wannacry | e1c622e4f4c8f056a735555bdcfc4d784aac7b87cbde08d879109ff0143ef45a

General

Target

b171eaf32d9837fdb6c73c59d1216ff0N.dll
Size

5.0MB
MD5

b171eaf32d9837fdb6c73c59d1216ff0
SHA1

3f2920b4c444c98bdd8eb605b60d6f9c172d9bbc
SHA256

e1c622e4f4c8f056a735555bdcfc4d784aac7b87cbde08d879109ff0143ef45a
SHA512

3ffa21d45b546f54f8a6de2efe72484404ed7b8d566441fa24f9ab63d89c724e2f7b651c6e9f5cb9cc746ae7fc9a93e77ade5f5a905f79927f80fc84072540ca
SSDEEP

6144:TE9l9ynRIYVTH5DgSgNajldktM0XXrO2/HJKyrYev3AiiVjAqZfAgbJ3iqMgAyY:T1bLgmlu//dhAvVLJAmd3A

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (2448) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 3 IoCs

pid	Process
4528	mssecsvr.exe
4732	mssecsvr.exe
4656	tasksche.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	mssecsvr.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	mssecsvr.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	mssecsvr.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	mssecsvr.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvr.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvr.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1608	4656	WerFault.exe	91
4984	4656	WerFault.exe	91

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasksche.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	mssecsvr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	mssecsvr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	mssecsvr.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 904	4652	rundll32.exe	83
PID 4652 wrote to memory of 904	4652	rundll32.exe	83
PID 4652 wrote to memory of 904	4652	rundll32.exe	83
PID 904 wrote to memory of 4528	904	rundll32.exe	84
PID 904 wrote to memory of 4528	904	rundll32.exe	84
PID 904 wrote to memory of 4528	904	rundll32.exe	84
PID 4528 wrote to memory of 4656	4528	mssecsvr.exe	91
PID 4528 wrote to memory of 4656	4528	mssecsvr.exe	91
PID 4528 wrote to memory of 4656	4528	mssecsvr.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b171eaf32d9837fdb6c73c59d1216ff0N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b171eaf32d9837fdb6c73c59d1216ff0N.dll,#1
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:904
- - C:\WINDOWS\mssecsvr.exe
    C:\WINDOWS\mssecsvr.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4528
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4656
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 216
        5⤵
        Program crash
        
        PID:1608
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 240
        5⤵
        Program crash
        
        PID:4984

C:\WINDOWS\mssecsvr.exe
C:\WINDOWS\mssecsvr.exe -m security
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:4732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4656 -ip 4656
1⤵
PID:1180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4656 -ip 4656
1⤵
PID:1292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

1

T1046

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\mssecsvr.exe

Filesize
2.2MB

MD5
6a5adbeaa8b5161671874b27b0c00269

SHA1
453912ce5e6c9f0bf360c41c1b8adfbd10ec7473

SHA256
65f8acd369c6a98f01849f09c9981cc1a03ff8813d72f4da7e5e32d72e4b5237

SHA512
42d762ac33f4c22418a17f2093987e329a55ede43049a7262870477c929beca4297134de30050555fc41677118e0db2d2e7a5a2bdf7af0632405b20d4751c9da

Download Submit
C:\WINDOWS\tasksche.exe

Filesize
2.0MB

MD5
250ff99090260532ff0acf9da52e8602

SHA1
f51193260ef8396caf576c432ddaece649928a6b

SHA256
faeebe09f45e15faf27a262ef3780feed5b4c3e885cad37742635fd490d74109

SHA512
be5fefd2744a2277b6ac1a24899e6112775e0e48fd7d7868032a7984bb84cbafdb9e628682e21650a5521ba1168ca3686079842b83e2a946f41b47e8dae2b475

Download Submit

Analysis

Sharing