wannacry | d357d032ff72e7ccf7b757f023adb1efee5224a1a6cb88a9d04a75c71869c83f

General

Target

148c53e6e824ea02536573145e9a280f.dll
Size

5.0MB
MD5

148c53e6e824ea02536573145e9a280f
SHA1

2d2506b815ffddf5100a04ecf820c2367f066534
SHA256

d357d032ff72e7ccf7b757f023adb1efee5224a1a6cb88a9d04a75c71869c83f
SHA512

0386866d02b44217237e5810e1b7665cdf874b6d53c04b4883913aec628ce28c3278cf6871ae6e63f9451436935324b2b902f3eade36fcf3d7e5d7622a4bf9d9

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (1270) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Executes dropped EXE 2 IoCs

Processes:

mssecsvr.exemssecsvr.exe

pid process

1604 mssecsvr.exe
2016 mssecsvr.exe

pid	process
1604	mssecsvr.exe
2016	mssecsvr.exe

Drops file in System32 directory 1 IoCs

Processes:

mssecsvr.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	mssecsvr.exe

Drops file in Windows directory 2 IoCs

Processes:

rundll32.exemssecsvr.exe

description ioc process

File created C:\WINDOWS\mssecsvr.exe rundll32.exe
File created C:\WINDOWS\tasksche.exe mssecsvr.exe

description	ioc	process
File created	C:\WINDOWS\mssecsvr.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvr.exe

Modifies data under HKEY_USERS 24 IoCs

Processes:

mssecsvr.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{91B91427-278C-456F-90B8-31FE4C81EBD2}	mssecsvr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{91B91427-278C-456F-90B8-31FE4C81EBD2}\WpadDecisionTime = e0a4cfc5e79bd801	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{91B91427-278C-456F-90B8-31FE4C81EBD2}\WpadDecision = "0"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-31-93-ef-c4-8f\WpadDecisionReason = "1"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-31-93-ef-c4-8f\WpadDecision = "0"	mssecsvr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	mssecsvr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	mssecsvr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00bc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{91B91427-278C-456F-90B8-31FE4C81EBD2}\WpadDecisionReason = "1"	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{91B91427-278C-456F-90B8-31FE4C81EBD2}\52-31-93-ef-c4-8f	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	mssecsvr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	mssecsvr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-31-93-ef-c4-8f	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	mssecsvr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{91B91427-278C-456F-90B8-31FE4C81EBD2}\WpadNetworkName = "Network 3"	mssecsvr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-31-93-ef-c4-8f\WpadDecisionTime = e0a4cfc5e79bd801	mssecsvr.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 960 wrote to memory of 896	960	rundll32.exe	rundll32.exe
PID 960 wrote to memory of 896	960	rundll32.exe	rundll32.exe
PID 960 wrote to memory of 896	960	rundll32.exe	rundll32.exe
PID 960 wrote to memory of 896	960	rundll32.exe	rundll32.exe
PID 960 wrote to memory of 896	960	rundll32.exe	rundll32.exe
PID 960 wrote to memory of 896	960	rundll32.exe	rundll32.exe
PID 960 wrote to memory of 896	960	rundll32.exe	rundll32.exe
PID 896 wrote to memory of 1604	896	rundll32.exe	mssecsvr.exe
PID 896 wrote to memory of 1604	896	rundll32.exe	mssecsvr.exe
PID 896 wrote to memory of 1604	896	rundll32.exe	mssecsvr.exe
PID 896 wrote to memory of 1604	896	rundll32.exe	mssecsvr.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\148c53e6e824ea02536573145e9a280f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:960

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\148c53e6e824ea02536573145e9a280f.dll,#1
2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:896

C:\WINDOWS\mssecsvr.exe
C:\WINDOWS\mssecsvr.exe
3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1604

C:\WINDOWS\mssecsvr.exe
C:\WINDOWS\mssecsvr.exe -m security
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2016

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

1

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\mssecsvr.exe
Filesize
2.2MB

MD5
6c549de3462a189387cc9914a2f81872

SHA1
bf2150145e91b8be34e8328188930a23c0c385f9

SHA256
7ad8ec9f8686ad924e553921c930d9732c6c2d740ffe1dff6757ff0caaa27b54

SHA512
5f14243e1b00251879a566337b964019acdc277aff92d95e3e0afceb5fa6b562d621183ca0737d4988dc499b4a383ff94dec6254e0faaa2f8addf3add15106f2

Download Submit
C:\Windows\mssecsvr.exe
Filesize
2.2MB

MD5
6c549de3462a189387cc9914a2f81872

SHA1
bf2150145e91b8be34e8328188930a23c0c385f9

SHA256
7ad8ec9f8686ad924e553921c930d9732c6c2d740ffe1dff6757ff0caaa27b54

SHA512
5f14243e1b00251879a566337b964019acdc277aff92d95e3e0afceb5fa6b562d621183ca0737d4988dc499b4a383ff94dec6254e0faaa2f8addf3add15106f2

Download Submit
C:\Windows\mssecsvr.exe
Filesize
2.2MB

MD5
6c549de3462a189387cc9914a2f81872

SHA1
bf2150145e91b8be34e8328188930a23c0c385f9

SHA256
7ad8ec9f8686ad924e553921c930d9732c6c2d740ffe1dff6757ff0caaa27b54

SHA512
5f14243e1b00251879a566337b964019acdc277aff92d95e3e0afceb5fa6b562d621183ca0737d4988dc499b4a383ff94dec6254e0faaa2f8addf3add15106f2

Download Submit
memory/896-54-0x0000000000000000-mapping.dmp

Download
memory/896-55-0x00000000753E1000-0x00000000753E3000-memory.dmp

Filesize
8KB

Download
memory/1604-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads