wannacry | 121185201c29380e366cdee4e00038fd7aedb191e67498ba97bf85c16e39db6c

General

Target

9c27887058bdc8efa7761da28e613994.dll
Size

5.0MB
MD5

9c27887058bdc8efa7761da28e613994
SHA1

01be4b3c0fd62ff481450e646453d4e3651b5713
SHA256

121185201c29380e366cdee4e00038fd7aedb191e67498ba97bf85c16e39db6c
SHA512

59c6f7a6f592db777d7802faeef6f3507f4c7d4db9ea2edf4cd685d7220e0c5238cb7fa27b8bce3a2fa87a3fbd8caf4a510bb28efee0a9a0f4df593355ea2d7a

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (1213) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Executes dropped EXE 2 IoCs

Processes:

mssecsvr.exemssecsvr.exe

pid process

1924 mssecsvr.exe
2012 mssecsvr.exe

pid	process
1924	mssecsvr.exe
2012	mssecsvr.exe

Drops file in System32 directory 1 IoCs

Processes:

mssecsvr.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	mssecsvr.exe

Drops file in Windows directory 2 IoCs

Processes:

rundll32.exemssecsvr.exe

description ioc process

File created C:\WINDOWS\mssecsvr.exe rundll32.exe
File created C:\WINDOWS\tasksche.exe mssecsvr.exe

description	ioc	process
File created	C:\WINDOWS\mssecsvr.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvr.exe

Modifies data under HKEY_USERS 24 IoCs

Processes:

mssecsvr.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	mssecsvr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fa-40-f3-b5-5c-16\WpadDecisionTime = c0da5df2e99bd801	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4420727A-EFE9-4269-9A40-BDBABAE13548}	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4420727A-EFE9-4269-9A40-BDBABAE13548}\WpadDecision = "0"	mssecsvr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4420727A-EFE9-4269-9A40-BDBABAE13548}\WpadNetworkName = "Network 3"	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fa-40-f3-b5-5c-16	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4420727A-EFE9-4269-9A40-BDBABAE13548}\fa-40-f3-b5-5c-16	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	mssecsvr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	mssecsvr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	mssecsvr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00d2000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fa-40-f3-b5-5c-16\WpadDecisionReason = "1"	mssecsvr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	mssecsvr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4420727A-EFE9-4269-9A40-BDBABAE13548}\WpadDecisionReason = "1"	mssecsvr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4420727A-EFE9-4269-9A40-BDBABAE13548}\WpadDecisionTime = c0da5df2e99bd801	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fa-40-f3-b5-5c-16\WpadDecision = "0"	mssecsvr.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 600 wrote to memory of 1968	600	rundll32.exe	rundll32.exe
PID 600 wrote to memory of 1968	600	rundll32.exe	rundll32.exe
PID 600 wrote to memory of 1968	600	rundll32.exe	rundll32.exe
PID 600 wrote to memory of 1968	600	rundll32.exe	rundll32.exe
PID 600 wrote to memory of 1968	600	rundll32.exe	rundll32.exe
PID 600 wrote to memory of 1968	600	rundll32.exe	rundll32.exe
PID 600 wrote to memory of 1968	600	rundll32.exe	rundll32.exe
PID 1968 wrote to memory of 1924	1968	rundll32.exe	mssecsvr.exe
PID 1968 wrote to memory of 1924	1968	rundll32.exe	mssecsvr.exe
PID 1968 wrote to memory of 1924	1968	rundll32.exe	mssecsvr.exe
PID 1968 wrote to memory of 1924	1968	rundll32.exe	mssecsvr.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9c27887058bdc8efa7761da28e613994.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:600

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9c27887058bdc8efa7761da28e613994.dll,#1
2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1968

C:\WINDOWS\mssecsvr.exe
C:\WINDOWS\mssecsvr.exe
3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1924

C:\WINDOWS\mssecsvr.exe
C:\WINDOWS\mssecsvr.exe -m security
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2012

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

1

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\mssecsvr.exe
Filesize
2.2MB

MD5
074660125e8b575e6cb1a4af9094a7e9

SHA1
3aa024f4e7b5282c6b3450246492b29783017b6c

SHA256
b4c63d4a7eeffef514ca7be622e4d3331af935565ded5d233e8a21d27a481af4

SHA512
0494fe133dab8e1b7bf30f4ff6ee2ba0530e64324df44f86a253f763e152c8b6a2f329f0895bd145656deaa72d40221d6743f2adfc966887c2a0e0986b596de3

Download Submit
C:\Windows\mssecsvr.exe
Filesize
2.2MB

MD5
074660125e8b575e6cb1a4af9094a7e9

SHA1
3aa024f4e7b5282c6b3450246492b29783017b6c

SHA256
b4c63d4a7eeffef514ca7be622e4d3331af935565ded5d233e8a21d27a481af4

SHA512
0494fe133dab8e1b7bf30f4ff6ee2ba0530e64324df44f86a253f763e152c8b6a2f329f0895bd145656deaa72d40221d6743f2adfc966887c2a0e0986b596de3

Download Submit
C:\Windows\mssecsvr.exe
Filesize
2.2MB

MD5
074660125e8b575e6cb1a4af9094a7e9

SHA1
3aa024f4e7b5282c6b3450246492b29783017b6c

SHA256
b4c63d4a7eeffef514ca7be622e4d3331af935565ded5d233e8a21d27a481af4

SHA512
0494fe133dab8e1b7bf30f4ff6ee2ba0530e64324df44f86a253f763e152c8b6a2f329f0895bd145656deaa72d40221d6743f2adfc966887c2a0e0986b596de3

Download Submit
memory/1924-56-0x0000000000000000-mapping.dmp

Download
memory/1968-54-0x0000000000000000-mapping.dmp

Download
memory/1968-55-0x00000000756B1000-0x00000000756B3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads