wannacry | f15d3cab30a049cc6bd9e61d97931c0463167ec9daa2b870b87f0ef1bdb151ca

General

Target
ca1a49f52b29493450529af0b2a891c4.dll
Size 5.0MB
Sample220720-at3e6shgd3
SHA256 f15d3cab30a049cc6bd9e61d97931c0463167ec9daa2b870b87f0ef1bdb151ca
MD5 ca1a49f52b29493450529af0b2a891c4
SHA1 29e01611e9cc77062aa4ef61bd7e019e1e184559
SHA512 f93b769a772623f94e400c86298a4b7fd8fd1a126bebd8326a7fb929745ad48dbcb6c56372f8de3d94dad50d281d53812170af46d94a85ff41d9c9953d5f038f
MD5 SHA1 SHA512

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (2919) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Executes dropped EXE 3 IoCs

pid	Process
3756	mssecsvr.exe
5000	mssecsvr.exe
4268	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvr.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvr.exe
File created	C:\Windows\__tmp_rar_sfx_access_check_240547046	tasksche.exe
File created	C:\Windows\eee.exe	tasksche.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvr.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3236 wrote to memory of 3112	3236	rundll32.exe	78
PID 3236 wrote to memory of 3112	3236	rundll32.exe	78
PID 3236 wrote to memory of 3112	3236	rundll32.exe	78
PID 3112 wrote to memory of 3756	3112	rundll32.exe	79
PID 3112 wrote to memory of 3756	3112	rundll32.exe	79
PID 3112 wrote to memory of 3756	3112	rundll32.exe	79
PID 3756 wrote to memory of 4268	3756	mssecsvr.exe	81
PID 3756 wrote to memory of 4268	3756	mssecsvr.exe	81
PID 3756 wrote to memory of 4268	3756	mssecsvr.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ca1a49f52b29493450529af0b2a891c4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3236
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ca1a49f52b29493450529af0b2a891c4.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:3112
- - C:\WINDOWS\mssecsvr.exe
    C:\WINDOWS\mssecsvr.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:3756
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      PID:4268

C:\WINDOWS\mssecsvr.exe
C:\WINDOWS\mssecsvr.exe -m security
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:5000

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

2

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvr.exe

Path C:\WINDOWS\mssecsvr.exe
Size 2.2MB
SHA256 fc632abee505769bb5b98fde7a830932f2eabeab061e793e0e4c58b55ac40386
MD5 26c0ece5ae9ee659634f70a82f4df256
SHA1 93bd163f7d604d9962959b4313d1bce34dcd6f39
SHA512 76b096dcdfddff4fd40f7bc370af48cdd8ee74a599eb1bb326a7285d587e4dc2042a69213fc591fb1b7d1859e2aa9a2de99cf0697b7254ccb6b8ea1604cd6c91
SSDEEP 49152:QnpEKUacBVQej/1INRx+TSqTdX1HkQo6SAARdhnve:QpyfBhz1aRxcSUDk36SAEdhve
MD5 SHA1 SHA512 SSDEEP

Submit Download

tasksche.exe

Path C:\WINDOWS\tasksche.exe
Size 2.0MB
SHA256 faa71692e47f3855d4bb35e8a0310d9388fa15bd45fe4af988d469dce9d6da5f
MD5 fa4ae9331adf1b8d457a42f0abf8323e
SHA1 e4e9dc8c3005ea9eddc5aa9430b196b19aa3ba18
SHA512 838c09374d43572e8e055577b813ae59e5b3f6a3a6132db3afc93167ca016da61dcc02430e4e1b7f8637360e85b10e32898d527301970d1c4c6a42fc58620202
SSDEEP 49152:XEKUacBVQej/1INRx+TSqTdX1HkQo6SAARdhnvB:XyfBhz1aRxcSUDk36SAEdhvB
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvr.exe

Path C:\Windows\mssecsvr.exe
Size 2.2MB
SHA256 fc632abee505769bb5b98fde7a830932f2eabeab061e793e0e4c58b55ac40386
MD5 26c0ece5ae9ee659634f70a82f4df256
SHA1 93bd163f7d604d9962959b4313d1bce34dcd6f39
SHA512 76b096dcdfddff4fd40f7bc370af48cdd8ee74a599eb1bb326a7285d587e4dc2042a69213fc591fb1b7d1859e2aa9a2de99cf0697b7254ccb6b8ea1604cd6c91
SSDEEP 49152:QnpEKUacBVQej/1INRx+TSqTdX1HkQo6SAARdhnve:QpyfBhz1aRxcSUDk36SAEdhve
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvr.exe

Path C:\Windows\mssecsvr.exe
Size 2.2MB
SHA256 fc632abee505769bb5b98fde7a830932f2eabeab061e793e0e4c58b55ac40386
MD5 26c0ece5ae9ee659634f70a82f4df256
SHA1 93bd163f7d604d9962959b4313d1bce34dcd6f39
SHA512 76b096dcdfddff4fd40f7bc370af48cdd8ee74a599eb1bb326a7285d587e4dc2042a69213fc591fb1b7d1859e2aa9a2de99cf0697b7254ccb6b8ea1604cd6c91
SSDEEP 49152:QnpEKUacBVQej/1INRx+TSqTdX1HkQo6SAARdhnve:QpyfBhz1aRxcSUDk36SAEdhve
MD5 SHA1 SHA512 SSDEEP

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 2.0MB
SHA256 faa71692e47f3855d4bb35e8a0310d9388fa15bd45fe4af988d469dce9d6da5f
MD5 fa4ae9331adf1b8d457a42f0abf8323e
SHA1 e4e9dc8c3005ea9eddc5aa9430b196b19aa3ba18
SHA512 838c09374d43572e8e055577b813ae59e5b3f6a3a6132db3afc93167ca016da61dcc02430e4e1b7f8637360e85b10e32898d527301970d1c4c6a42fc58620202
SSDEEP 49152:XEKUacBVQej/1INRx+TSqTdX1HkQo6SAARdhnvB:XyfBhz1aRxcSUDk36SAEdhvB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads