wannacry | f72611c5668e9ea1177f96b11318d74b446eaba038723226d0b9d02173f00086

General

Target

5c7ccee392be19a1410dd69479bb9aaa.dll
Size

5.0MB
MD5

5c7ccee392be19a1410dd69479bb9aaa
SHA1

b35778532b222a35147c77a7a4497a236793815b
SHA256

f72611c5668e9ea1177f96b11318d74b446eaba038723226d0b9d02173f00086
SHA512

63d2670b01294ba10e9047f8de06a3c0a8ce04eaae8738577214164b5cb625a45fdec41a2750f088c3c05da38673473678b6ae5d71002d60a943344bb30810cc

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (1266) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Executes dropped EXE 3 IoCs

Processes:

mssecsvc.exemssecsvc.exetasksche.exe

pid process

860 mssecsvc.exe
1356 mssecsvc.exe
320 tasksche.exe

pid	process
860	mssecsvc.exe
1356	mssecsvc.exe
320	tasksche.exe

Drops file in System32 directory 1 IoCs

Processes:

mssecsvc.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	mssecsvc.exe

Drops file in Windows directory 2 IoCs

Processes:

rundll32.exemssecsvc.exe

description ioc process

File created C:\WINDOWS\mssecsvc.exe rundll32.exe
File created C:\WINDOWS\tasksche.exe mssecsvc.exe

description	ioc	process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 24 IoCs

Processes:

mssecsvc.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BD3673BF-48A3-41C2-95E6-96B7F21C007E}\WpadDecisionTime = b004da48e49bd801	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b6-c3-ef-61-21-da	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BD3673BF-48A3-41C2-95E6-96B7F21C007E}\b6-c3-ef-61-21-da	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b6-c3-ef-61-21-da\WpadDecisionTime = b004da48e49bd801	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00bd000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BD3673BF-48A3-41C2-95E6-96B7F21C007E}	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BD3673BF-48A3-41C2-95E6-96B7F21C007E}\WpadNetworkName = "Network 3"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b6-c3-ef-61-21-da\WpadDecision = "0"	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BD3673BF-48A3-41C2-95E6-96B7F21C007E}\WpadDecisionReason = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BD3673BF-48A3-41C2-95E6-96B7F21C007E}\WpadDecision = "0"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b6-c3-ef-61-21-da\WpadDecisionReason = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	mssecsvc.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1108 wrote to memory of 1436	1108	rundll32.exe	rundll32.exe
PID 1108 wrote to memory of 1436	1108	rundll32.exe	rundll32.exe
PID 1108 wrote to memory of 1436	1108	rundll32.exe	rundll32.exe
PID 1108 wrote to memory of 1436	1108	rundll32.exe	rundll32.exe
PID 1108 wrote to memory of 1436	1108	rundll32.exe	rundll32.exe
PID 1108 wrote to memory of 1436	1108	rundll32.exe	rundll32.exe
PID 1108 wrote to memory of 1436	1108	rundll32.exe	rundll32.exe
PID 1436 wrote to memory of 860	1436	rundll32.exe	mssecsvc.exe
PID 1436 wrote to memory of 860	1436	rundll32.exe	mssecsvc.exe
PID 1436 wrote to memory of 860	1436	rundll32.exe	mssecsvc.exe
PID 1436 wrote to memory of 860	1436	rundll32.exe	mssecsvc.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c7ccee392be19a1410dd69479bb9aaa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1108

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c7ccee392be19a1410dd69479bb9aaa.dll,#1
2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1436

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe
3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:860

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
4⤵
- Executes dropped EXE
PID:320

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1356

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

1

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\mssecsvc.exe
Filesize
3.6MB

MD5
0e03979bf10f5620dc79af026805095d

SHA1
f47bf3b7f0fc27542317629b77a397eff7a01ae2

SHA256
63c892fd054eb87587d80dd2274db0728f20466d6b3f9fc0eafe413ed2da3ae5

SHA512
da4935b0da9f26a86613fb6db2f5c973af33355a01ad418a017147e8999873e74b961f71a9043f4c7540e770a59f23af892c6f7e866e2b91f0329d006a3cd601

Download Submit
C:\Windows\mssecsvc.exe
Filesize
3.6MB

MD5
0e03979bf10f5620dc79af026805095d

SHA1
f47bf3b7f0fc27542317629b77a397eff7a01ae2

SHA256
63c892fd054eb87587d80dd2274db0728f20466d6b3f9fc0eafe413ed2da3ae5

SHA512
da4935b0da9f26a86613fb6db2f5c973af33355a01ad418a017147e8999873e74b961f71a9043f4c7540e770a59f23af892c6f7e866e2b91f0329d006a3cd601

Download Submit
C:\Windows\mssecsvc.exe
Filesize
3.6MB

MD5
0e03979bf10f5620dc79af026805095d

SHA1
f47bf3b7f0fc27542317629b77a397eff7a01ae2

SHA256
63c892fd054eb87587d80dd2274db0728f20466d6b3f9fc0eafe413ed2da3ae5

SHA512
da4935b0da9f26a86613fb6db2f5c973af33355a01ad418a017147e8999873e74b961f71a9043f4c7540e770a59f23af892c6f7e866e2b91f0329d006a3cd601

Download Submit
C:\Windows\tasksche.exe
Filesize
3.4MB

MD5
d8f489fcc0bc44d46bba2cf4c4918eb2

SHA1
a9c5cb31317c1eb04f180a3a0d7c3220793f5a31

SHA256
141659eb331099d5e2042b6a9afcd9b2ff7b95fdb3dcf009daca874ee3ca21fc

SHA512
384d24d1744e81d88cd9c9c4001eb5978dc6ae5801ea53f25d942af93921fb3b4843c076cdf1779fd062a2d9ed576b3d19c33e854aecf72ac7526bc0262220a9

Download Submit
memory/860-56-0x0000000000000000-mapping.dmp

Download
memory/1436-54-0x0000000000000000-mapping.dmp

Download
memory/1436-55-0x0000000076921000-0x0000000076923000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads