wannacry | 1e843da35f4ffa5118cabb17f0a339fd89141875c38bbaa18abb1105a77c779a

General

Target

183d59acfb1081bd87974feefe7ff7a1_JaffaCakes118.dll
Size

5.0MB
MD5

183d59acfb1081bd87974feefe7ff7a1
SHA1

5eea1742ce3694b8fc00db428c77b1edaf28fe79
SHA256

1e843da35f4ffa5118cabb17f0a339fd89141875c38bbaa18abb1105a77c779a
SHA512

4468dfbe1f0f0b26f65879a20308fb1b0daa832db6531553e962241c8bde336727453af0d9b0802b463f2d616a92c46b657e2f03d50f4eef975ea31c576fea6f
SSDEEP

49152:SnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAAjCx1cEeeCtM:+DqPoBhz1aRxcSUDk36SA3xyE1Ce

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3013) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Executes dropped EXE 3 IoCs

Processes:

mssecsvc.exemssecsvc.exetasksche.exe

pid process

2412 mssecsvc.exe
2476 mssecsvc.exe
2576 tasksche.exe
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

pid	process
2412	mssecsvc.exe
2476	mssecsvc.exe
2576	tasksche.exe

Drops file in System32 directory 1 IoCs

Processes:

mssecsvc.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	mssecsvc.exe

Drops file in Windows directory 2 IoCs

Processes:

rundll32.exemssecsvc.exe

description ioc process

File created C:\WINDOWS\mssecsvc.exe rundll32.exe
File created C:\WINDOWS\tasksche.exe mssecsvc.exe

description	ioc	process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 24 IoCs

Processes:

mssecsvc.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9DCF05A0-8F7B-4B9B-8D02-882E3DA5E092}	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9DCF05A0-8F7B-4B9B-8D02-882E3DA5E092}\WpadDecisionReason = "1"	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9DCF05A0-8F7B-4B9B-8D02-882E3DA5E092}\WpadDecisionTime = 50028cd0fd9eda01	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9DCF05A0-8F7B-4B9B-8D02-882E3DA5E092}\WpadDecision = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-1b-e0-db-da-20	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-1b-e0-db-da-20\WpadDecisionTime = 50028cd0fd9eda01	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-1b-e0-db-da-20\WpadDecision = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9DCF05A0-8F7B-4B9B-8D02-882E3DA5E092}\WpadNetworkName = "Network 3"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9DCF05A0-8F7B-4B9B-8D02-882E3DA5E092}\fe-1b-e0-db-da-20	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-1b-e0-db-da-20\WpadDecisionReason = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f008a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1400 wrote to memory of 2172	1400	rundll32.exe	rundll32.exe
PID 1400 wrote to memory of 2172	1400	rundll32.exe	rundll32.exe
PID 1400 wrote to memory of 2172	1400	rundll32.exe	rundll32.exe
PID 1400 wrote to memory of 2172	1400	rundll32.exe	rundll32.exe
PID 1400 wrote to memory of 2172	1400	rundll32.exe	rundll32.exe
PID 1400 wrote to memory of 2172	1400	rundll32.exe	rundll32.exe
PID 1400 wrote to memory of 2172	1400	rundll32.exe	rundll32.exe
PID 2172 wrote to memory of 2412	2172	rundll32.exe	mssecsvc.exe
PID 2172 wrote to memory of 2412	2172	rundll32.exe	mssecsvc.exe
PID 2172 wrote to memory of 2412	2172	rundll32.exe	mssecsvc.exe
PID 2172 wrote to memory of 2412	2172	rundll32.exe	mssecsvc.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\183d59acfb1081bd87974feefe7ff7a1_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1400

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\183d59acfb1081bd87974feefe7ff7a1_JaffaCakes118.dll,#1
2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2172

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe
3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2412

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
4⤵
- Executes dropped EXE
PID:2576

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

2

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\mssecsvc.exe
Filesize
3.6MB

MD5
e4826055bfcb99b37334d41394b3c1e2

SHA1
633d93152a33dd3503509c2035ebbfb168c0a327

SHA256
dfc5db20cdc2e816a168e3c5545ed774861afdc0a2b186b99d41ef3e1cbb28f8

SHA512
f0f830156d14ebd391e256c418d536b7dbc65e830278871793bc04c1b94b8a3a20b526c9e99bd4191fab05223d3487cbf80e79e2bdfdedec54fc58b12870b5fb

Download Submit
C:\Windows\tasksche.exe
Filesize
3.4MB

MD5
cd654c087ff5cb6489414a7df2ed72e2

SHA1
f832df763d59669b3391d69c8b5f2631bde2d2c3

SHA256
7538150899f044a294d70331a6d625a7e2f59e7edcc01079f5684d5b7fa70fca

SHA512
70f65a050f785b7e79a7c2425db2aa92c73391fc8109b49064e855c7f0ea78d352d827696029729fa55458e0a825beec0c10de74a713e8286c2ab5f7087f894e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads