wannacry | bcad6919d2edc3c51ba917a3348c39b5a7a5d0b2a5d3418977fcd475f6aeec20

General

Target

7831fbc27706698871cb2076f52e32e7.dll
Size

5.0MB
MD5

7831fbc27706698871cb2076f52e32e7
SHA1

473110b7e670cb6a3b7df0e603153b4fc47bcb4f
SHA256

bcad6919d2edc3c51ba917a3348c39b5a7a5d0b2a5d3418977fcd475f6aeec20
SHA512

ae1e555620d4d378120229db150331b2987268a6c53f641544b9b8a2a011d9f96b1321b648304f5a32cb707584114f033e60617c3b273b136bd42a36ff0f02d7

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (1211) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Executes dropped EXE 2 IoCs

Processes:

mssecsvr.exemssecsvr.exe

pid process

968 mssecsvr.exe
1104 mssecsvr.exe

pid	process
968	mssecsvr.exe
1104	mssecsvr.exe

Drops file in System32 directory 1 IoCs

Processes:

mssecsvr.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	mssecsvr.exe

Drops file in Windows directory 2 IoCs

Processes:

rundll32.exemssecsvr.exe

description ioc process

File created C:\WINDOWS\mssecsvr.exe rundll32.exe
File created C:\WINDOWS\tasksche.exe mssecsvr.exe

description	ioc	process
File created	C:\WINDOWS\mssecsvr.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvr.exe

Modifies data under HKEY_USERS 24 IoCs

Processes:

mssecsvr.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00cb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\f2-a3-7c-4b-9a-67\WpadDecisionReason = "1"	mssecsvr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\f2-a3-7c-4b-9a-67\WpadDecisionTime = d069238de59bd801	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	mssecsvr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D66BCBE2-7640-4A15-98A5-CA8865030184}\WpadDecisionTime = d069238de59bd801	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\f2-a3-7c-4b-9a-67	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D66BCBE2-7640-4A15-98A5-CA8865030184}\f2-a3-7c-4b-9a-67	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\f2-a3-7c-4b-9a-67\WpadDecision = "0"	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	mssecsvr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D66BCBE2-7640-4A15-98A5-CA8865030184}	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D66BCBE2-7640-4A15-98A5-CA8865030184}\WpadDecisionReason = "1"	mssecsvr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	mssecsvr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	mssecsvr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D66BCBE2-7640-4A15-98A5-CA8865030184}\WpadDecision = "0"	mssecsvr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D66BCBE2-7640-4A15-98A5-CA8865030184}\WpadNetworkName = "Network 3"	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvr.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1208 wrote to memory of 896	1208	rundll32.exe	rundll32.exe
PID 1208 wrote to memory of 896	1208	rundll32.exe	rundll32.exe
PID 1208 wrote to memory of 896	1208	rundll32.exe	rundll32.exe
PID 1208 wrote to memory of 896	1208	rundll32.exe	rundll32.exe
PID 1208 wrote to memory of 896	1208	rundll32.exe	rundll32.exe
PID 1208 wrote to memory of 896	1208	rundll32.exe	rundll32.exe
PID 1208 wrote to memory of 896	1208	rundll32.exe	rundll32.exe
PID 896 wrote to memory of 968	896	rundll32.exe	mssecsvr.exe
PID 896 wrote to memory of 968	896	rundll32.exe	mssecsvr.exe
PID 896 wrote to memory of 968	896	rundll32.exe	mssecsvr.exe
PID 896 wrote to memory of 968	896	rundll32.exe	mssecsvr.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7831fbc27706698871cb2076f52e32e7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1208

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7831fbc27706698871cb2076f52e32e7.dll,#1
2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:896

C:\WINDOWS\mssecsvr.exe
C:\WINDOWS\mssecsvr.exe
3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:968

C:\WINDOWS\mssecsvr.exe
C:\WINDOWS\mssecsvr.exe -m security
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1104

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

1

T1046

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\mssecsvr.exe
Filesize
2.2MB

MD5
e443f3ffe145795945411c0c1a4b0479

SHA1
a4c44dbebd84d55ddcab70a1d9fe22c2ec875346

SHA256
e97a21794fb4071da5751940f518819ec296aad6909384cf7ea734992b82872b

SHA512
f913024e0783fd782669fff01c13c427b4b19c15671b0cc5f2a864477c1a0860a5d949ec9f9d57f9503adf97418b480094aaec84509160ab993fb0216630e370

Download Submit
C:\Windows\mssecsvr.exe
Filesize
2.2MB

MD5
e443f3ffe145795945411c0c1a4b0479

SHA1
a4c44dbebd84d55ddcab70a1d9fe22c2ec875346

SHA256
e97a21794fb4071da5751940f518819ec296aad6909384cf7ea734992b82872b

SHA512
f913024e0783fd782669fff01c13c427b4b19c15671b0cc5f2a864477c1a0860a5d949ec9f9d57f9503adf97418b480094aaec84509160ab993fb0216630e370

Download Submit
C:\Windows\mssecsvr.exe
Filesize
2.2MB

MD5
e443f3ffe145795945411c0c1a4b0479

SHA1
a4c44dbebd84d55ddcab70a1d9fe22c2ec875346

SHA256
e97a21794fb4071da5751940f518819ec296aad6909384cf7ea734992b82872b

SHA512
f913024e0783fd782669fff01c13c427b4b19c15671b0cc5f2a864477c1a0860a5d949ec9f9d57f9503adf97418b480094aaec84509160ab993fb0216630e370

Download Submit
memory/896-54-0x0000000000000000-mapping.dmp

Download
memory/896-55-0x00000000758D1000-0x00000000758D3000-memory.dmp

Filesize
8KB

Download
memory/968-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads