wannacry | e1c622e4f4c8f056a735555bdcfc4d784aac7b87cbde08d879109ff0143ef45a

General

Target

b171eaf32d9837fdb6c73c59d1216ff0N.dll
Size

5.0MB
MD5

b171eaf32d9837fdb6c73c59d1216ff0
SHA1

3f2920b4c444c98bdd8eb605b60d6f9c172d9bbc
SHA256

e1c622e4f4c8f056a735555bdcfc4d784aac7b87cbde08d879109ff0143ef45a
SHA512

3ffa21d45b546f54f8a6de2efe72484404ed7b8d566441fa24f9ab63d89c724e2f7b651c6e9f5cb9cc746ae7fc9a93e77ade5f5a905f79927f80fc84072540ca
SSDEEP

6144:TE9l9ynRIYVTH5DgSgNajldktM0XXrO2/HJKyrYev3AiiVjAqZfAgbJ3iqMgAyY:T1bLgmlu//dhAvVLJAmd3A

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (2216) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 3 IoCs

pid	Process
2184	mssecsvr.exe
2860	mssecsvr.exe
2628	tasksche.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	mssecsvr.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\5JDRE1DN.txt	mssecsvr.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\5JDRE1DN.txt	mssecsvr.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\DQTT333K.txt	mssecsvr.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\DQTT333K.txt	mssecsvr.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvr.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvr.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2852	2628	WerFault.exe	34

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasksche.exe

Modifies data under HKEY_USERS 24 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	mssecsvr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	mssecsvr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f011d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{958DB71B-F2D8-4775-B299-531733DBA471}\WpadDecision = "0"	mssecsvr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{958DB71B-F2D8-4775-B299-531733DBA471}\WpadNetworkName = "Network 3"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	mssecsvr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\86-57-c1-73-cc-cc\WpadDecisionReason = "1"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\86-57-c1-73-cc-cc\WpadDecision = "0"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{958DB71B-F2D8-4775-B299-531733DBA471}\WpadDecisionReason = "1"	mssecsvr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{958DB71B-F2D8-4775-B299-531733DBA471}\WpadDecisionTime = 3074d7eb73deda01	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\86-57-c1-73-cc-cc	mssecsvr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\86-57-c1-73-cc-cc\WpadDecisionTime = 3074d7eb73deda01	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	mssecsvr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{958DB71B-F2D8-4775-B299-531733DBA471}\86-57-c1-73-cc-cc	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{958DB71B-F2D8-4775-B299-531733DBA471}	mssecsvr.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 2164	2128	rundll32.exe	30
PID 2128 wrote to memory of 2164	2128	rundll32.exe	30
PID 2128 wrote to memory of 2164	2128	rundll32.exe	30
PID 2128 wrote to memory of 2164	2128	rundll32.exe	30
PID 2128 wrote to memory of 2164	2128	rundll32.exe	30
PID 2128 wrote to memory of 2164	2128	rundll32.exe	30
PID 2128 wrote to memory of 2164	2128	rundll32.exe	30
PID 2164 wrote to memory of 2184	2164	rundll32.exe	31
PID 2164 wrote to memory of 2184	2164	rundll32.exe	31
PID 2164 wrote to memory of 2184	2164	rundll32.exe	31
PID 2164 wrote to memory of 2184	2164	rundll32.exe	31
PID 2184 wrote to memory of 2628	2184	mssecsvr.exe	34
PID 2184 wrote to memory of 2628	2184	mssecsvr.exe	34
PID 2184 wrote to memory of 2628	2184	mssecsvr.exe	34
PID 2184 wrote to memory of 2628	2184	mssecsvr.exe	34
PID 2628 wrote to memory of 2852	2628	tasksche.exe	35
PID 2628 wrote to memory of 2852	2628	tasksche.exe	35
PID 2628 wrote to memory of 2852	2628	tasksche.exe	35
PID 2628 wrote to memory of 2852	2628	tasksche.exe	35

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b171eaf32d9837fdb6c73c59d1216ff0N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b171eaf32d9837fdb6c73c59d1216ff0N.dll,#1
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2164
- - C:\WINDOWS\mssecsvr.exe
    C:\WINDOWS\mssecsvr.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2184
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2628
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 36
        5⤵
        Program crash
        
        PID:2852

C:\WINDOWS\mssecsvr.exe
C:\WINDOWS\mssecsvr.exe -m security
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

1

T1046

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\mssecsvr.exe

Filesize
2.2MB

MD5
6a5adbeaa8b5161671874b27b0c00269

SHA1
453912ce5e6c9f0bf360c41c1b8adfbd10ec7473

SHA256
65f8acd369c6a98f01849f09c9981cc1a03ff8813d72f4da7e5e32d72e4b5237

SHA512
42d762ac33f4c22418a17f2093987e329a55ede43049a7262870477c929beca4297134de30050555fc41677118e0db2d2e7a5a2bdf7af0632405b20d4751c9da

Download Submit
C:\Windows\tasksche.exe

Filesize
2.0MB

MD5
250ff99090260532ff0acf9da52e8602

SHA1
f51193260ef8396caf576c432ddaece649928a6b

SHA256
faeebe09f45e15faf27a262ef3780feed5b4c3e885cad37742635fd490d74109

SHA512
be5fefd2744a2277b6ac1a24899e6112775e0e48fd7d7868032a7984bb84cbafdb9e628682e21650a5521ba1168ca3686079842b83e2a946f41b47e8dae2b475

Download Submit

Analysis

Sharing