wannacry | 0113c0b8f5a263e6aa02658e32446659289f6b18b55ab70f5a5ac2b82d469624

General

Target

203436927dfcfb20518d8c6ea8002588.dll
Size

5.0MB
MD5

203436927dfcfb20518d8c6ea8002588
SHA1

acb0ad80e393d0efaac0affbc554350de2dd9742
SHA256

0113c0b8f5a263e6aa02658e32446659289f6b18b55ab70f5a5ac2b82d469624
SHA512

9301deaaecdaf72300a5be45b1863fa25732c95d774a86d8c31adac91e938778cb4b8a5ef546ccdb1a3d94146ed6f7b1f2d7099a163d7fdf83b9ce5cc71b7498

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (1251) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Executes dropped EXE 2 IoCs

Processes:

mssecsvr.exemssecsvr.exe

pid process

1944 mssecsvr.exe
1216 mssecsvr.exe

pid	process
1944	mssecsvr.exe
1216	mssecsvr.exe

Drops file in System32 directory 1 IoCs

Processes:

mssecsvr.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	mssecsvr.exe

Drops file in Windows directory 2 IoCs

Processes:

rundll32.exemssecsvr.exe

description ioc process

File created C:\WINDOWS\mssecsvr.exe rundll32.exe
File created C:\WINDOWS\tasksche.exe mssecsvr.exe

description	ioc	process
File created	C:\WINDOWS\mssecsvr.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvr.exe

Modifies data under HKEY_USERS 24 IoCs

Processes:

mssecsvr.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	mssecsvr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	mssecsvr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4420727A-EFE9-4269-9A40-BDBABAE13548}\WpadDecision = "0"	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fa-40-f3-b5-5c-16\WpadDecisionTime = 3099233ced9bd801	mssecsvr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4420727A-EFE9-4269-9A40-BDBABAE13548}\WpadNetworkName = "Network 3"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fa-40-f3-b5-5c-16\WpadDecisionReason = "1"	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fa-40-f3-b5-5c-16	mssecsvr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00d2000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4420727A-EFE9-4269-9A40-BDBABAE13548}\WpadDecisionReason = "1"	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4420727A-EFE9-4269-9A40-BDBABAE13548}\fa-40-f3-b5-5c-16	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fa-40-f3-b5-5c-16\WpadDecision = "0"	mssecsvr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4420727A-EFE9-4269-9A40-BDBABAE13548}	mssecsvr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4420727A-EFE9-4269-9A40-BDBABAE13548}\WpadDecisionTime = 3099233ced9bd801	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	mssecsvr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	mssecsvr.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1956 wrote to memory of 1856	1956	rundll32.exe	rundll32.exe
PID 1956 wrote to memory of 1856	1956	rundll32.exe	rundll32.exe
PID 1956 wrote to memory of 1856	1956	rundll32.exe	rundll32.exe
PID 1956 wrote to memory of 1856	1956	rundll32.exe	rundll32.exe
PID 1956 wrote to memory of 1856	1956	rundll32.exe	rundll32.exe
PID 1956 wrote to memory of 1856	1956	rundll32.exe	rundll32.exe
PID 1956 wrote to memory of 1856	1956	rundll32.exe	rundll32.exe
PID 1856 wrote to memory of 1944	1856	rundll32.exe	mssecsvr.exe
PID 1856 wrote to memory of 1944	1856	rundll32.exe	mssecsvr.exe
PID 1856 wrote to memory of 1944	1856	rundll32.exe	mssecsvr.exe
PID 1856 wrote to memory of 1944	1856	rundll32.exe	mssecsvr.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\203436927dfcfb20518d8c6ea8002588.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1956

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\203436927dfcfb20518d8c6ea8002588.dll,#1
2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1856

C:\WINDOWS\mssecsvr.exe
C:\WINDOWS\mssecsvr.exe
3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1944

C:\WINDOWS\mssecsvr.exe
C:\WINDOWS\mssecsvr.exe -m security
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1216

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

1

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\mssecsvr.exe

Filesize
2.2MB

MD5
2dff9bae8c7d5e4a68c74c4f3467228a

SHA1
64a32e6a94f171eab63c73d5b8942d5191692895

SHA256
2ae575a134f05fc486845e302caf6407f2477c1527f15f42df7fb9953d5f197d

SHA512
7c0ff6d9aeea6cc2ca8a81acdc5888ea72889acdd285932a35a663de73306ecd6cfb35f4f0b90f0aaf25a103a37a15f65f655a6985a61b9070ff6184b07ae9a3

Download Submit
C:\Windows\mssecsvr.exe

Filesize
2.2MB

MD5
2dff9bae8c7d5e4a68c74c4f3467228a

SHA1
64a32e6a94f171eab63c73d5b8942d5191692895

SHA256
2ae575a134f05fc486845e302caf6407f2477c1527f15f42df7fb9953d5f197d

SHA512
7c0ff6d9aeea6cc2ca8a81acdc5888ea72889acdd285932a35a663de73306ecd6cfb35f4f0b90f0aaf25a103a37a15f65f655a6985a61b9070ff6184b07ae9a3

Download Submit
C:\Windows\mssecsvr.exe

Filesize
2.2MB

MD5
2dff9bae8c7d5e4a68c74c4f3467228a

SHA1
64a32e6a94f171eab63c73d5b8942d5191692895

SHA256
2ae575a134f05fc486845e302caf6407f2477c1527f15f42df7fb9953d5f197d

SHA512
7c0ff6d9aeea6cc2ca8a81acdc5888ea72889acdd285932a35a663de73306ecd6cfb35f4f0b90f0aaf25a103a37a15f65f655a6985a61b9070ff6184b07ae9a3

Download Submit
memory/1856-54-0x0000000000000000-mapping.dmp

Download
memory/1856-55-0x00000000756B1000-0x00000000756B3000-memory.dmp

Filesize
8KB

Download
memory/1944-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads