wannacry | 039b32d60d25dea0656c75fcc4017898a780560966b3a2915ca0e0c4220d4431

General

Target

937d1c7c2a656bccc8a115f445b166db.dll
Size

5.0MB
MD5

937d1c7c2a656bccc8a115f445b166db
SHA1

a20b4e933772ca65117992bdd60220726e9d545a
SHA256

039b32d60d25dea0656c75fcc4017898a780560966b3a2915ca0e0c4220d4431
SHA512

cbeea4b9e06c90514da3a98f7c16a72144ca93ec3b4bbd7a01c7a4bf181868803aeb5dd221698e8493f671fbaf1690ecc2543b85e2272bf83753b70bd124c610

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (996) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Executes dropped EXE 3 IoCs

Processes:

mssecsvc.exemssecsvc.exetasksche.exe

pid process

900 mssecsvc.exe
1484 mssecsvc.exe
1052 tasksche.exe

pid	process
900	mssecsvc.exe
1484	mssecsvc.exe
1052	tasksche.exe

Drops file in System32 directory 1 IoCs

Processes:

mssecsvc.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	mssecsvc.exe

Drops file in Windows directory 2 IoCs

Processes:

mssecsvc.exerundll32.exe

description ioc process

File created C:\WINDOWS\tasksche.exe mssecsvc.exe
File created C:\WINDOWS\mssecsvc.exe rundll32.exe

description	ioc	process
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe

Modifies data under HKEY_USERS 24 IoCs

Processes:

mssecsvc.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{64ECAC15-224E-45BA-A02F-29585095B53D}\WpadDecision = "0"	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{64ECAC15-224E-45BA-A02F-29585095B53D}\WpadNetworkName = "Network 3"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{64ECAC15-224E-45BA-A02F-29585095B53D}\be-70-c6-d0-49-d9	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\be-70-c6-d0-49-d9\WpadDecision = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00c2000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\be-70-c6-d0-49-d9\WpadDecisionTime = e09aa2b7e69bd801	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{64ECAC15-224E-45BA-A02F-29585095B53D}	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{64ECAC15-224E-45BA-A02F-29585095B53D}\WpadDecisionReason = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\be-70-c6-d0-49-d9\WpadDecisionReason = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{64ECAC15-224E-45BA-A02F-29585095B53D}\WpadDecisionTime = e09aa2b7e69bd801	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\be-70-c6-d0-49-d9	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1968 wrote to memory of 1096	1968	rundll32.exe	rundll32.exe
PID 1968 wrote to memory of 1096	1968	rundll32.exe	rundll32.exe
PID 1968 wrote to memory of 1096	1968	rundll32.exe	rundll32.exe
PID 1968 wrote to memory of 1096	1968	rundll32.exe	rundll32.exe
PID 1968 wrote to memory of 1096	1968	rundll32.exe	rundll32.exe
PID 1968 wrote to memory of 1096	1968	rundll32.exe	rundll32.exe
PID 1968 wrote to memory of 1096	1968	rundll32.exe	rundll32.exe
PID 1096 wrote to memory of 900	1096	rundll32.exe	mssecsvc.exe
PID 1096 wrote to memory of 900	1096	rundll32.exe	mssecsvc.exe
PID 1096 wrote to memory of 900	1096	rundll32.exe	mssecsvc.exe
PID 1096 wrote to memory of 900	1096	rundll32.exe	mssecsvc.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\937d1c7c2a656bccc8a115f445b166db.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1968

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\937d1c7c2a656bccc8a115f445b166db.dll,#1
2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1096

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe
3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:900

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
4⤵
- Executes dropped EXE
PID:1052

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1484

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

1

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\mssecsvc.exe
Filesize
3.6MB

MD5
e0c388c78e52ae9f5b9e15d044574358

SHA1
de2ed045caa3a4840bfcfe3e1aaf3ffe68e5c477

SHA256
01c0478b33a0ef1ec2e9d8c438ab3a61f0ebe037b152dca37f45a8d39aad3db3

SHA512
92f6ceddd66f069c9c99cb195435dd3fff8aed2baf2f4f6ab37728cda5d51a11c376a1c73d40ab39fb47cd96630673dae4aee85b900a3f7228716b28908d8068

Download Submit
C:\Windows\mssecsvc.exe
Filesize
3.6MB

MD5
e0c388c78e52ae9f5b9e15d044574358

SHA1
de2ed045caa3a4840bfcfe3e1aaf3ffe68e5c477

SHA256
01c0478b33a0ef1ec2e9d8c438ab3a61f0ebe037b152dca37f45a8d39aad3db3

SHA512
92f6ceddd66f069c9c99cb195435dd3fff8aed2baf2f4f6ab37728cda5d51a11c376a1c73d40ab39fb47cd96630673dae4aee85b900a3f7228716b28908d8068

Download Submit
C:\Windows\mssecsvc.exe
Filesize
3.6MB

MD5
e0c388c78e52ae9f5b9e15d044574358

SHA1
de2ed045caa3a4840bfcfe3e1aaf3ffe68e5c477

SHA256
01c0478b33a0ef1ec2e9d8c438ab3a61f0ebe037b152dca37f45a8d39aad3db3

SHA512
92f6ceddd66f069c9c99cb195435dd3fff8aed2baf2f4f6ab37728cda5d51a11c376a1c73d40ab39fb47cd96630673dae4aee85b900a3f7228716b28908d8068

Download Submit
C:\Windows\tasksche.exe
Filesize
3.4MB

MD5
ab4c6ef5625fcc194fdfa6e760eab2c8

SHA1
eea52215e31b7ce34e8ddc0f90e5d73f66c9fee8

SHA256
abfdb4a7d6e4cfe9a15e4e998b1b1c2adbfa388c94c1c7f696c1a15368446f88

SHA512
ff4bb15aaeb4449538c4bc8adbadc67a4aa6e59872bec1aa786b91b3b851607f7a6f961b820f70192b7c34cda4c00e916569e7f6abb52d7aea064b1aa78558c9

Download Submit
memory/900-56-0x0000000000000000-mapping.dmp

Download
memory/1096-54-0x0000000000000000-mapping.dmp

Download
memory/1096-55-0x0000000075851000-0x0000000075853000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads