wannacry | 5810c7be87e79ff5f358d7867aaa05c53b76319cc88fe04b1f548fac05504867

General

Target
1fc89ece03929425de3ecd437fe74c39.dll
Size 5.0MB
Sample220720-cy6phabaa3
SHA256 5810c7be87e79ff5f358d7867aaa05c53b76319cc88fe04b1f548fac05504867
MD5 1fc89ece03929425de3ecd437fe74c39
SHA1 8f49425dbaa464cdeccf4e397828b9a2130e6447
SHA512 e21b4cc0e1d3dcb5ac95be9676dbac5003f2be2202356864e2eb12c04bb4b6c08c30c329a3c505f6296b9db77802300f9ead4e12205d6a30835a674c07be59c0
MD5 SHA1 SHA512

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3050) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Executes dropped EXE 3 IoCs

pid	Process
4928	mssecsvc.exe
4648	mssecsvc.exe
4204	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
112	4204	WerFault.exe	85

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 4316	4588	rundll32.exe	82
PID 4588 wrote to memory of 4316	4588	rundll32.exe	82
PID 4588 wrote to memory of 4316	4588	rundll32.exe	82
PID 4316 wrote to memory of 4928	4316	rundll32.exe	83
PID 4316 wrote to memory of 4928	4316	rundll32.exe	83
PID 4316 wrote to memory of 4928	4316	rundll32.exe	83
PID 4928 wrote to memory of 4204	4928	mssecsvc.exe	85
PID 4928 wrote to memory of 4204	4928	mssecsvc.exe	85
PID 4928 wrote to memory of 4204	4928	mssecsvc.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1fc89ece03929425de3ecd437fe74c39.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1fc89ece03929425de3ecd437fe74c39.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:4316
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:4928
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:4204
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 596
        5⤵
        Program crash
        
        PID:112

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4204 -ip 4204
1⤵
PID:4584

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

2

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvc.exe

Path C:\WINDOWS\mssecsvc.exe
Size 3.6MB
SHA256 ea5ca0a67857fc81967232a8a42f49c1cc590deee996f6e44967459b9dafae59
MD5 c492f8037a1c4a60cb35e9cdb42b837a
SHA1 8f09727837d3ead326185bc64692cb8ee5c610c2
SHA512 e0e4a15843721113596a3ef9f8a78adeff2f8452e77fa533a4f6c9dc5993fc9ee8a1c0dd76c304f3e8c5cba9ddc4bc5c8c5a2f7808b8585ddbc3b49f3a4ef9f4
SSDEEP 98304:ywOoBhz1aRxcSUDk36SAEdhv7m3MOujtDZnhf/Bg:ybe1Cxcxk3ZAErlFB5g
MD5 SHA1 SHA512 SSDEEP

Submit Download

tasksche.exe

Path C:\WINDOWS\tasksche.exe
Size 2.0MB
SHA256 d3e3c54a4d3eb9174afdfb87ac48d17845760cc2f0f4d4f73f69f7290f3d06a5
MD5 52f8fc1480109b39f566aa0a0ae599d6
SHA1 0d9e0316b2e78b81fb125d2e2dcc4828ece88c22
SHA512 ce841b87b64b43bd77e75768086b0d1201a4584d9b713ac4287e8553461e24654da2dc3f3453b742ae902a941fc4df47765135895b89acd5ff693a7fdb9de026
SSDEEP 49152:DEhPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvm:DOoBhz1aRxcSUDk36SAEdhvm
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 ea5ca0a67857fc81967232a8a42f49c1cc590deee996f6e44967459b9dafae59
MD5 c492f8037a1c4a60cb35e9cdb42b837a
SHA1 8f09727837d3ead326185bc64692cb8ee5c610c2
SHA512 e0e4a15843721113596a3ef9f8a78adeff2f8452e77fa533a4f6c9dc5993fc9ee8a1c0dd76c304f3e8c5cba9ddc4bc5c8c5a2f7808b8585ddbc3b49f3a4ef9f4
SSDEEP 98304:ywOoBhz1aRxcSUDk36SAEdhv7m3MOujtDZnhf/Bg:ybe1Cxcxk3ZAErlFB5g
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 ea5ca0a67857fc81967232a8a42f49c1cc590deee996f6e44967459b9dafae59
MD5 c492f8037a1c4a60cb35e9cdb42b837a
SHA1 8f09727837d3ead326185bc64692cb8ee5c610c2
SHA512 e0e4a15843721113596a3ef9f8a78adeff2f8452e77fa533a4f6c9dc5993fc9ee8a1c0dd76c304f3e8c5cba9ddc4bc5c8c5a2f7808b8585ddbc3b49f3a4ef9f4
SSDEEP 98304:ywOoBhz1aRxcSUDk36SAEdhv7m3MOujtDZnhf/Bg:ybe1Cxcxk3ZAErlFB5g
MD5 SHA1 SHA512 SSDEEP

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 2.0MB
SHA256 d3e3c54a4d3eb9174afdfb87ac48d17845760cc2f0f4d4f73f69f7290f3d06a5
MD5 52f8fc1480109b39f566aa0a0ae599d6
SHA1 0d9e0316b2e78b81fb125d2e2dcc4828ece88c22
SHA512 ce841b87b64b43bd77e75768086b0d1201a4584d9b713ac4287e8553461e24654da2dc3f3453b742ae902a941fc4df47765135895b89acd5ff693a7fdb9de026
SSDEEP 49152:DEhPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvm:DOoBhz1aRxcSUDk36SAEdhvm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads