wannacry | 4ffce411f462670df9a7d95579bbf1fab89df79e1548bfc21f974ee1721b0432

General

Target
42e738ed97f87cd7a1da297a81fca30e.dll
Size 5.0MB
Sample220720-bkhvvaaedr
SHA256 4ffce411f462670df9a7d95579bbf1fab89df79e1548bfc21f974ee1721b0432
MD5 42e738ed97f87cd7a1da297a81fca30e
SHA1 c7f969152a9d332bcccebf82afb38a5a3a66a7cb
SHA512 346be9dd8018067aa34d64521a7a6cee72e0436c30422ece384f177de4266a86508422d04e0b0a9126b3907a596871a588c355c43247639079aa64c9e2f29d0b
MD5 SHA1 SHA512

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (1270) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Executes dropped EXE 3 IoCs

pid	Process
1384	mssecsvc.exe
1288	mssecsvc.exe
1704	tasksche.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	mssecsvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvc.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 1008	1140	rundll32.exe	28
PID 1140 wrote to memory of 1008	1140	rundll32.exe	28
PID 1140 wrote to memory of 1008	1140	rundll32.exe	28
PID 1140 wrote to memory of 1008	1140	rundll32.exe	28
PID 1140 wrote to memory of 1008	1140	rundll32.exe	28
PID 1140 wrote to memory of 1008	1140	rundll32.exe	28
PID 1140 wrote to memory of 1008	1140	rundll32.exe	28
PID 1008 wrote to memory of 1384	1008	rundll32.exe	29
PID 1008 wrote to memory of 1384	1008	rundll32.exe	29
PID 1008 wrote to memory of 1384	1008	rundll32.exe	29
PID 1008 wrote to memory of 1384	1008	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\42e738ed97f87cd7a1da297a81fca30e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\42e738ed97f87cd7a1da297a81fca30e.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1008
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:1384
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:1704

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1288

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

1

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvc.exe

Path C:\WINDOWS\mssecsvc.exe
Size 3.6MB
SHA256 64ce85fc6096610b695c207271cc11ea1cff1c945ce2097e2e5dadb7c2fd4da4
MD5 5e1ea63e17fe3ba96369958edcf18dda
SHA1 37b98029f687a63caf28482456d6090cd4ac1dff
SHA512 9423bb7869464b05150f08cde0cede9ece15ee818d536c32643aeadc058857dcc9da2a90ff042eb18df287be4b9d5a2ea089bcd1812d196d9c2d5b11c4acfee8
SSDEEP 98304:H8qPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2HI:H8qPe1Cxcxk3ZAEUadzR8yc4HI
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 64ce85fc6096610b695c207271cc11ea1cff1c945ce2097e2e5dadb7c2fd4da4
MD5 5e1ea63e17fe3ba96369958edcf18dda
SHA1 37b98029f687a63caf28482456d6090cd4ac1dff
SHA512 9423bb7869464b05150f08cde0cede9ece15ee818d536c32643aeadc058857dcc9da2a90ff042eb18df287be4b9d5a2ea089bcd1812d196d9c2d5b11c4acfee8
SSDEEP 98304:H8qPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2HI:H8qPe1Cxcxk3ZAEUadzR8yc4HI
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 64ce85fc6096610b695c207271cc11ea1cff1c945ce2097e2e5dadb7c2fd4da4
MD5 5e1ea63e17fe3ba96369958edcf18dda
SHA1 37b98029f687a63caf28482456d6090cd4ac1dff
SHA512 9423bb7869464b05150f08cde0cede9ece15ee818d536c32643aeadc058857dcc9da2a90ff042eb18df287be4b9d5a2ea089bcd1812d196d9c2d5b11c4acfee8
SSDEEP 98304:H8qPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2HI:H8qPe1Cxcxk3ZAEUadzR8yc4HI
MD5 SHA1 SHA512 SSDEEP

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 2584e1521065e45ec3c17767c065429038fc6291c091097ea8b22c8a502c41dd
MD5 7f7ccaa16fb15eb1c7399d422f8363e8
SHA1 bd44d0ab543bf814d93b719c24e90d8dd7111234
SHA512 83e334b80de08903cfa9891a3fa349c1ece7e19f8e62b74a017512fa9a7989a0fd31929bf1fc13847bee04f2da3dacf6bc3f5ee58f0e4b9d495f4b9af12ed2b7
SSDEEP 98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2Hj:QqPe1Cxcxk3ZAEUadzR8yc4Hj
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1008-55-0x0000000074D61000-0x0000000074D63000-memory.dmp

Download

memory/1288-64-0x0000000000400000-0x0000000000A72000-memory.dmp

Download

memory/1288-65-0x0000000000400000-0x0000000000A72000-memory.dmp

Download

memory/1384-63-0x0000000000400000-0x0000000000A72000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads