wannacry | 0f1516a8c0600c59defcf96c87c27de6a81e732ecb2f64b5e48904c31ab2cbb2

General

Target

1f0e54455209d879b8d4a9b06ee00746.dll
Size

5.0MB
MD5

1f0e54455209d879b8d4a9b06ee00746
SHA1

32b59f3433af3d34e9cbf01646981748f7e4a3f4
SHA256

0f1516a8c0600c59defcf96c87c27de6a81e732ecb2f64b5e48904c31ab2cbb2
SHA512

7610c74439843fff55777ed65e97838bc086c0bec432f701c978c6a84142ede788da5b68ac81534aa327047641df300d780d7fe70ae22ed2c4eff921f00290b7

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (1244) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Executes dropped EXE 3 IoCs

Processes:

mssecsvc.exemssecsvc.exetasksche.exe

pid process

1948 mssecsvc.exe
904 mssecsvc.exe
1056 tasksche.exe

pid	process
1948	mssecsvc.exe
904	mssecsvc.exe
1056	tasksche.exe

Drops file in System32 directory 1 IoCs

Processes:

mssecsvc.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	mssecsvc.exe

Drops file in Windows directory 2 IoCs

Processes:

mssecsvc.exerundll32.exe

description ioc process

File created C:\WINDOWS\tasksche.exe mssecsvc.exe
File created C:\WINDOWS\mssecsvc.exe rundll32.exe

description	ioc	process
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe

Modifies data under HKEY_USERS 24 IoCs

Processes:

mssecsvc.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5AB3EC69-37C3-4F68-A950-A93EE4D75C8E}\46-b6-0d-ab-9a-20	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5AB3EC69-37C3-4F68-A950-A93EE4D75C8E}\WpadDecisionTime = d0bc1a66e59bd801	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\46-b6-0d-ab-9a-20	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5AB3EC69-37C3-4F68-A950-A93EE4D75C8E}	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5AB3EC69-37C3-4F68-A950-A93EE4D75C8E}\WpadNetworkName = "Network 3"	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\46-b6-0d-ab-9a-20\WpadDecisionTime = d0bc1a66e59bd801	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\46-b6-0d-ab-9a-20\WpadDecision = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00c5000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5AB3EC69-37C3-4F68-A950-A93EE4D75C8E}\WpadDecisionReason = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5AB3EC69-37C3-4F68-A950-A93EE4D75C8E}\WpadDecision = "0"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\46-b6-0d-ab-9a-20\WpadDecisionReason = "1"	mssecsvc.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1660 wrote to memory of 1876	1660	rundll32.exe	rundll32.exe
PID 1660 wrote to memory of 1876	1660	rundll32.exe	rundll32.exe
PID 1660 wrote to memory of 1876	1660	rundll32.exe	rundll32.exe
PID 1660 wrote to memory of 1876	1660	rundll32.exe	rundll32.exe
PID 1660 wrote to memory of 1876	1660	rundll32.exe	rundll32.exe
PID 1660 wrote to memory of 1876	1660	rundll32.exe	rundll32.exe
PID 1660 wrote to memory of 1876	1660	rundll32.exe	rundll32.exe
PID 1876 wrote to memory of 1948	1876	rundll32.exe	mssecsvc.exe
PID 1876 wrote to memory of 1948	1876	rundll32.exe	mssecsvc.exe
PID 1876 wrote to memory of 1948	1876	rundll32.exe	mssecsvc.exe
PID 1876 wrote to memory of 1948	1876	rundll32.exe	mssecsvc.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1f0e54455209d879b8d4a9b06ee00746.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1660

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1f0e54455209d879b8d4a9b06ee00746.dll,#1
2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1876

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe
3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1948

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
4⤵
- Executes dropped EXE
PID:1056

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:904

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

1

T1046

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\mssecsvc.exe
Filesize
3.6MB

MD5
6e6802d5de74e388e03edb32f550b65a

SHA1
6900c2c3301601e74c470a24eca2c8665440b3b4

SHA256
c2c00613999afec5b573db8e48b699c95c0896341465482a7228d6f17048758f

SHA512
a3407cba8a13b5f25bcc61121318b0be21a27f705db69c650f6c56f4d586d59e5d8ebf119ed0d865c02724681c5ca84e9b96cfeb2bdf59b6785780ae49af9179

Download Submit
C:\Windows\mssecsvc.exe
Filesize
3.6MB

MD5
6e6802d5de74e388e03edb32f550b65a

SHA1
6900c2c3301601e74c470a24eca2c8665440b3b4

SHA256
c2c00613999afec5b573db8e48b699c95c0896341465482a7228d6f17048758f

SHA512
a3407cba8a13b5f25bcc61121318b0be21a27f705db69c650f6c56f4d586d59e5d8ebf119ed0d865c02724681c5ca84e9b96cfeb2bdf59b6785780ae49af9179

Download Submit
C:\Windows\mssecsvc.exe
Filesize
3.6MB

MD5
6e6802d5de74e388e03edb32f550b65a

SHA1
6900c2c3301601e74c470a24eca2c8665440b3b4

SHA256
c2c00613999afec5b573db8e48b699c95c0896341465482a7228d6f17048758f

SHA512
a3407cba8a13b5f25bcc61121318b0be21a27f705db69c650f6c56f4d586d59e5d8ebf119ed0d865c02724681c5ca84e9b96cfeb2bdf59b6785780ae49af9179

Download Submit
C:\Windows\tasksche.exe
Filesize
3.4MB

MD5
5ceab4fe5af2e2ef5b6f6fb2bc86642b

SHA1
3c44e4762302b7b5fcd6f14457fcfb74ff98b2d1

SHA256
1741c55afa4bc741abc334324a18f41d626bca8b85d82800d6832430eeb6598c

SHA512
d53df9677bd645b1802efd7a93d81e6dad8e5d35969c9f498697dc760c987bc0dedca64db646bc291fe65977b3bcf22c141b37c01245b3f04978f22cb1f0ac03

Download Submit
memory/1876-54-0x0000000000000000-mapping.dmp

Download
memory/1876-55-0x00000000756C1000-0x00000000756C3000-memory.dmp

Filesize
8KB

Download
memory/1948-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads