wannacry | 5e543c96b537b9ac589b9e94cb4080c8e45330ce854eda6a1755351902f5d435

General

Target

c12a265a269f9db4c29ee7308488a4a9.dll
Size

5.0MB
MD5

c12a265a269f9db4c29ee7308488a4a9
SHA1

b60e0dd175d66e343ea6f5329ea3aba14f13c23d
SHA256

5e543c96b537b9ac589b9e94cb4080c8e45330ce854eda6a1755351902f5d435
SHA512

c70659229e42e8d49cc03cb4158c01adc80a986319c13f5c472b3c1f99af455444f7f918d301e7d5689569fc0f128060086057f0f948dd1d4c150a07c8b953b1

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (1274) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Executes dropped EXE 3 IoCs

Processes:

mssecsvc.exemssecsvc.exetasksche.exe

pid process

1952 mssecsvc.exe
1316 mssecsvc.exe
1744 tasksche.exe

pid	process
1952	mssecsvc.exe
1316	mssecsvc.exe
1744	tasksche.exe

Drops file in System32 directory 1 IoCs

Processes:

mssecsvc.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	mssecsvc.exe

Drops file in Windows directory 2 IoCs

Processes:

rundll32.exemssecsvc.exe

description ioc process

File created C:\WINDOWS\mssecsvc.exe rundll32.exe
File created C:\WINDOWS\tasksche.exe mssecsvc.exe

description	ioc	process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 24 IoCs

Processes:

mssecsvc.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{458370D2-F5F5-4CF0-84A5-E9A8FC58ECAA}\06-5e-a2-7c-72-e4	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00cf000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{458370D2-F5F5-4CF0-84A5-E9A8FC58ECAA}\WpadNetworkName = "Network 3"	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{458370D2-F5F5-4CF0-84A5-E9A8FC58ECAA}\WpadDecisionTime = f00658c6e79bd801	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-5e-a2-7c-72-e4	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-5e-a2-7c-72-e4\WpadDecisionReason = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-5e-a2-7c-72-e4\WpadDecision = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{458370D2-F5F5-4CF0-84A5-E9A8FC58ECAA}	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-5e-a2-7c-72-e4\WpadDecisionTime = f00658c6e79bd801	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{458370D2-F5F5-4CF0-84A5-E9A8FC58ECAA}\WpadDecisionReason = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{458370D2-F5F5-4CF0-84A5-E9A8FC58ECAA}\WpadDecision = "0"	mssecsvc.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1904 wrote to memory of 608	1904	rundll32.exe	rundll32.exe
PID 1904 wrote to memory of 608	1904	rundll32.exe	rundll32.exe
PID 1904 wrote to memory of 608	1904	rundll32.exe	rundll32.exe
PID 1904 wrote to memory of 608	1904	rundll32.exe	rundll32.exe
PID 1904 wrote to memory of 608	1904	rundll32.exe	rundll32.exe
PID 1904 wrote to memory of 608	1904	rundll32.exe	rundll32.exe
PID 1904 wrote to memory of 608	1904	rundll32.exe	rundll32.exe
PID 608 wrote to memory of 1952	608	rundll32.exe	mssecsvc.exe
PID 608 wrote to memory of 1952	608	rundll32.exe	mssecsvc.exe
PID 608 wrote to memory of 1952	608	rundll32.exe	mssecsvc.exe
PID 608 wrote to memory of 1952	608	rundll32.exe	mssecsvc.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c12a265a269f9db4c29ee7308488a4a9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1904

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c12a265a269f9db4c29ee7308488a4a9.dll,#1
2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:608

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe
3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1952

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
4⤵
- Executes dropped EXE
PID:1744

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1316

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

1

T1046

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\mssecsvc.exe
Filesize
3.6MB

MD5
b5d7dab7278c0ec855d70664e2c602ba

SHA1
d4498db5b4a3535d6e957f73078861dab4820d2d

SHA256
aa8e0b683f9721c9ff7d0ea54ecf1ac8edf8eeb0e44552cbc5143a32bf3cd4a6

SHA512
4be9af67ae7ac561de8d3ba00c3db104c12aeb593b71678ea4d78ff273b693f2d0fd845566f9639ae6d6238e879aa26c3db71461bd0d75a46e60b55d7a67b73f

Download Submit
C:\Windows\mssecsvc.exe
Filesize
3.6MB

MD5
b5d7dab7278c0ec855d70664e2c602ba

SHA1
d4498db5b4a3535d6e957f73078861dab4820d2d

SHA256
aa8e0b683f9721c9ff7d0ea54ecf1ac8edf8eeb0e44552cbc5143a32bf3cd4a6

SHA512
4be9af67ae7ac561de8d3ba00c3db104c12aeb593b71678ea4d78ff273b693f2d0fd845566f9639ae6d6238e879aa26c3db71461bd0d75a46e60b55d7a67b73f

Download Submit
C:\Windows\mssecsvc.exe
Filesize
3.6MB

MD5
b5d7dab7278c0ec855d70664e2c602ba

SHA1
d4498db5b4a3535d6e957f73078861dab4820d2d

SHA256
aa8e0b683f9721c9ff7d0ea54ecf1ac8edf8eeb0e44552cbc5143a32bf3cd4a6

SHA512
4be9af67ae7ac561de8d3ba00c3db104c12aeb593b71678ea4d78ff273b693f2d0fd845566f9639ae6d6238e879aa26c3db71461bd0d75a46e60b55d7a67b73f

Download Submit
C:\Windows\tasksche.exe
Filesize
3.4MB

MD5
64a81f920a27dcb3fe4d2b94ab047a86

SHA1
cdcc302aabfb420e239ef1637d94e6d5a84acc72

SHA256
096470b766cd3813729285b23d4392e6941a592f90087169b77dda0359cb1374

SHA512
23fdecab454abd2c3d1301eb41f4deeab65550066de0899a0a2b51e46832cf423f8ebc22d3131e4c6727c60626702da829d768d061934ba4f3565ff2ed700211

Download Submit
memory/608-54-0x0000000000000000-mapping.dmp

Download
memory/608-55-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download
memory/1952-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads