wannacry | 1c0c5c64a2269a0479814cafc612940ba1d842c95ca57974f66da0482b89ec4f

General

Target

88e1eb906b7b52fc9e553e8618fc75ba_JaffaCakes118.dll
Size

5.0MB
MD5

88e1eb906b7b52fc9e553e8618fc75ba
SHA1

afb8cdd9f4b7e482736e38a00b823dc17aa7285f
SHA256

1c0c5c64a2269a0479814cafc612940ba1d842c95ca57974f66da0482b89ec4f
SHA512

01b1b70a0f560e427eda3d22e1e1c9e2d5cff2f4436e9599cf2265b2ec93ead11d355b5598a7b29c94e31c0a5c630ff85ef09e8ac088e414cc0ad1acc86a7baf
SSDEEP

98304:TDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2iV:TDqPe1Cxcxk3ZAEUadzR8yc4O

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3162) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Executes dropped EXE 3 IoCs

Processes:

mssecsvc.exemssecsvc.exetasksche.exe

pid process

1740 mssecsvc.exe
2612 mssecsvc.exe
2628 tasksche.exe
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

pid	process
1740	mssecsvc.exe
2612	mssecsvc.exe
2628	tasksche.exe

Drops file in System32 directory 1 IoCs

Processes:

mssecsvc.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	mssecsvc.exe

Drops file in Windows directory 2 IoCs

Processes:

rundll32.exemssecsvc.exe

description ioc process

File created C:\WINDOWS\mssecsvc.exe rundll32.exe
File created C:\WINDOWS\tasksche.exe mssecsvc.exe

description	ioc	process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 24 IoCs

Processes:

mssecsvc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00dd000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5E87A428-798C-4E5F-B890-657F5DAF008D}\WpadNetworkName = "Network 3"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5E87A428-798C-4E5F-B890-657F5DAF008D}	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5E87A428-798C-4E5F-B890-657F5DAF008D}\WpadDecision = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5E87A428-798C-4E5F-B890-657F5DAF008D}\fe-99-13-52-c7-4d	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-99-13-52-c7-4d\WpadDecisionTime = 907e325ebcb3da01	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-99-13-52-c7-4d\WpadDecision = "0"	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5E87A428-798C-4E5F-B890-657F5DAF008D}\WpadDecisionTime = 907e325ebcb3da01	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5E87A428-798C-4E5F-B890-657F5DAF008D}\WpadDecisionReason = "1"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-99-13-52-c7-4d	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-99-13-52-c7-4d\WpadDecisionReason = "1"	mssecsvc.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2460 wrote to memory of 1764	2460	rundll32.exe	rundll32.exe
PID 2460 wrote to memory of 1764	2460	rundll32.exe	rundll32.exe
PID 2460 wrote to memory of 1764	2460	rundll32.exe	rundll32.exe
PID 2460 wrote to memory of 1764	2460	rundll32.exe	rundll32.exe
PID 2460 wrote to memory of 1764	2460	rundll32.exe	rundll32.exe
PID 2460 wrote to memory of 1764	2460	rundll32.exe	rundll32.exe
PID 2460 wrote to memory of 1764	2460	rundll32.exe	rundll32.exe
PID 1764 wrote to memory of 1740	1764	rundll32.exe	mssecsvc.exe
PID 1764 wrote to memory of 1740	1764	rundll32.exe	mssecsvc.exe
PID 1764 wrote to memory of 1740	1764	rundll32.exe	mssecsvc.exe
PID 1764 wrote to memory of 1740	1764	rundll32.exe	mssecsvc.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\88e1eb906b7b52fc9e553e8618fc75ba_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2460

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\88e1eb906b7b52fc9e553e8618fc75ba_JaffaCakes118.dll,#1
2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1764

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe
3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1740

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
4⤵
- Executes dropped EXE
PID:2628

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2612

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

2

T1046

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\mssecsvc.exe
Filesize
3.6MB

MD5
779b667c20fbf62faf9c7d8bc33c091c

SHA1
3a67d9f1a99c40847d6d8a0c48c1756fbebd7f80

SHA256
b1190c057b2547f2e0a92be6e9e516c77783e745a53db416b2dd33c435e8effb

SHA512
411d054af8a9bfd9d395d8b7215f6f7a8f0c0693af662062c4ab87bc2dc9de9326131b5cbb1c84ae95eb95ce173b2a19cad5d4973ed7b86fcd26fde72b9278ad

Download Submit
C:\Windows\tasksche.exe
Filesize
3.4MB

MD5
004bb5877da565bc4a68dc31379128e1

SHA1
5b0cdebd7c4568b6457b2013112f73a8b8285c23

SHA256
8d7f46ac465fee96db843f38a94eca73a0d314ece7174754323c965616452b5a

SHA512
394785ad0490f7cb065c8f6184a2ac70517301a5f16e65cf7a298432a9716059a7bd70d41afc136a023d417661cae763800da4c56d8c3a57a2ca396550e2cd19

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads