wannacry | 396dd4f9315945f760e943f01b2d8a3ba0c2ccbfdb5a710b8f8cf792b546d493

General

Target

a8f823503d00a4109daae94eaca52d01_JaffaCakes118.dll
Size

5.0MB
MD5

a8f823503d00a4109daae94eaca52d01
SHA1

1cc861a4b4fe676c23f661fdfc46e1b0fd33c9a4
SHA256

396dd4f9315945f760e943f01b2d8a3ba0c2ccbfdb5a710b8f8cf792b546d493
SHA512

7250b2d16edae7e02b0fc0af3e6b20d4c193070526d8d84b3709d68985318f4413817fb32d92336c83ae2398d05e18817a79d0f3dc391b66f7259585a4f9d0ed
SSDEEP

49152:znAQqMSCNRx+TSqTdX1HkQo6SAARdhnvxJM0H9PAMEcaEau3:TDqgRxcSUDk36SAEdhvxWa9P593

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3161) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Executes dropped EXE 3 IoCs

Processes:

mssecsvc.exemssecsvc.exetasksche.exe

pid process

2328 mssecsvc.exe
2624 mssecsvc.exe
2720 tasksche.exe
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

pid	process
2328	mssecsvc.exe
2624	mssecsvc.exe
2720	tasksche.exe

Drops file in System32 directory 1 IoCs

Processes:

mssecsvc.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	mssecsvc.exe

Drops file in Windows directory 2 IoCs

Processes:

rundll32.exemssecsvc.exe

description ioc process

File created C:\WINDOWS\mssecsvc.exe rundll32.exe
File created C:\WINDOWS\tasksche.exe mssecsvc.exe

description	ioc	process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 24 IoCs

Processes:

mssecsvc.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00c1000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\92-05-8b-bf-89-06	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{34D5B593-5A46-4C36-AF10-36B0F433E1BE}\WpadDecisionTime = b044c13a3dbeda01	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\92-05-8b-bf-89-06\WpadDecision = "0"	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{34D5B593-5A46-4C36-AF10-36B0F433E1BE}\WpadNetworkName = "Network 3"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{34D5B593-5A46-4C36-AF10-36B0F433E1BE}	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{34D5B593-5A46-4C36-AF10-36B0F433E1BE}\WpadDecisionReason = "1"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{34D5B593-5A46-4C36-AF10-36B0F433E1BE}\92-05-8b-bf-89-06	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\92-05-8b-bf-89-06\WpadDecisionReason = "1"	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\92-05-8b-bf-89-06\WpadDecisionTime = b044c13a3dbeda01	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{34D5B593-5A46-4C36-AF10-36B0F433E1BE}\WpadDecision = "0"	mssecsvc.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2040 wrote to memory of 2324	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 2324	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 2324	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 2324	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 2324	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 2324	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 2324	2040	rundll32.exe	rundll32.exe
PID 2324 wrote to memory of 2328	2324	rundll32.exe	mssecsvc.exe
PID 2324 wrote to memory of 2328	2324	rundll32.exe	mssecsvc.exe
PID 2324 wrote to memory of 2328	2324	rundll32.exe	mssecsvc.exe
PID 2324 wrote to memory of 2328	2324	rundll32.exe	mssecsvc.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a8f823503d00a4109daae94eaca52d01_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a8f823503d00a4109daae94eaca52d01_JaffaCakes118.dll,#1
2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2324

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe
3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2328

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
4⤵
- Executes dropped EXE
PID:2720

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

2

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\mssecsvc.exe

Filesize
3.6MB

MD5
db748a2b115c816e15c9581df5ac464e

SHA1
7576c96193e26bc44dcd4bfabdb2a9716d9438e4

SHA256
b691fa1e6cf4a5d14ac7dd55d8e5ec9421ad8fba6d31f6102da3f3ba9d2c1f09

SHA512
366c7c76ebfa5a3fddf11b583295ac34035e38dc71ee4ab9fe7cec9e4efd029f0d44bf9ccb1ee6c25be8945c79a5a39be358d41310436ea0289ff1aca88b22f7

Download Submit
C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
da00941503e61f0d9d0fe5431cb9e5e1

SHA1
0cf1e1cd804613e0b8e17e874e1270c81ebfb199

SHA256
3c4f89b8592fd9bc70ad56ece32f8ce4e701c42edfe521f00e47d844ea9f9299

SHA512
f86cce23d0d511d60ba4487c4d84d5b45f837035de9e3582548ad728422c0ba063138738e07abc8956904805b94ad6de4d51eebcd5448b005625d344cedddb67

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads