wannacry | cb5120bb8f471051d3ec31ce6b27aae8c2a4537cf2e528f2bfd08cfe2310a804

General

Target

76997e1a25b7ad5d8ed286532f05c578_JaffaCakes118.dll
Size

5.0MB
MD5

76997e1a25b7ad5d8ed286532f05c578
SHA1

5c1f74b3d95171f8f3415a0f32aeaad6387f83fd
SHA256

cb5120bb8f471051d3ec31ce6b27aae8c2a4537cf2e528f2bfd08cfe2310a804
SHA512

52b2e33b24e403edff6690a2ce80575213cacdc7ea0de73bcfc3cf46ce5147bc45e40bcfc15a842b630c7edbdd2ea3e5c4c293c868c400bf34910d533802b077
SSDEEP

49152:SnAQqMSPbcBVQej/1INRx+TSqTdOxJM0H9PAMEcaEau3R8yAH1plA:+DqPoBhz1aRxcSUwxWa9P593R8yAVp2

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3141) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Executes dropped EXE 3 IoCs

Processes:

mssecsvc.exemssecsvc.exetasksche.exe

pid process

2052 mssecsvc.exe
2956 mssecsvc.exe
2584 tasksche.exe
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

pid	process
2052	mssecsvc.exe
2956	mssecsvc.exe
2584	tasksche.exe

Drops file in System32 directory 1 IoCs

Processes:

mssecsvc.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	mssecsvc.exe

Drops file in Windows directory 2 IoCs

Processes:

rundll32.exemssecsvc.exe

description ioc process

File created C:\WINDOWS\mssecsvc.exe rundll32.exe
File created C:\WINDOWS\tasksche.exe mssecsvc.exe

description	ioc	process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 24 IoCs

Processes:

mssecsvc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A4877036-7BA5-424E-A337-371AA4D3D5B4}\WpadDecisionReason = "1"	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f007e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-16-0e-00-7c-ec	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A4877036-7BA5-424E-A337-371AA4D3D5B4}\72-16-0e-00-7c-ec	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-16-0e-00-7c-ec\WpadDecisionTime = c066528da4afda01	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-16-0e-00-7c-ec\WpadDecision = "0"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-16-0e-00-7c-ec\WpadDecisionReason = "1"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A4877036-7BA5-424E-A337-371AA4D3D5B4}	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A4877036-7BA5-424E-A337-371AA4D3D5B4}\WpadDecisionTime = c066528da4afda01	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A4877036-7BA5-424E-A337-371AA4D3D5B4}\WpadDecision = "0"	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A4877036-7BA5-424E-A337-371AA4D3D5B4}\WpadNetworkName = "Network 3"	mssecsvc.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2032 wrote to memory of 1728	2032	rundll32.exe	rundll32.exe
PID 2032 wrote to memory of 1728	2032	rundll32.exe	rundll32.exe
PID 2032 wrote to memory of 1728	2032	rundll32.exe	rundll32.exe
PID 2032 wrote to memory of 1728	2032	rundll32.exe	rundll32.exe
PID 2032 wrote to memory of 1728	2032	rundll32.exe	rundll32.exe
PID 2032 wrote to memory of 1728	2032	rundll32.exe	rundll32.exe
PID 2032 wrote to memory of 1728	2032	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 2052	1728	rundll32.exe	mssecsvc.exe
PID 1728 wrote to memory of 2052	1728	rundll32.exe	mssecsvc.exe
PID 1728 wrote to memory of 2052	1728	rundll32.exe	mssecsvc.exe
PID 1728 wrote to memory of 2052	1728	rundll32.exe	mssecsvc.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\76997e1a25b7ad5d8ed286532f05c578_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\76997e1a25b7ad5d8ed286532f05c578_JaffaCakes118.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1728
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:2052
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:2584

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

2

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\mssecsvc.exe

Filesize
3.6MB

MD5
2388424c4d909c563530cc48ba88fefc

SHA1
8b71168f0821a786afb33c51333f1e51923eef31

SHA256
603e42df45a1f65fb4dae4182ec9abd55796d2bf9005c46f668f079dfac67667

SHA512
b5cd28088f54d4ed2ceb5a88f383a62f3d4557e3ac741c01b94379662160122b8571ae860dc96e301caa2dd3b581c9da497045cfe3601fa41472a05abefbed31

Download Submit
C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
e0264a5e7efc1def40b0415b14c0d4be

SHA1
a109d562b06d548151fc0cdaf4f4b1045f6f0ef3

SHA256
64861559ee089d87f8f0983f08c2db874e36640a081c860a81fdb5f5b85cef0c

SHA512
060d82b0cda057f401c10688b1c12366572260b65499d8ed19b7bdc7d320adf3d00689d749b8ccdbb6722cdf084568fecbc132695d9435409fd96d5b104862b8

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads