461f2062f1689aa9044c94105f1fba681f8

Download Submit
C:\Windows\mssecsvc.exe
Filesize
3.6MB

MD5
a7907fb78b57067e2fa968adb6ce398b

SHA1
5d2d4a0ba8b560c738792b5f83a15e44135c89d8

SHA256
c1e6c5b5428ac1ca5fce455cf500175b10197ba9847ceb75801f18b9c8b85d9a

SHA512
76f048c1ed3f6d28d3bb664797eb26697cc4b48de0206e628dc260eb7f943082b96845c56078c8bbd4f0e12e7cc87461f2062f1689aa9044c94105f1fba681f8

Download Submit
C:\Windows\tasksche.exe
Filesize
3.4MB

MD5
ebdcc5c657343f17afc85c7265a6a4b1

SHA1
d3765b19562232788ba9af0d61f966a8c86f907d

SHA256
5d8ca63aa31550c3b1d45db0e6743d466ff16e378801677d9b1d31e6c2da5ab8

SHA512
43e7cd793d1b362fdab7107446fc5cd80370e195451aabce6fb442bc981cac5566e4dbc4d4140e97d6f5d148255fafc3c48cf605bd2c3fe829ab369b49b53c7c

Download Submit
memory/1080-56-0x0000000000000000-mapping.dmp

Download
memory/1144-54-0x0000000000000000-mapping.dmp

Download
memory/1144-55-0x0000000076AE1000-0x0000000076AE3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads