wannacry | ff95f0d81247ca01a46e54ccbe1154e9f5cfbb3e854bc6460882d9ecce2abc83

General

Target

16067c78a3393c4604b7a2ad4e908a90N.dll
Size

5.0MB
MD5

16067c78a3393c4604b7a2ad4e908a90
SHA1

47c0864838a0e172249ed4dc2947fa24435b34c9
SHA256

ff95f0d81247ca01a46e54ccbe1154e9f5cfbb3e854bc6460882d9ecce2abc83
SHA512

fab51fea0f7a2763f5605a8982eb19f5490a2ac0120161cbd3a6a34348f3b63bb2b635c72c994d8cbf9465b55dd5c199f32dd5946f360dbb80a4a41cc254ac4a
SSDEEP

49152:RnpENbcBVQe01INRx+TSqTdX1HkQo6SAARdhnv:1p+oBh01aRxcSUDk36SAEdhv

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (1289) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 3 IoCs

pid	Process
2660	mssecsvr.exe
1700	mssecsvr.exe
340	tasksche.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	mssecsvr.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\eee.exe	tasksche.exe
File created	C:\WINDOWS\mssecsvr.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvr.exe
File created	C:\Windows\__tmp_rar_sfx_access_check_259504262	tasksche.exe

Modifies data under HKEY_USERS 24 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	mssecsvr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\92-19-de-fd-39-c0\WpadDecisionReason = "1"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\92-19-de-fd-39-c0\WpadDecision = "0"	mssecsvr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	mssecsvr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0027000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{22016429-DB11-4067-8CB8-0B2DBB13780B}\WpadDecisionReason = "1"	mssecsvr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{22016429-DB11-4067-8CB8-0B2DBB13780B}\WpadDecisionTime = 007e0e83ead3da01	mssecsvr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{22016429-DB11-4067-8CB8-0B2DBB13780B}\WpadNetworkName = "Network 3"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{22016429-DB11-4067-8CB8-0B2DBB13780B}	mssecsvr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\92-19-de-fd-39-c0\WpadDecisionTime = 007e0e83ead3da01	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	mssecsvr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{22016429-DB11-4067-8CB8-0B2DBB13780B}\WpadDecision = "0"	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\92-19-de-fd-39-c0	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{22016429-DB11-4067-8CB8-0B2DBB13780B}\92-19-de-fd-39-c0	mssecsvr.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 112	2644	rundll32.exe	30
PID 2644 wrote to memory of 112	2644	rundll32.exe	30
PID 2644 wrote to memory of 112	2644	rundll32.exe	30
PID 2644 wrote to memory of 112	2644	rundll32.exe	30
PID 2644 wrote to memory of 112	2644	rundll32.exe	30
PID 2644 wrote to memory of 112	2644	rundll32.exe	30
PID 2644 wrote to memory of 112	2644	rundll32.exe	30
PID 112 wrote to memory of 2660	112	rundll32.exe	31
PID 112 wrote to memory of 2660	112	rundll32.exe	31
PID 112 wrote to memory of 2660	112	rundll32.exe	31
PID 112 wrote to memory of 2660	112	rundll32.exe	31
PID 2660 wrote to memory of 340	2660	mssecsvr.exe	34
PID 2660 wrote to memory of 340	2660	mssecsvr.exe	34
PID 2660 wrote to memory of 340	2660	mssecsvr.exe	34
PID 2660 wrote to memory of 340	2660	mssecsvr.exe	34
PID 2660 wrote to memory of 340	2660	mssecsvr.exe	34
PID 2660 wrote to memory of 340	2660	mssecsvr.exe	34
PID 2660 wrote to memory of 340	2660	mssecsvr.exe	34

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\16067c78a3393c4604b7a2ad4e908a90N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\16067c78a3393c4604b7a2ad4e908a90N.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:112
- - C:\WINDOWS\mssecsvr.exe
    C:\WINDOWS\mssecsvr.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:2660
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      PID:340

C:\WINDOWS\mssecsvr.exe
C:\WINDOWS\mssecsvr.exe -m security
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

1

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\tasksche.exe

Filesize
2.0MB

MD5
90b4050408a6daf42b0fe666b2f1b41b

SHA1
8b2d64befe94ab1c692b3d9218764560bfd7ad05

SHA256
99a622faf7fa1f73c8c2df50589cfb917fdb093e7336675e8d2e51b449d3e7e9

SHA512
2f8113a333be1e4c57e99b223ad6f8d9609e97ae4be5a1f155714d3a65f0c0c6dc6e51a9f4bf3237492c751e9ff0f36fce391e0661c70781f234e618c993674b

Download Submit
C:\Windows\mssecsvr.exe

Filesize
2.2MB

MD5
53db41c9b29c1ef8242d21dc33b9f81b

SHA1
999fbe2d2ba609e5f3dc4a244a4737654336addb

SHA256
249d0c7a79ee1b2bc0170d43b6eb24f87b045d617a87a563ec0f474d88b8f122

SHA512
e070356d033ec0409a13bdea060e2c7e449f9d40ef54df0d76bf050d2a6d013a2de615b057e24a6a11112df6921ab43f03ab56281f9919b5cdc1ea3cc8aba8d8

Download Submit

Analysis

Sharing