wannacry | b5d543c8a8334519f013bb236d43d0561088b52b0d5602ea9b58fc453f2c4156

General

Target
98df58e71b5202e49ba6f9e6e43ef6ef.dll
Size 5.0MB
Sample221222-kz15eaeb82
SHA256 b5d543c8a8334519f013bb236d43d0561088b52b0d5602ea9b58fc453f2c4156
MD5 98df58e71b5202e49ba6f9e6e43ef6ef
SHA1 7ee6e1082c30108ae631c6193878195c1abe7112
SHA512 1eba0f2e6f38cf4b53c84926396a0a18f0e524bbea3fc2fcd9326c43a001ae9bfb80556ce07c489dae09b8e4830c89276589cb208f23a5aa78776a01c692520b
SSDEEP 49152:RnpENbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnv:1p+oBhz1aRxcSUDk36SAEdhv
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry

Executes dropped EXE 3 IoCs

pid	Process
3648	mssecsvr.exe
3408	mssecsvr.exe
712	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\__tmp_rar_sfx_access_check_240557718	tasksche.exe
File created	C:\Windows\eee.exe	tasksche.exe
File created	C:\WINDOWS\mssecsvr.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvr.exe

Modifies data under HKEY_USERS 12 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvr.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 764 wrote to memory of 376	764	rundll32.exe	80
PID 764 wrote to memory of 376	764	rundll32.exe	80
PID 764 wrote to memory of 376	764	rundll32.exe	80
PID 376 wrote to memory of 3648	376	rundll32.exe	81
PID 376 wrote to memory of 3648	376	rundll32.exe	81
PID 376 wrote to memory of 3648	376	rundll32.exe	81
PID 3648 wrote to memory of 712	3648	mssecsvr.exe	83
PID 3648 wrote to memory of 712	3648	mssecsvr.exe	83
PID 3648 wrote to memory of 712	3648	mssecsvr.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\98df58e71b5202e49ba6f9e6e43ef6ef.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:764
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\98df58e71b5202e49ba6f9e6e43ef6ef.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:376
- - C:\WINDOWS\mssecsvr.exe
    C:\WINDOWS\mssecsvr.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:3648
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      PID:712

C:\WINDOWS\mssecsvr.exe
C:\WINDOWS\mssecsvr.exe -m security
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:3408

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

1

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvr.exe

Path C:\WINDOWS\mssecsvr.exe
Size 2.2MB
SHA256 528ea2825f49b83a9d2774233e46ce145f09c1c2daf1cb0fa251d406c38bc851
MD5 06f05fa7206b546118253c33d60541dc
SHA1 b27f9dc8394423c38591367a87827b5e51d31719
SHA512 df5e762182346f090ca912c8a5149ad08c47addd57bf453a0b88b052d1deeb0024efc1af680c6e8b024c24a3d2a1dc8e375eebc3aa16e4b87346d5de2c0a87d3
SSDEEP 49152:QnpENbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvn:Qp+oBhz1aRxcSUDk36SAEdhvn
MD5 SHA1 SHA512 SSDEEP

Submit Download

tasksche.exe

Path C:\WINDOWS\tasksche.exe
Size 2.0MB
SHA256 486a1da92d0a86066de7714104451c10051432c6eb357b7cd04125b685f43f63
MD5 06773c385b9f9a55b70067ed1d5739de
SHA1 3e65f2c71708e103e7036a2f877ebcc88063c67b
SHA512 ae728eb69c5da7208a240e50d99ffbde0282ebf8291d130e3417357074dc1efa3c397e9f4ae2e7b20ff05fa9e7353cfc76167234fcc21a223a34b30701acc075
SSDEEP 49152:XENbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvm:X+oBhz1aRxcSUDk36SAEdhvm
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvr.exe

Path C:\Windows\mssecsvr.exe
Size 2.2MB
SHA256 528ea2825f49b83a9d2774233e46ce145f09c1c2daf1cb0fa251d406c38bc851
MD5 06f05fa7206b546118253c33d60541dc
SHA1 b27f9dc8394423c38591367a87827b5e51d31719
SHA512 df5e762182346f090ca912c8a5149ad08c47addd57bf453a0b88b052d1deeb0024efc1af680c6e8b024c24a3d2a1dc8e375eebc3aa16e4b87346d5de2c0a87d3
SSDEEP 49152:QnpENbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvn:Qp+oBhz1aRxcSUDk36SAEdhvn
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvr.exe

Path C:\Windows\mssecsvr.exe
Size 2.2MB
SHA256 528ea2825f49b83a9d2774233e46ce145f09c1c2daf1cb0fa251d406c38bc851
MD5 06f05fa7206b546118253c33d60541dc
SHA1 b27f9dc8394423c38591367a87827b5e51d31719
SHA512 df5e762182346f090ca912c8a5149ad08c47addd57bf453a0b88b052d1deeb0024efc1af680c6e8b024c24a3d2a1dc8e375eebc3aa16e4b87346d5de2c0a87d3
SSDEEP 49152:QnpENbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvn:Qp+oBhz1aRxcSUDk36SAEdhvn
MD5 SHA1 SHA512 SSDEEP

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 2.0MB
SHA256 486a1da92d0a86066de7714104451c10051432c6eb357b7cd04125b685f43f63
MD5 06773c385b9f9a55b70067ed1d5739de
SHA1 3e65f2c71708e103e7036a2f877ebcc88063c67b
SHA512 ae728eb69c5da7208a240e50d99ffbde0282ebf8291d130e3417357074dc1efa3c397e9f4ae2e7b20ff05fa9e7353cfc76167234fcc21a223a34b30701acc075
SSDEEP 49152:XENbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvm:X+oBhz1aRxcSUDk36SAEdhvm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads