wannacry | 0e1ab75ab474f63458548f47eaa4f81564a8259adb2514db69154ba1ae3f5248

General

Target

1307057e6fadcf0d67764b9b44a679f9_JaffaCakes118.dll
Size

5.0MB
MD5

1307057e6fadcf0d67764b9b44a679f9
SHA1

4613beaee1e9b76a80fe801e1f60be094e7dcea7
SHA256

0e1ab75ab474f63458548f47eaa4f81564a8259adb2514db69154ba1ae3f5248
SHA512

9abf5383d89d6dfd4cd3b4ebe27e0724a3d1c7e131c49f48c5f57e5d3bbacc7f36842e146da421d49a544332fdc8b6ef6a692155ba662976ade3eba805261b6c
SSDEEP

98304:TDqPoBhz1aRxcSUDk36SAEdhvxWa9P593e/:TDqPe1Cxcxk3ZAEUadze/

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3259) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 3 IoCs

pid	Process
2936	mssecsvc.exe
2796	mssecsvc.exe
2660	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	mssecsvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 24 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a2-13-92-9e-a4-c3\WpadDecisionTime = e04c85102c9eda01	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a2-13-92-9e-a4-c3\WpadDecisionReason = "1"	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E97642A1-EA6C-47D0-ADFB-7C153167EBD7}\WpadDecisionReason = "1"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a2-13-92-9e-a4-c3	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E97642A1-EA6C-47D0-ADFB-7C153167EBD7}\a2-13-92-9e-a4-c3	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E97642A1-EA6C-47D0-ADFB-7C153167EBD7}\WpadDecision = "0"	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E97642A1-EA6C-47D0-ADFB-7C153167EBD7}\WpadNetworkName = "Network 3"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a2-13-92-9e-a4-c3\WpadDecision = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E97642A1-EA6C-47D0-ADFB-7C153167EBD7}	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E97642A1-EA6C-47D0-ADFB-7C153167EBD7}\WpadDecisionTime = e04c85102c9eda01	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0103000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 2688	1952	rundll32.exe	28
PID 1952 wrote to memory of 2688	1952	rundll32.exe	28
PID 1952 wrote to memory of 2688	1952	rundll32.exe	28
PID 1952 wrote to memory of 2688	1952	rundll32.exe	28
PID 1952 wrote to memory of 2688	1952	rundll32.exe	28
PID 1952 wrote to memory of 2688	1952	rundll32.exe	28
PID 1952 wrote to memory of 2688	1952	rundll32.exe	28
PID 2688 wrote to memory of 2936	2688	rundll32.exe	29
PID 2688 wrote to memory of 2936	2688	rundll32.exe	29
PID 2688 wrote to memory of 2936	2688	rundll32.exe	29
PID 2688 wrote to memory of 2936	2688	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1307057e6fadcf0d67764b9b44a679f9_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1307057e6fadcf0d67764b9b44a679f9_JaffaCakes118.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:2936
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:2660

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

2

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\mssecsvc.exe

Filesize
3.6MB

MD5
29696311e8e276907d46ff93387e4d64

SHA1
7efca2527e5d143226f6b1f7cbb46ac5461df68f

SHA256
ea3ccc9228b5715ee494cf48ac3e16e7083a819327f078b4de11e2bd97011026

SHA512
e86cde7699d8cd0dc7b83dec7ac4a0aceb8ba4063d34273fe8262be3e1677b0f9af07dd751daef175fc0131952cac05fee5f8ad30323628cb3bcef530f1759ad

Download Submit
C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
37a6bb3b2972bb680119b16b231bc500

SHA1
7932eb4f9e6a10a551de47ef35f39cf9283300ef

SHA256
39e432a8eac4cfbb092bb4abba6911b88acbdfc52f9610b9dbf595b4d5f4b726

SHA512
be846abb162f53bab50073c9903c8a1c0ddc11e6d8a6da12dd52cdba71ecb233acf561a6b1b2d3a7a95acd122f005dbb14a80f017170c703eb486575c637236d

Download Submit

Resubmissions

Analysis

Sharing