wannacry | 7632930b27dfc20a2bd82a937b3dbf3edd5d8108c14f7fc9d083d5476a4b3fa0

General

Target

c0c6cdd528c438532fe16b19c5302bf5.dll
Size

5.0MB
MD5

c0c6cdd528c438532fe16b19c5302bf5
SHA1

2cda06ec3ed843e1c5778a91b8a2a3c1740f1a0e
SHA256

7632930b27dfc20a2bd82a937b3dbf3edd5d8108c14f7fc9d083d5476a4b3fa0
SHA512

9f5abda38300187b723ca90e113068f16f0a4b0ee1d0b00de0c6211ee339f2802883284b74f3755f64480e1c71fe01b58fb5e7009c094774fa2577983d67c301

Score

10^/10

wannacry discovery ransomware upx worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3174) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Executes dropped EXE 4 IoCs

Processes:

mssecsvc.exemssecsvcmgr.exemssecsvc.exetasksche.exe

pid process

4420 mssecsvc.exe
4164 mssecsvcmgr.exe
1816 mssecsvc.exe
3184 tasksche.exe

pid	process
4420	mssecsvc.exe
4164	mssecsvcmgr.exe
1816	mssecsvc.exe
3184	tasksche.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\WINDOWS\mssecsvcmgr.exe	upx
C:\Windows\mssecsvcmgr.exe	upx
behavioral2/memory/4164-139-0x0000000000400000-0x0000000000454000-memory.dmp	upx

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Drops file in Windows directory 4 IoCs

Processes:

mssecsvc.exemssecsvc.exerundll32.exe

description	ioc	process
File created	C:\WINDOWS\mssecsvcmgr.exe	mssecsvc.exe
File created	C:\WINDOWS\mssecsvcmgr.exe	mssecsvc.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3468 4164 WerFault.exe mssecsvcmgr.exe

pid	pid_target	process	target process
3468	4164	WerFault.exe	mssecsvcmgr.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

mssecsvc.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

rundll32.exerundll32.exemssecsvc.exe

description	pid	process	target process
PID 3368 wrote to memory of 4604	3368	rundll32.exe	rundll32.exe
PID 3368 wrote to memory of 4604	3368	rundll32.exe	rundll32.exe
PID 3368 wrote to memory of 4604	3368	rundll32.exe	rundll32.exe
PID 4604 wrote to memory of 4420	4604	rundll32.exe	mssecsvc.exe
PID 4604 wrote to memory of 4420	4604	rundll32.exe	mssecsvc.exe
PID 4604 wrote to memory of 4420	4604	rundll32.exe	mssecsvc.exe
PID 4420 wrote to memory of 4164	4420	mssecsvc.exe	mssecsvcmgr.exe
PID 4420 wrote to memory of 4164	4420	mssecsvc.exe	mssecsvcmgr.exe
PID 4420 wrote to memory of 4164	4420	mssecsvc.exe	mssecsvcmgr.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c0c6cdd528c438532fe16b19c5302bf5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3368

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c0c6cdd528c438532fe16b19c5302bf5.dll,#1
2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4604

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe
3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4420

C:\WINDOWS\mssecsvcmgr.exe
C:\WINDOWS\mssecsvcmgr.exe
4⤵
- Executes dropped EXE
PID:4164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4164 -s 260
5⤵
- Program crash
PID:3468

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
4⤵
- Executes dropped EXE
PID:3184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4164 -ip 4164
1⤵
PID:1168

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1816

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

2

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\mssecsvc.exe

Filesize
3.7MB

MD5
e8ac4e9a26b8207b69884e4e2f30475d

SHA1
a060c2acc1e903e12ed52f96d1b5f7777bf18b28

SHA256
52752ecd2284e0565634dec194b9a917341996647d46e25b295139808c180b85

SHA512
845ee5ae658f0c4f80dadd70b6fa6d0fc26f8e55eb8110a119c2b428c9db6b6f207ebf49831556bf34a4dd4ca8ff02a72cc6fcf81cd3b726068130b36f8d6d83

Download Submit
C:\WINDOWS\mssecsvcmgr.exe

Filesize
103KB

MD5
39ba7f790512d1af40cc864189175cb7

SHA1
da5f35bed908b1a0d08b7639d76cf2d711789e29

SHA256
b7bf5c2afcbb6f664966c7b2cd72ac8cc26f95199ff49a490550858e83a91e75

SHA512
0b59b197cf1123bacd7badb5b359ec17c45d99e297893a28b5130a724d6ba12465f361d7872ab3ebc527ae317735c1182d3d71bcd53b4773dbca3cd82ea1d76e

Download Submit
C:\Windows\mssecsvc.exe

Filesize
3.7MB

MD5
e8ac4e9a26b8207b69884e4e2f30475d

SHA1
a060c2acc1e903e12ed52f96d1b5f7777bf18b28

SHA256
52752ecd2284e0565634dec194b9a917341996647d46e25b295139808c180b85

SHA512
845ee5ae658f0c4f80dadd70b6fa6d0fc26f8e55eb8110a119c2b428c9db6b6f207ebf49831556bf34a4dd4ca8ff02a72cc6fcf81cd3b726068130b36f8d6d83

Download Submit
C:\Windows\mssecsvc.exe

Filesize
3.7MB

MD5
e8ac4e9a26b8207b69884e4e2f30475d

SHA1
a060c2acc1e903e12ed52f96d1b5f7777bf18b28

SHA256
52752ecd2284e0565634dec194b9a917341996647d46e25b295139808c180b85

SHA512
845ee5ae658f0c4f80dadd70b6fa6d0fc26f8e55eb8110a119c2b428c9db6b6f207ebf49831556bf34a4dd4ca8ff02a72cc6fcf81cd3b726068130b36f8d6d83

Download Submit
C:\Windows\mssecsvcmgr.exe

Filesize
103KB

MD5
39ba7f790512d1af40cc864189175cb7

SHA1
da5f35bed908b1a0d08b7639d76cf2d711789e29

SHA256
b7bf5c2afcbb6f664966c7b2cd72ac8cc26f95199ff49a490550858e83a91e75

SHA512
0b59b197cf1123bacd7badb5b359ec17c45d99e297893a28b5130a724d6ba12465f361d7872ab3ebc527ae317735c1182d3d71bcd53b4773dbca3cd82ea1d76e

Download Submit
C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
3233aced9279ef54267c479bba665b90

SHA1
0b2cc142386641901511269503cdf6f641fad305

SHA256
f60f8a6bcaf1384a0d6a76d3e88007a8604560b263d2b8aeee06fd74c9ee5b3b

SHA512
55f25c51ffb89d46f2a7d2ed9b67701e178bd68e74b71d757d5fa14bd9530a427104fc36116633033ead762ecf7960ab96429f5b0a085a701001c6832ba4555e

Download Submit
memory/1816-140-0x0000000000400000-0x0000000000A86000-memory.dmp

Filesize
6.5MB

Download
memory/1816-143-0x0000000000400000-0x0000000000A86000-memory.dmp

Filesize
6.5MB

Download
memory/4164-134-0x0000000000000000-mapping.dmp

Download
memory/4164-139-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4420-131-0x0000000000000000-mapping.dmp

Download
memory/4420-136-0x0000000000400000-0x0000000000A86000-memory.dmp

Filesize
6.5MB

Download
memory/4420-142-0x0000000000400000-0x0000000000A86000-memory.dmp

Filesize
6.5MB

Download
memory/4604-130-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads