wannacry | 3b6f289036c7e924b20c5eb12daa5b902dcc660fc89a99b9fd0024088c9bec45

General

Target

38a3377280ad3182ab1541c841add640_JaffaCakes118.dll
Size

5.0MB
MD5

38a3377280ad3182ab1541c841add640
SHA1

86b486bbcbeca9d821af505d2c0fde1c3a73ab2e
SHA256

3b6f289036c7e924b20c5eb12daa5b902dcc660fc89a99b9fd0024088c9bec45
SHA512

8c1740d12db3352ef27570010a42c51fdaa59695ca720b09786b1d1d0e9025da1dc248285c0f6656e31acc8f4f267b228b36698f528db73ce9b09fbd6672b97c
SSDEEP

12288:T1bLgmluCti62WfSm0iEcQhfYNVUy7ckPU82900Ve7zw+K+DHeQYSUjEXFGeX:RbLguriIfEcQdIVUacMNgef0QeQjG

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3133) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Executes dropped EXE 3 IoCs

Processes:

mssecsvr.exemssecsvr.exetasksche.exe

pid process

4632 mssecsvr.exe
2308 mssecsvr.exe
2500 tasksche.exe
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

pid	process
4632	mssecsvr.exe
2308	mssecsvr.exe
2500	tasksche.exe

Drops file in System32 directory 4 IoCs

Processes:

mssecsvr.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	mssecsvr.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	mssecsvr.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	mssecsvr.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	mssecsvr.exe

Drops file in Windows directory 4 IoCs

Processes:

tasksche.exerundll32.exemssecsvr.exe

description	ioc	process
File created	C:\Windows\eee.exe	tasksche.exe
File created	C:\WINDOWS\mssecsvr.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvr.exe
File created	C:\Windows\__tmp_rar_sfx_access_check_241414562	tasksche.exe

Modifies data under HKEY_USERS 15 IoCs

Processes:

mssecsvr.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	mssecsvr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvr.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

rundll32.exerundll32.exemssecsvr.exe

description	pid	process	target process
PID 1592 wrote to memory of 4664	1592	rundll32.exe	rundll32.exe
PID 1592 wrote to memory of 4664	1592	rundll32.exe	rundll32.exe
PID 1592 wrote to memory of 4664	1592	rundll32.exe	rundll32.exe
PID 4664 wrote to memory of 4632	4664	rundll32.exe	mssecsvr.exe
PID 4664 wrote to memory of 4632	4664	rundll32.exe	mssecsvr.exe
PID 4664 wrote to memory of 4632	4664	rundll32.exe	mssecsvr.exe
PID 4632 wrote to memory of 2500	4632	mssecsvr.exe	tasksche.exe
PID 4632 wrote to memory of 2500	4632	mssecsvr.exe	tasksche.exe
PID 4632 wrote to memory of 2500	4632	mssecsvr.exe	tasksche.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\38a3377280ad3182ab1541c841add640_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1592

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\38a3377280ad3182ab1541c841add640_JaffaCakes118.dll,#1
2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4664

C:\WINDOWS\mssecsvr.exe
C:\WINDOWS\mssecsvr.exe
3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4632

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
4⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2500

C:\WINDOWS\mssecsvr.exe
C:\WINDOWS\mssecsvr.exe -m security
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

2

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\mssecsvr.exe

Filesize
2.2MB

MD5
a88fd13c373d10711fd23d4893d199f7

SHA1
a1b0d0de6b658171b45c4db034bc846e8ef06e02

SHA256
c00851c0e0fcadbf5430ff8ad8e68bf453fa5a70d21f6b0d65437f27d7be514b

SHA512
13befe2211f6a92f46a00ef6789f9dabc4dcac838a2dff3434698334b6efcc8604c429f16c780072f6985c75776e17b7deb6411fc6bd18606377037e8a33d873

Download Submit
C:\Windows\tasksche.exe

Filesize
2.0MB

MD5
0c761ff198ad086294f0a317de3812e2

SHA1
fe057de7755461c0595c00a54e5e37b2da29d50a

SHA256
befb04b65682bab3d99663901730dde05c298604b9db15bb65fec062865465d6

SHA512
d1ed2fe76a390dcaec2d57e0d14ba3413b547cef0a2f6f18ea2ba96be49fc6192d982aa836d5e634027b86b7ff49675bf777d73a752d1795b479fd4ef225ebf3

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads