wannacry | c9db9ce17eb23dd902c86fdf9190599718bb01572983cdb14e10f9c4d71a3977

General

Target

85d3a6eb4f1c04311c52891051503b3a.dll
Size

5.0MB
MD5

85d3a6eb4f1c04311c52891051503b3a
SHA1

b69a6112fe9e3f1903e57eda73e990c4ffadeb6d
SHA256

c9db9ce17eb23dd902c86fdf9190599718bb01572983cdb14e10f9c4d71a3977
SHA512

acdf2290b61bc08c6bb693598e5e081e8c2f1408fcd08818b2ecf32ec7c84a2ebb0ff36630c77f2cd7b19cb9f802c6884a6a7a9ceb69cc8d23c0d59b42043e57

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (1269) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Executes dropped EXE 3 IoCs

Processes:

mssecsvc.exemssecsvc.exetasksche.exe

pid process

2012 mssecsvc.exe
1652 mssecsvc.exe
864 tasksche.exe

pid	process
2012	mssecsvc.exe
1652	mssecsvc.exe
864	tasksche.exe

Drops file in System32 directory 1 IoCs

Processes:

mssecsvc.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	mssecsvc.exe

Drops file in Windows directory 2 IoCs

Processes:

rundll32.exemssecsvc.exe

description ioc process

File created C:\WINDOWS\mssecsvc.exe rundll32.exe
File created C:\WINDOWS\tasksche.exe mssecsvc.exe

description	ioc	process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 24 IoCs

Processes:

mssecsvc.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DE712024-1306-41DB-8737-14C67078445E}\WpadDecisionTime = d05e0a70ea9bd801	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DE712024-1306-41DB-8737-14C67078445E}\WpadDecision = "0"	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DE712024-1306-41DB-8737-14C67078445E}\WpadNetworkName = "Network 3"	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fa-2a-a3-ed-34-1b\WpadDecisionTime = d05e0a70ea9bd801	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fa-2a-a3-ed-34-1b\WpadDecision = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fa-2a-a3-ed-34-1b	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00c4000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DE712024-1306-41DB-8737-14C67078445E}	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DE712024-1306-41DB-8737-14C67078445E}\WpadDecisionReason = "1"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DE712024-1306-41DB-8737-14C67078445E}\fa-2a-a3-ed-34-1b	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fa-2a-a3-ed-34-1b\WpadDecisionReason = "1"	mssecsvc.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1476 wrote to memory of 1636	1476	rundll32.exe	rundll32.exe
PID 1476 wrote to memory of 1636	1476	rundll32.exe	rundll32.exe
PID 1476 wrote to memory of 1636	1476	rundll32.exe	rundll32.exe
PID 1476 wrote to memory of 1636	1476	rundll32.exe	rundll32.exe
PID 1476 wrote to memory of 1636	1476	rundll32.exe	rundll32.exe
PID 1476 wrote to memory of 1636	1476	rundll32.exe	rundll32.exe
PID 1476 wrote to memory of 1636	1476	rundll32.exe	rundll32.exe
PID 1636 wrote to memory of 2012	1636	rundll32.exe	mssecsvc.exe
PID 1636 wrote to memory of 2012	1636	rundll32.exe	mssecsvc.exe
PID 1636 wrote to memory of 2012	1636	rundll32.exe	mssecsvc.exe
PID 1636 wrote to memory of 2012	1636	rundll32.exe	mssecsvc.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\85d3a6eb4f1c04311c52891051503b3a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1476

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\85d3a6eb4f1c04311c52891051503b3a.dll,#1
2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1636

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe
3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2012

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
4⤵
- Executes dropped EXE
PID:864

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1652

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

1

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\mssecsvc.exe

Filesize
3.6MB

MD5
a614a0ad86696a9a2c65ddd73ae87c75

SHA1
870539bcda0c1981b946b709660631c6be52558c

SHA256
78e9045a7d6d914a550a29c3d446cdf3a4ef2950eaac279e5868587cea02b55e

SHA512
531f7945a686dcbf272123352830637ce5c235e3f1f803c6d0d9d0df4b8931a0d03ad1db599be79e61366a0c55e12badda143accb9993b1ccd5ce159620b3637

Download Submit
C:\Windows\mssecsvc.exe

Filesize
3.6MB

MD5
a614a0ad86696a9a2c65ddd73ae87c75

SHA1
870539bcda0c1981b946b709660631c6be52558c

SHA256
78e9045a7d6d914a550a29c3d446cdf3a4ef2950eaac279e5868587cea02b55e

SHA512
531f7945a686dcbf272123352830637ce5c235e3f1f803c6d0d9d0df4b8931a0d03ad1db599be79e61366a0c55e12badda143accb9993b1ccd5ce159620b3637

Download Submit
C:\Windows\mssecsvc.exe

Filesize
3.6MB

MD5
a614a0ad86696a9a2c65ddd73ae87c75

SHA1
870539bcda0c1981b946b709660631c6be52558c

SHA256
78e9045a7d6d914a550a29c3d446cdf3a4ef2950eaac279e5868587cea02b55e

SHA512
531f7945a686dcbf272123352830637ce5c235e3f1f803c6d0d9d0df4b8931a0d03ad1db599be79e61366a0c55e12badda143accb9993b1ccd5ce159620b3637

Download Submit
C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
05b29f45d56d401e2e00e7892c696de1

SHA1
1f5591566c9a7bb485a87fe35d7d2a88fa0447b6

SHA256
7ffa57a70b24a82ba79d41038bcbb42aca217325dc86140d156b408e3c218a07

SHA512
84a31f191d5c89c4c3c8219a87da7dff12e12c120bd06937a2157163331f388029024c24a56409ee6b5b88ab677af952e76c7812ff644ca61ac6032660c39da7

Download Submit
memory/1636-54-0x0000000000000000-mapping.dmp

Download
memory/1636-55-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download
memory/2012-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads