wannacry | c41fd8476e584fb994e234397446431e1bc7d08e30cc96dd080bc65c91a52406

General

Target
5091c8470383ab149157d9b645e6aaa5.dll
Size 5.0MB
Sample220720-defveabgdj
SHA256 c41fd8476e584fb994e234397446431e1bc7d08e30cc96dd080bc65c91a52406
MD5 5091c8470383ab149157d9b645e6aaa5
SHA1 a24a88aeb8d10fbef6cbba2805755b18db380711
SHA512 81db7c7420d39534eea2ed7ddbc1d55a50880a5c8574e680bd85795db2a1f42e151547adc755488740eb23abbbb406fdc1e00352159e9c7241f50d4475783d96
MD5 SHA1 SHA512

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3280) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Executes dropped EXE 3 IoCs

pid	Process
4112	mssecsvc.exe
4428	mssecsvc.exe
3544	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe
File created	C:\Windows\__tmp_rar_sfx_access_check_240553250	tasksche.exe
File created	C:\Windows\eee.exe	tasksche.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3536 wrote to memory of 3796	3536	rundll32.exe	76
PID 3536 wrote to memory of 3796	3536	rundll32.exe	76
PID 3536 wrote to memory of 3796	3536	rundll32.exe	76
PID 3796 wrote to memory of 4112	3796	rundll32.exe	77
PID 3796 wrote to memory of 4112	3796	rundll32.exe	77
PID 3796 wrote to memory of 4112	3796	rundll32.exe	77
PID 4112 wrote to memory of 3544	4112	mssecsvc.exe	79
PID 4112 wrote to memory of 3544	4112	mssecsvc.exe	79
PID 4112 wrote to memory of 3544	4112	mssecsvc.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5091c8470383ab149157d9b645e6aaa5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5091c8470383ab149157d9b645e6aaa5.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:3796
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:4112
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      PID:3544

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4428

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

2

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvc.exe

Path C:\WINDOWS\mssecsvc.exe
Size 3.6MB
SHA256 f43223e6b8df51d54d81fb6f4dfb8ad17274ae22b58f514870737019942d7a11
MD5 e13f14b004703cd9a0cf74b81e36eb0f
SHA1 855d017e3341490d288f7ff571c44b96d684682e
SHA512 a7af370dfb0e9f76cd65a5df2f20d430960725d0f181c572cf26b3c8fef8d927ddf44ea2b29102a41b9368775a6894af7cd685b27041ab22cb5de9e73a353da4
SSDEEP 49152:2nsEKUv0cBVQej/1ICRx+TSqTdX1HkQo6SAARdhnv:ysyvZBhz1hRxcSUDk36SAEdhv
MD5 SHA1 SHA512 SSDEEP

Submit Download

tasksche.exe

Path C:\WINDOWS\tasksche.exe
Size 2.0MB
SHA256 28c19226c6c403ba4a0d8078c2ab776a30b6c53e360bb8c74b0920b5b5316078
MD5 8edec9b3a6d0ca313387ef8a422fe458
SHA1 b733ad6b6a342cff3a4b91746d528528008b9029
SHA512 1514ebab0972f7b343f0897623099217c40aa5d6179f5ed6a82630d7a061e52827fcbcbc0f519c4727eb2f1ee87f295fc0346f185a1721fc4fb5767b06d8560a
SSDEEP 49152:XEKUv0cBVQej/1ICRx+TSqTdX1HkQo6SAARdhnvm:XyvZBhz1hRxcSUDk36SAEdhvm
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 f43223e6b8df51d54d81fb6f4dfb8ad17274ae22b58f514870737019942d7a11
MD5 e13f14b004703cd9a0cf74b81e36eb0f
SHA1 855d017e3341490d288f7ff571c44b96d684682e
SHA512 a7af370dfb0e9f76cd65a5df2f20d430960725d0f181c572cf26b3c8fef8d927ddf44ea2b29102a41b9368775a6894af7cd685b27041ab22cb5de9e73a353da4
SSDEEP 49152:2nsEKUv0cBVQej/1ICRx+TSqTdX1HkQo6SAARdhnv:ysyvZBhz1hRxcSUDk36SAEdhv
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 f43223e6b8df51d54d81fb6f4dfb8ad17274ae22b58f514870737019942d7a11
MD5 e13f14b004703cd9a0cf74b81e36eb0f
SHA1 855d017e3341490d288f7ff571c44b96d684682e
SHA512 a7af370dfb0e9f76cd65a5df2f20d430960725d0f181c572cf26b3c8fef8d927ddf44ea2b29102a41b9368775a6894af7cd685b27041ab22cb5de9e73a353da4
SSDEEP 49152:2nsEKUv0cBVQej/1ICRx+TSqTdX1HkQo6SAARdhnv:ysyvZBhz1hRxcSUDk36SAEdhv
MD5 SHA1 SHA512 SSDEEP

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 2.0MB
SHA256 28c19226c6c403ba4a0d8078c2ab776a30b6c53e360bb8c74b0920b5b5316078
MD5 8edec9b3a6d0ca313387ef8a422fe458
SHA1 b733ad6b6a342cff3a4b91746d528528008b9029
SHA512 1514ebab0972f7b343f0897623099217c40aa5d6179f5ed6a82630d7a061e52827fcbcbc0f519c4727eb2f1ee87f295fc0346f185a1721fc4fb5767b06d8560a
SSDEEP 49152:XEKUv0cBVQej/1ICRx+TSqTdX1HkQo6SAARdhnvm:XyvZBhz1hRxcSUDk36SAEdhvm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads