wannacry | cd2db616d0aefceb729ef987e39e51dd4689d8648b7d7bec8fbb0bf23976e1f7

General

Target

b4574e300787f055071ae787374f1e5d_JaffaCakes118.dll
Size

5.0MB
MD5

b4574e300787f055071ae787374f1e5d
SHA1

129291eb7176b286206008612539583f6302f69a
SHA256

cd2db616d0aefceb729ef987e39e51dd4689d8648b7d7bec8fbb0bf23976e1f7
SHA512

92f7a4e0b483eec0d9f1bdd5f76b8bdc3d736288b26baea175e51dc8993a0d757cb916cea57a95b4f27f44098b8f5b118902642e433fb2f0b6a88810793a164a
SSDEEP

98304:TDqPoBhz1aRxcSUDk36SAEdhvxWa9P593oH:TDqPe1Cxcxk3ZAEUadzoH

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3102) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Executes dropped EXE 3 IoCs

Processes:

mssecsvc.exemssecsvc.exetasksche.exe

pid process

1956 mssecsvc.exe
2292 mssecsvc.exe
2672 tasksche.exe
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

pid	process
1956	mssecsvc.exe
2292	mssecsvc.exe
2672	tasksche.exe

Drops file in System32 directory 1 IoCs

Processes:

mssecsvc.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	mssecsvc.exe

Drops file in Windows directory 2 IoCs

Processes:

rundll32.exemssecsvc.exe

description ioc process

File created C:\WINDOWS\mssecsvc.exe rundll32.exe
File created C:\WINDOWS\tasksche.exe mssecsvc.exe

description	ioc	process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 24 IoCs

Processes:

mssecsvc.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5795B581-5DB6-4FFF-AC52-E33B4B68711D}\62-87-f1-8e-c4-b7	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\62-87-f1-8e-c4-b7\WpadDecisionReason = "1"	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\62-87-f1-8e-c4-b7\WpadDecisionTime = 7031d1c205c0da01	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5795B581-5DB6-4FFF-AC52-E33B4B68711D}	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5795B581-5DB6-4FFF-AC52-E33B4B68711D}\WpadDecisionReason = "1"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\62-87-f1-8e-c4-b7	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\62-87-f1-8e-c4-b7\WpadDecision = "0"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5795B581-5DB6-4FFF-AC52-E33B4B68711D}\WpadDecision = "0"	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5795B581-5DB6-4FFF-AC52-E33B4B68711D}\WpadNetworkName = "Network 3"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0064000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5795B581-5DB6-4FFF-AC52-E33B4B68711D}\WpadDecisionTime = 7031d1c205c0da01	mssecsvc.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2976 wrote to memory of 1664	2976	rundll32.exe	rundll32.exe
PID 2976 wrote to memory of 1664	2976	rundll32.exe	rundll32.exe
PID 2976 wrote to memory of 1664	2976	rundll32.exe	rundll32.exe
PID 2976 wrote to memory of 1664	2976	rundll32.exe	rundll32.exe
PID 2976 wrote to memory of 1664	2976	rundll32.exe	rundll32.exe
PID 2976 wrote to memory of 1664	2976	rundll32.exe	rundll32.exe
PID 2976 wrote to memory of 1664	2976	rundll32.exe	rundll32.exe
PID 1664 wrote to memory of 1956	1664	rundll32.exe	mssecsvc.exe
PID 1664 wrote to memory of 1956	1664	rundll32.exe	mssecsvc.exe
PID 1664 wrote to memory of 1956	1664	rundll32.exe	mssecsvc.exe
PID 1664 wrote to memory of 1956	1664	rundll32.exe	mssecsvc.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4574e300787f055071ae787374f1e5d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2976

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4574e300787f055071ae787374f1e5d_JaffaCakes118.dll,#1
2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1664

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe
3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1956

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
4⤵
- Executes dropped EXE
PID:2672

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

2

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\mssecsvc.exe

Filesize
3.6MB

MD5
4c8fb3cceb3671c7050c9922ec3e3645

SHA1
51f094761d5138a52162011e64c37a75dbd89b38

SHA256
79669256f55a8495766c964f6c0a2daa5bd1385d5279214e63647fef08379912

SHA512
271ca2ca7d042a1229b72057ffd6d7a521d0d9c7bad0439a63f24b001122afce93624533402d329c3dbeb9924df12f54885567572c535c5ef6f7f44a5c38f17f

Download Submit
C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
dda5a8eb3493b66a012c03e3f40379c8

SHA1
625151238aa5a3cd512f7015464f608ac8451a14

SHA256
6d470767439293a2fb5bc4b6aabefd744fcee2737335daa87bd99621da35d407

SHA512
452a30f1bf933a7dc6a73cd1b96ddbcffe7b48dddd83c20b9c87bb322c6824b5519265948611ffede82732b1e6723bc33a356e45efc1ff57f3b14d95d14334f4

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads