wannacry | 48fc9ccb42ec0234df4d4f41db1d0cb1e1fe6aa5e640c28625aa3d73e65d2856

General

Target

0a9138624a09d2bd90e04a78799b35ac.dll
Size

5.0MB
MD5

0a9138624a09d2bd90e04a78799b35ac
SHA1

018aa130b119685c358514576ba3ba4d37b95e43
SHA256

48fc9ccb42ec0234df4d4f41db1d0cb1e1fe6aa5e640c28625aa3d73e65d2856
SHA512

24f7ed2d3a526ebfb1389833d2a7de79b565799c3bde644c67fdda37e0ca831c747d9267922caba4018dc4c16ec7b70825b44652cc69f6801d33b6af84d1958b

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (1313) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Executes dropped EXE 2 IoCs

Processes:

mssecsvc.exemssecsvc.exe

pid process

900 mssecsvc.exe
1616 mssecsvc.exe

pid	process
900	mssecsvc.exe
1616	mssecsvc.exe

Drops file in System32 directory 1 IoCs

Processes:

mssecsvc.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	mssecsvc.exe

Drops file in Windows directory 2 IoCs

Processes:

rundll32.exemssecsvc.exe

description ioc process

File created C:\WINDOWS\mssecsvc.exe rundll32.exe
File created C:\WINDOWS\tasksche.exe mssecsvc.exe

description	ioc	process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 24 IoCs

Processes:

mssecsvc.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CD5ABDE6-A542-44FB-BBC4-452A0BE1EF0D}	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CD5ABDE6-A542-44FB-BBC4-452A0BE1EF0D}\WpadNetworkName = "Network 3"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-d2-28-2d-c7-fb\WpadDecision = "0"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CD5ABDE6-A542-44FB-BBC4-452A0BE1EF0D}\WpadDecision = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CD5ABDE6-A542-44FB-BBC4-452A0BE1EF0D}\WpadDecisionTime = 30e7f7dfd69bd801	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-d2-28-2d-c7-fb\WpadDecisionReason = "1"	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-d2-28-2d-c7-fb\WpadDecisionTime = 30e7f7dfd69bd801	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CD5ABDE6-A542-44FB-BBC4-452A0BE1EF0D}\WpadDecisionReason = "1"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0105000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-d2-28-2d-c7-fb	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CD5ABDE6-A542-44FB-BBC4-452A0BE1EF0D}\56-d2-28-2d-c7-fb	mssecsvc.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1848 wrote to memory of 1756	1848	rundll32.exe	rundll32.exe
PID 1848 wrote to memory of 1756	1848	rundll32.exe	rundll32.exe
PID 1848 wrote to memory of 1756	1848	rundll32.exe	rundll32.exe
PID 1848 wrote to memory of 1756	1848	rundll32.exe	rundll32.exe
PID 1848 wrote to memory of 1756	1848	rundll32.exe	rundll32.exe
PID 1848 wrote to memory of 1756	1848	rundll32.exe	rundll32.exe
PID 1848 wrote to memory of 1756	1848	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 900	1756	rundll32.exe	mssecsvc.exe
PID 1756 wrote to memory of 900	1756	rundll32.exe	mssecsvc.exe
PID 1756 wrote to memory of 900	1756	rundll32.exe	mssecsvc.exe
PID 1756 wrote to memory of 900	1756	rundll32.exe	mssecsvc.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0a9138624a09d2bd90e04a78799b35ac.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1848

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0a9138624a09d2bd90e04a78799b35ac.dll,#1
2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1756

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe
3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:900

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1616

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

1

T1046

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\mssecsvc.exe
Filesize
3.6MB

MD5
b5b08199acf7e5cdbbe3c804c751e04d

SHA1
47e0beb1515875af762dc41c7a5c7c912cae1fad

SHA256
9c47b3926cbb301c7449449cb427f9fc774d109bc2b46b6a1439adf50170d7b4

SHA512
22b28606176c8628ee6ffdfecf2ab29a4ff58371df034d2554d35ee4893de6c0d398d19e3842bf63e2a65505417362909d5c76979af4b307e85994df6607e256

Download Submit
C:\Windows\mssecsvc.exe
Filesize
3.6MB

MD5
b5b08199acf7e5cdbbe3c804c751e04d

SHA1
47e0beb1515875af762dc41c7a5c7c912cae1fad

SHA256
9c47b3926cbb301c7449449cb427f9fc774d109bc2b46b6a1439adf50170d7b4

SHA512
22b28606176c8628ee6ffdfecf2ab29a4ff58371df034d2554d35ee4893de6c0d398d19e3842bf63e2a65505417362909d5c76979af4b307e85994df6607e256

Download Submit
C:\Windows\mssecsvc.exe
Filesize
3.6MB

MD5
b5b08199acf7e5cdbbe3c804c751e04d

SHA1
47e0beb1515875af762dc41c7a5c7c912cae1fad

SHA256
9c47b3926cbb301c7449449cb427f9fc774d109bc2b46b6a1439adf50170d7b4

SHA512
22b28606176c8628ee6ffdfecf2ab29a4ff58371df034d2554d35ee4893de6c0d398d19e3842bf63e2a65505417362909d5c76979af4b307e85994df6607e256

Download Submit
memory/900-56-0x0000000000000000-mapping.dmp

Download
memory/1756-54-0x0000000000000000-mapping.dmp

Download
memory/1756-55-0x0000000074F41000-0x0000000074F43000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads