wannacry | e6a3ac4235b6ef444de81213a9c13c6ab5f208f67a240afb5e9182ff538425a5

General

Target

560c8d8b51659d30527fe62dcc0cb4e5_JaffaCakes118.dll
Size

5.0MB
MD5

560c8d8b51659d30527fe62dcc0cb4e5
SHA1

5ef485f0841f6d79fe07f9ab3b53d4a6176f005d
SHA256

e6a3ac4235b6ef444de81213a9c13c6ab5f208f67a240afb5e9182ff538425a5
SHA512

55fdf414559f7bb63963b56cbb65c031796d8127b6ac8d75d1fb3bfdf0f7139ef77e1c694f31455b7eff5ebb5d0c63e54d1d1c1eab4f437cb443ca7d868ff2ae
SSDEEP

49152:znAQqMSPbcBVQej/1INRx+TSqTdX1HkQo69:TDqPoBhz1aRxcSUDk369

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3177) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 3 IoCs

pid	Process
2752	mssecsvc.exe
2648	mssecsvc.exe
2268	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	mssecsvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 24 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{452F0236-2293-4B4E-8D0D-C38F0F9F7A61}\WpadDecisionTime = 308fc531c6d8da01	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9e-43-22-e8-e9-4a	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9e-43-22-e8-e9-4a\WpadDecisionReason = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{452F0236-2293-4B4E-8D0D-C38F0F9F7A61}\WpadDecisionReason = "1"	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9e-43-22-e8-e9-4a\WpadDecisionTime = 308fc531c6d8da01	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0196000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{452F0236-2293-4B4E-8D0D-C38F0F9F7A61}\WpadNetworkName = "Network 3"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{452F0236-2293-4B4E-8D0D-C38F0F9F7A61}\9e-43-22-e8-e9-4a	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{452F0236-2293-4B4E-8D0D-C38F0F9F7A61}	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{452F0236-2293-4B4E-8D0D-C38F0F9F7A61}\WpadDecision = "0"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9e-43-22-e8-e9-4a\WpadDecision = "0"	mssecsvc.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2700	2876	rundll32.exe	30
PID 2876 wrote to memory of 2700	2876	rundll32.exe	30
PID 2876 wrote to memory of 2700	2876	rundll32.exe	30
PID 2876 wrote to memory of 2700	2876	rundll32.exe	30
PID 2876 wrote to memory of 2700	2876	rundll32.exe	30
PID 2876 wrote to memory of 2700	2876	rundll32.exe	30
PID 2876 wrote to memory of 2700	2876	rundll32.exe	30
PID 2700 wrote to memory of 2752	2700	rundll32.exe	31
PID 2700 wrote to memory of 2752	2700	rundll32.exe	31
PID 2700 wrote to memory of 2752	2700	rundll32.exe	31
PID 2700 wrote to memory of 2752	2700	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\560c8d8b51659d30527fe62dcc0cb4e5_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\560c8d8b51659d30527fe62dcc0cb4e5_JaffaCakes118.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:2752
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:2268

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

2

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\mssecsvc.exe

Filesize
3.6MB

MD5
111499d873815c3d6face3a8480f286d

SHA1
6a05bfc9806784884ca6c260bbdb5785fca2762d

SHA256
971f763939910cc04c170936ad2467e592678a301997aa80adde2e94040afe28

SHA512
e7ba9fa467498e8db5df1c03f315bbbfbea1429268778ac792346bd5e050bfe1db310ccab887a78d162831b885c3a1c3e67a5bd16b300a9aaacd1edd41cf83fd

Download Submit
C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
b71a10d0e3f3255cdce7903784d380a7

SHA1
46ac26d48c204458cca61147fbfb356b8b468a8e

SHA256
571305f8160f8b4bf8063845763578794f215e3c525b198881d0e38e2f70e89c

SHA512
23204156ce4afd6b5ec24a906c7c9ed88c23a1483b089f7d0151be731105079f84d22a46a5912359d096afa8e9dc90a778d50025ba83b8714ad91f0ffaaa8017

Download Submit

Analysis

Sharing