wannacry | 06cc1cf5c6f98e91d17ce4b86ecc78b5dab56130198235d5ebd956ad4e2980a1

General

Target

4df03efd1558eaeee19808c9f133b61e_JaffaCakes118.dll
Size

5.0MB
MD5

4df03efd1558eaeee19808c9f133b61e
SHA1

5f018de1b021226428135af117f492996cee5d6e
SHA256

06cc1cf5c6f98e91d17ce4b86ecc78b5dab56130198235d5ebd956ad4e2980a1
SHA512

798a0b2beedea2bb944001c31fe38de1c700958f92dc0bf8a0ca18cc229f7341a42cf0526c408cbf90a14338224255495da0d0094626999272820d1eca288bf9
SSDEEP

6144:yE9l9yUqIYVTH5DgSg8ajldktM0XXrP2QhMV9qbBLIwYQuy8:yvbLgPlu+QhMbaIMu

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3130) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 3 IoCs

pid	Process
2828	mssecsvc.exe
2880	mssecsvc.exe
2792	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	mssecsvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 24 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4CC83AD8-A6CD-411B-A0ED-524E1E0F8321}\WpadDecisionReason = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4CC83AD8-A6CD-411B-A0ED-524E1E0F8321}\WpadDecision = "0"	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4CC83AD8-A6CD-411B-A0ED-524E1E0F8321}\WpadNetworkName = "Network 3"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4CC83AD8-A6CD-411B-A0ED-524E1E0F8321}\b2-2f-73-f8-ed-35	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b2-2f-73-f8-ed-35\WpadDecision = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b2-2f-73-f8-ed-35	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b2-2f-73-f8-ed-35\WpadDecisionTime = 90ac91fd6bd7da01	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4CC83AD8-A6CD-411B-A0ED-524E1E0F8321}	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b2-2f-73-f8-ed-35\WpadDecisionReason = "1"	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0077000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4CC83AD8-A6CD-411B-A0ED-524E1E0F8321}\WpadDecisionTime = 90ac91fd6bd7da01	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	mssecsvc.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 1696	2304	rundll32.exe	29
PID 2304 wrote to memory of 1696	2304	rundll32.exe	29
PID 2304 wrote to memory of 1696	2304	rundll32.exe	29
PID 2304 wrote to memory of 1696	2304	rundll32.exe	29
PID 2304 wrote to memory of 1696	2304	rundll32.exe	29
PID 2304 wrote to memory of 1696	2304	rundll32.exe	29
PID 2304 wrote to memory of 1696	2304	rundll32.exe	29
PID 1696 wrote to memory of 2828	1696	rundll32.exe	30
PID 1696 wrote to memory of 2828	1696	rundll32.exe	30
PID 1696 wrote to memory of 2828	1696	rundll32.exe	30
PID 1696 wrote to memory of 2828	1696	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4df03efd1558eaeee19808c9f133b61e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4df03efd1558eaeee19808c9f133b61e_JaffaCakes118.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1696
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:2828
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:2792

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

2

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\mssecsvc.exe

Filesize
3.6MB

MD5
b6a79236c888b3710beb1bd8bfde513b

SHA1
896f70487c06d860b20f463d21298ffb880adbfc

SHA256
ae1bd2bebc2479cecc03d7eebfb93e3e0d9a02fcfd7ff27b3ad7baf1739af822

SHA512
0695d764afde66e35b243588b4bf3e6c93a01d6ed73e0c3200a54cc422572a24faa1ffd7d2a1efb26a8c9a088390493d3bf0eabb748160d04c297c1e142ea1ab

Download Submit
C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
d835fb84413ab5980a8c6c240102589c

SHA1
b16a433200c9b31d6e96080040546d8e504bcee1

SHA256
62c8e06fc684d111157886a85bbd934e64bfa8607b9ec53d362bfa9520c939b8

SHA512
a9994016cdf027b8512877f7c565b6e7efb3bc9e09e2b85af09fb462607bb70f9ee68c793d1bde9cedea6b1d1e8bb3e96298cce902c598e703113c2274fb2538

Download Submit

Analysis

Sharing