wannacry | a3c0ae3b078f2896377466f0d0296e862d886d09244344e72fec3016aa26285b

General

Target
391de298f50072b0b6fc5857a12ff386_JaffaCakes118.dll
Size 5.0MB
Sample240512-j3hlssfh8x
SHA256 a3c0ae3b078f2896377466f0d0296e862d886d09244344e72fec3016aa26285b
MD5 391de298f50072b0b6fc5857a12ff386
SHA1 d46ddb14cd772292020b3fb96e195a0d8e9c85a4
SHA512 02f24c1cd6229608ab8695eea967e63726cf9d69b9fe6249d17013afee05bb17da444ecc25ac6c35de47c41a40d896986ce0369d951ceeaf2c65c2d805589c74
SSDEEP 49152:pnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAA:9DqPoBhz1aRxcSUDk36SA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3170) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 3 IoCs

pid	Process
804	mssecsvc.exe
2532	mssecsvc.exe
2664	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	mssecsvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 24 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{8427941F-11B5-4B3F-ABB4-066F31080721}\WpadDecisionReason = "1"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{8427941F-11B5-4B3F-ABB4-066F31080721}\WpadDecision = "0"	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{8427941F-11B5-4B3F-ABB4-066F31080721}\WpadNetworkName = "Network 3"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\76-2c-0e-57-a7-6f	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\76-2c-0e-57-a7-6f\WpadDecisionReason = "1"	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\76-2c-0e-57-a7-6f\WpadDecisionTime = d0fbc20144a4da01	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\76-2c-0e-57-a7-6f\WpadDecision = "0"	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00fd000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{8427941F-11B5-4B3F-ABB4-066F31080721}	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{8427941F-11B5-4B3F-ABB4-066F31080721}\WpadDecisionTime = d0fbc20144a4da01	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{8427941F-11B5-4B3F-ABB4-066F31080721}\76-2c-0e-57-a7-6f	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 2196	2352	rundll32.exe	28
PID 2352 wrote to memory of 2196	2352	rundll32.exe	28
PID 2352 wrote to memory of 2196	2352	rundll32.exe	28
PID 2352 wrote to memory of 2196	2352	rundll32.exe	28
PID 2352 wrote to memory of 2196	2352	rundll32.exe	28
PID 2352 wrote to memory of 2196	2352	rundll32.exe	28
PID 2352 wrote to memory of 2196	2352	rundll32.exe	28
PID 2196 wrote to memory of 804	2196	rundll32.exe	29
PID 2196 wrote to memory of 804	2196	rundll32.exe	29
PID 2196 wrote to memory of 804	2196	rundll32.exe	29
PID 2196 wrote to memory of 804	2196	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\391de298f50072b0b6fc5857a12ff386_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\391de298f50072b0b6fc5857a12ff386_JaffaCakes118.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2196
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:804
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:2664

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

2

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 8959cb739e0a481a02a58abec28337bd4784565202f285462d139249528f0ad8
MD5 dcca9b252373d3bb50c77d4fc907ccc5
SHA1 c0c0f7c9556e0f1701ff5b9a85024a8465e6efe3
SHA512 e9130d89a34e319775db06642f6e29bfe89df28b00fc69864060114d8eb9538d3f4c1db7c9ad4c59e25c848a66ca983f641d5d9b973cbdc3b00fdffe2ba5c3d4
SSDEEP 49152:tnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAA2:hDqPoBhz1aRxcSUDk36SAB
MD5 SHA1 SHA512 SSDEEP

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 116af23f7b32a512fee8f982993005edc34cb973551b71fdb0c215b745f5b589
MD5 4010ed868053c1710ef899ba78a1b58e
SHA1 28ae50c078df192aea783cf011795d05ef4dbe54
SHA512 a80d0c83b36081f163394a559d3a0d2b468ddae87dd91f22b008197a54c142f17d751cb5f966c0b838b44c14294ab9fced79462b8b78a5cac109f7913a977413
SSDEEP 49152:nQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAA+:QqPoBhz1aRxcSUDk36SAx
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/804-7-0x0000000000400000-0x0000000000A72000-memory.dmp

Download

memory/804-15-0x0000000000400000-0x0000000000A72000-memory.dmp

Download

memory/2196-6-0x0000000002250000-0x00000000028C2000-memory.dmp

Download

memory/2532-9-0x0000000000400000-0x0000000000A72000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads