wannacry | b06b073d7b7686ccb923fe60231758fb74ab56b053aeb0d6c4b546fcaac8dae8

General

Target

31d084e2b1846efa6aa8c48e0c15479c.dll
Size

5.0MB
MD5

31d084e2b1846efa6aa8c48e0c15479c
SHA1

9ae7b8f7154dc52b7913a6cc10fe4ecf60fbef7f
SHA256

b06b073d7b7686ccb923fe60231758fb74ab56b053aeb0d6c4b546fcaac8dae8
SHA512

90143e5a66bd6caf8bfe64f6bdcd7e257522953299af4194dc1703cd2bdc568e092d78e0cf8ac5f0509cd08e29e04ad6eea57b32d29ed5a75b3f5c9da59f825a

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (986) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Executes dropped EXE 3 IoCs

Processes:

mssecsvc.exemssecsvc.exetasksche.exe

pid process

1492 mssecsvc.exe
1764 mssecsvc.exe
364 tasksche.exe

pid	process
1492	mssecsvc.exe
1764	mssecsvc.exe
364	tasksche.exe

Drops file in System32 directory 1 IoCs

Processes:

mssecsvc.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	mssecsvc.exe

Drops file in Windows directory 2 IoCs

Processes:

mssecsvc.exerundll32.exe

description ioc process

File created C:\WINDOWS\tasksche.exe mssecsvc.exe
File created C:\WINDOWS\mssecsvc.exe rundll32.exe

description	ioc	process
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe

Modifies data under HKEY_USERS 24 IoCs

Processes:

mssecsvc.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00c1000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{79924454-FFA8-40FA-B2E0-E50B81BFF94E}\WpadDecisionTime = c08bc3abec9bd801	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\12-63-50-77-49-84\WpadDecisionReason = "1"	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\12-63-50-77-49-84\WpadDecision = "0"	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\12-63-50-77-49-84\WpadDecisionTime = c08bc3abec9bd801	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{79924454-FFA8-40FA-B2E0-E50B81BFF94E}\WpadDecisionReason = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{79924454-FFA8-40FA-B2E0-E50B81BFF94E}\WpadDecision = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\12-63-50-77-49-84	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{79924454-FFA8-40FA-B2E0-E50B81BFF94E}	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{79924454-FFA8-40FA-B2E0-E50B81BFF94E}\WpadNetworkName = "Network 3"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{79924454-FFA8-40FA-B2E0-E50B81BFF94E}\12-63-50-77-49-84	mssecsvc.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1620 wrote to memory of 892	1620	rundll32.exe	rundll32.exe
PID 1620 wrote to memory of 892	1620	rundll32.exe	rundll32.exe
PID 1620 wrote to memory of 892	1620	rundll32.exe	rundll32.exe
PID 1620 wrote to memory of 892	1620	rundll32.exe	rundll32.exe
PID 1620 wrote to memory of 892	1620	rundll32.exe	rundll32.exe
PID 1620 wrote to memory of 892	1620	rundll32.exe	rundll32.exe
PID 1620 wrote to memory of 892	1620	rundll32.exe	rundll32.exe
PID 892 wrote to memory of 1492	892	rundll32.exe	mssecsvc.exe
PID 892 wrote to memory of 1492	892	rundll32.exe	mssecsvc.exe
PID 892 wrote to memory of 1492	892	rundll32.exe	mssecsvc.exe
PID 892 wrote to memory of 1492	892	rundll32.exe	mssecsvc.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\31d084e2b1846efa6aa8c48e0c15479c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1620

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\31d084e2b1846efa6aa8c48e0c15479c.dll,#1
2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:892

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe
3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1492

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
4⤵
- Executes dropped EXE
PID:364

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1764

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

1

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\mssecsvc.exe

Filesize
3.6MB

MD5
c95275f20af0ca0a731741c603a10d42

SHA1
5ccec9b53c79b16cb8c1477946c5ff23a6a6d72f

SHA256
67f464b9e9484542e5c595de223810bec74dd03db5ef9e93fcc24f136dd34c47

SHA512
5c081f3d043a343bd876d7b007f79b5625b2412e8187859e23fe9b9faf3643d75b889bf151042bd753831662bed71ef798c952220c155ab414c1f7e7683bc8bc

Download Submit
C:\Windows\mssecsvc.exe

Filesize
3.6MB

MD5
c95275f20af0ca0a731741c603a10d42

SHA1
5ccec9b53c79b16cb8c1477946c5ff23a6a6d72f

SHA256
67f464b9e9484542e5c595de223810bec74dd03db5ef9e93fcc24f136dd34c47

SHA512
5c081f3d043a343bd876d7b007f79b5625b2412e8187859e23fe9b9faf3643d75b889bf151042bd753831662bed71ef798c952220c155ab414c1f7e7683bc8bc

Download Submit
C:\Windows\mssecsvc.exe

Filesize
3.6MB

MD5
c95275f20af0ca0a731741c603a10d42

SHA1
5ccec9b53c79b16cb8c1477946c5ff23a6a6d72f

SHA256
67f464b9e9484542e5c595de223810bec74dd03db5ef9e93fcc24f136dd34c47

SHA512
5c081f3d043a343bd876d7b007f79b5625b2412e8187859e23fe9b9faf3643d75b889bf151042bd753831662bed71ef798c952220c155ab414c1f7e7683bc8bc

Download Submit
C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
ff7a3af81c0aebe0f7755eb9428f6189

SHA1
42f2b732feb316f58ed5ab500311d2cba8da7f7d

SHA256
9111adf54bd35bf90253ae991d9923f2fa673b465d0d9fca99a60b54f0adc044

SHA512
826640a2e651c092ee46314d19ff07313f25a1863e8a1bcf428a2fced2c6bf9b19bd82ec0237a66f93c047ccdb2fd3f35e1c08f80e0a2fb494d882046dd2dc91

Download Submit
memory/892-54-0x0000000000000000-mapping.dmp

Download
memory/892-55-0x0000000075A61000-0x0000000075A63000-memory.dmp

Filesize
8KB

Download
memory/1492-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads