wannacry | 9a840996e18efb6729cf0b2f5c53b251dcccfffee9874bdd3626d8ba9c6180f0

General

Target

d33512decfb5f2c8c423e5bd627bcdc8.dll
Size

5.0MB
MD5

d33512decfb5f2c8c423e5bd627bcdc8
SHA1

8675d0fa059e1fbc2e228f04ab9e80fe3e60b2d2
SHA256

9a840996e18efb6729cf0b2f5c53b251dcccfffee9874bdd3626d8ba9c6180f0
SHA512

655f16fec02571e19e6ac3be8a7f6160fb5aff79541f345e14fd8cf341823db525d24a40f584e6e631f072331897d657fb5cc8dbd89d18924521804489f61a02

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (1290) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Executes dropped EXE 3 IoCs

Processes:

mssecsvc.exemssecsvc.exetasksche.exe

pid process

1276 mssecsvc.exe
804 mssecsvc.exe
1684 tasksche.exe

pid	process
1276	mssecsvc.exe
804	mssecsvc.exe
1684	tasksche.exe

Drops file in System32 directory 1 IoCs

Processes:

mssecsvc.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	mssecsvc.exe

Drops file in Windows directory 2 IoCs

Processes:

rundll32.exemssecsvc.exe

description ioc process

File created C:\WINDOWS\mssecsvc.exe rundll32.exe
File created C:\WINDOWS\tasksche.exe mssecsvc.exe

description	ioc	process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 24 IoCs

Processes:

mssecsvc.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0106000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{05FF3AD9-38FC-4FD0-80CD-1D1125A655A4}\WpadDecisionTime = 10e6d001e49bd801	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-aa-4e-dd-1d-f6	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{05FF3AD9-38FC-4FD0-80CD-1D1125A655A4}\d6-aa-4e-dd-1d-f6	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{05FF3AD9-38FC-4FD0-80CD-1D1125A655A4}\WpadNetworkName = "Network 3"	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-aa-4e-dd-1d-f6\WpadDecisionTime = 10e6d001e49bd801	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{05FF3AD9-38FC-4FD0-80CD-1D1125A655A4}	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{05FF3AD9-38FC-4FD0-80CD-1D1125A655A4}\WpadDecisionReason = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{05FF3AD9-38FC-4FD0-80CD-1D1125A655A4}\WpadDecision = "0"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-aa-4e-dd-1d-f6\WpadDecisionReason = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-aa-4e-dd-1d-f6\WpadDecision = "0"	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2004 wrote to memory of 888	2004	rundll32.exe	rundll32.exe
PID 2004 wrote to memory of 888	2004	rundll32.exe	rundll32.exe
PID 2004 wrote to memory of 888	2004	rundll32.exe	rundll32.exe
PID 2004 wrote to memory of 888	2004	rundll32.exe	rundll32.exe
PID 2004 wrote to memory of 888	2004	rundll32.exe	rundll32.exe
PID 2004 wrote to memory of 888	2004	rundll32.exe	rundll32.exe
PID 2004 wrote to memory of 888	2004	rundll32.exe	rundll32.exe
PID 888 wrote to memory of 1276	888	rundll32.exe	mssecsvc.exe
PID 888 wrote to memory of 1276	888	rundll32.exe	mssecsvc.exe
PID 888 wrote to memory of 1276	888	rundll32.exe	mssecsvc.exe
PID 888 wrote to memory of 1276	888	rundll32.exe	mssecsvc.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d33512decfb5f2c8c423e5bd627bcdc8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2004

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d33512decfb5f2c8c423e5bd627bcdc8.dll,#1
2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:888

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe
3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1276

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
4⤵
- Executes dropped EXE
PID:1684

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:804

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

1

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\mssecsvc.exe

Filesize
3.6MB

MD5
2863611c1b10c05572f38f38b669b800

SHA1
55d54bacab6358e98daca2b75f4e2945f4d376c7

SHA256
9eb7dccba1ca32e3528218ac3ece6705b7ac0c18c4d2ffa177d012557efddcb2

SHA512
77ffc098a1bbc709a71fd166c602b517a050e5b26d74dbd0c94f31e7a71421505717c95bfd46f83c182e94a9bac0ec194ac077eac81b06ef7884a6d3f6467fbb

Download Submit
C:\Windows\mssecsvc.exe

Filesize
3.6MB

MD5
2863611c1b10c05572f38f38b669b800

SHA1
55d54bacab6358e98daca2b75f4e2945f4d376c7

SHA256
9eb7dccba1ca32e3528218ac3ece6705b7ac0c18c4d2ffa177d012557efddcb2

SHA512
77ffc098a1bbc709a71fd166c602b517a050e5b26d74dbd0c94f31e7a71421505717c95bfd46f83c182e94a9bac0ec194ac077eac81b06ef7884a6d3f6467fbb

Download Submit
C:\Windows\mssecsvc.exe

Filesize
3.6MB

MD5
2863611c1b10c05572f38f38b669b800

SHA1
55d54bacab6358e98daca2b75f4e2945f4d376c7

SHA256
9eb7dccba1ca32e3528218ac3ece6705b7ac0c18c4d2ffa177d012557efddcb2

SHA512
77ffc098a1bbc709a71fd166c602b517a050e5b26d74dbd0c94f31e7a71421505717c95bfd46f83c182e94a9bac0ec194ac077eac81b06ef7884a6d3f6467fbb

Download Submit
C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
33597668502c3bf358c8006e932f8a4e

SHA1
a84bf3fade231e537c7ec98661555b90be18eb22

SHA256
15f7bb33ab359936d36b2873bb559da97c5635ad704f9e0e79020145058e9a65

SHA512
b5adf4cd47b3612533925d62a06388dd68ef2162ec1d78ea870b1d0b0539722c62b8cc856b2637cf584b6fdfbe0023e140b1e0e060b1a6374f514ca576fa9cf9

Download Submit
memory/888-54-0x0000000000000000-mapping.dmp

Download
memory/888-55-0x00000000762A1000-0x00000000762A3000-memory.dmp

Filesize
8KB

Download
memory/1276-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads