wannacry | e1fe02b7aedd39d08211ebc47b5af21a05f8be7a6cc2de2b20835f37a5919d37

General

Target
a48ca7b40ab2a6ebdd94dbd52164c6cf.dll
Size 5.0MB
Sample240321-nnapvsad75
SHA256 e1fe02b7aedd39d08211ebc47b5af21a05f8be7a6cc2de2b20835f37a5919d37
MD5 a48ca7b40ab2a6ebdd94dbd52164c6cf
SHA1 9203753bc934a2ae18c94b1127905f277316b481
SHA512 f028aedb790d2f1135a06ae5ba037e607a23b209aeb3115bc4f05a6bca7405136d92e7674ec2f3b115e93ab4cf487c74919c2824dc81406cfc13f0135b6ebcb0
SSDEEP 49152:RnGMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnv:1GPoBhz1aRxcSUDk36SAEdhv
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3176) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 2 IoCs

pid	Process
212	mssecsvr.exe
4552	mssecsvr.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	mssecsvr.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	mssecsvr.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	mssecsvr.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	mssecsvr.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvr.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvr.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	mssecsvr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	mssecsvr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	mssecsvr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	mssecsvr.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	4840	svchost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4172 wrote to memory of 4284	4172	rundll32.exe	88
PID 4172 wrote to memory of 4284	4172	rundll32.exe	88
PID 4172 wrote to memory of 4284	4172	rundll32.exe	88
PID 4284 wrote to memory of 212	4284	rundll32.exe	89
PID 4284 wrote to memory of 212	4284	rundll32.exe	89
PID 4284 wrote to memory of 212	4284	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a48ca7b40ab2a6ebdd94dbd52164c6cf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4172
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a48ca7b40ab2a6ebdd94dbd52164c6cf.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:4284
- - C:\WINDOWS\mssecsvr.exe
    C:\WINDOWS\mssecsvr.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:212

C:\WINDOWS\mssecsvr.exe
C:\WINDOWS\mssecsvr.exe -m security
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4552

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:1256

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

2

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvr.exe

Path C:\Windows\mssecsvr.exe
Size 2.2MB
SHA256 616edb95177a6f2025fe69cf69814a192c353ed6cf1bf1328dcfbd85526451e3
MD5 eb5022ab51a6b0321542d82ad6fd8998
SHA1 c05b1f611631ff96bcea894528d5a234dc148f95
SHA512 00e5ed43c62f0a1535f7f0c595bc38768fa9def02c10ac8fc3e99a713075cd861714d8cce3a69701e8d958a4554d6d209d7d962828395dfe380c72c4f6599f43
SSDEEP 49152:QnGMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvn:QGPoBhz1aRxcSUDk36SAEdhvn
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4840-6-0x000001D453C40000-0x000001D453C50000-memory.dmp

Download

memory/4840-22-0x000001D453D40000-0x000001D453D50000-memory.dmp

Download

memory/4840-38-0x000001D45C0B0000-0x000001D45C0B1000-memory.dmp

Download

memory/4840-40-0x000001D45C0E0000-0x000001D45C0E1000-memory.dmp

Download

memory/4840-41-0x000001D45C0E0000-0x000001D45C0E1000-memory.dmp

Download

memory/4840-42-0x000001D45C1F0000-0x000001D45C1F1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads