wannacry | 3214a6bc1516237a1dd43a7362e4c5d8a48528aeadd8151eae8e9030fd98f273

General

Target

c6f93103b29652dbe18510ea58016058_JaffaCakes118.dll
Size

5.0MB
MD5

c6f93103b29652dbe18510ea58016058
SHA1

99f707cdd51c938b85b43413d982325919f18cd1
SHA256

3214a6bc1516237a1dd43a7362e4c5d8a48528aeadd8151eae8e9030fd98f273
SHA512

4a243ef4bf2ae2b01030c00f576c4c83a378f280e03f356c7298d5eaa41720722616da5dd7e4466b572158e658a01b92e09ff245b9c218949945e061bb40980d
SSDEEP

49152:SnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM:+DqPoBhz1aRxcSUDk36SAEdhvxW

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (694) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 3 IoCs

pid	Process
2232	mssecsvc.exe
2764	mssecsvc.exe
2768	tasksche.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	mssecsvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvc.exe

Modifies data under HKEY_USERS 24 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{00B21A40-6FAF-45D7-A099-5BB09CBF3C64}	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{00B21A40-6FAF-45D7-A099-5BB09CBF3C64}\WpadNetworkName = "Network 3"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\66-4e-4b-c5-e6-8c\WpadDecision = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{00B21A40-6FAF-45D7-A099-5BB09CBF3C64}\66-4e-4b-c5-e6-8c	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\66-4e-4b-c5-e6-8c\WpadDecisionReason = "1"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0033000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{00B21A40-6FAF-45D7-A099-5BB09CBF3C64}\WpadDecisionTime = 50a304b054f9da01	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{00B21A40-6FAF-45D7-A099-5BB09CBF3C64}\WpadDecisionReason = "1"	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\66-4e-4b-c5-e6-8c\WpadDecisionTime = 50a304b054f9da01	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{00B21A40-6FAF-45D7-A099-5BB09CBF3C64}\WpadDecision = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\66-4e-4b-c5-e6-8c	mssecsvc.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2164	vlc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2164	vlc.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2164	vlc.exe
2164	vlc.exe
2164	vlc.exe
2164	vlc.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2164	vlc.exe
2164	vlc.exe
2164	vlc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2164	vlc.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2244	2208	rundll32.exe	30
PID 2208 wrote to memory of 2244	2208	rundll32.exe	30
PID 2208 wrote to memory of 2244	2208	rundll32.exe	30
PID 2208 wrote to memory of 2244	2208	rundll32.exe	30
PID 2208 wrote to memory of 2244	2208	rundll32.exe	30
PID 2208 wrote to memory of 2244	2208	rundll32.exe	30
PID 2208 wrote to memory of 2244	2208	rundll32.exe	30
PID 2244 wrote to memory of 2232	2244	rundll32.exe	31
PID 2244 wrote to memory of 2232	2244	rundll32.exe	31
PID 2244 wrote to memory of 2232	2244	rundll32.exe	31
PID 2244 wrote to memory of 2232	2244	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c6f93103b29652dbe18510ea58016058_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c6f93103b29652dbe18510ea58016058_JaffaCakes118.dll,#1
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2244
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2232
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:2768

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2764

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2920

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

1

T1046

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\mssecsvc.exe

Filesize
3.6MB

MD5
8bcc3517b17394c04e305a5a31fbb5d6

SHA1
8e789cf5b8d483691554d6315212b00fb0f2727f

SHA256
c5d66f91b1b6b9ff6be7ca61ed7989b02d753b182959878db5b5dac064444b4d

SHA512
5137ca1fb369ea7de967307f9038d098562b257f2f3a46fda69e0d8312253b5b61ef2848dae389ea59a9f75a56acab42956b82916690ba1d3f0ce10e3c7e77c9

Download Submit
C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
f22c104bdced739dd330228c7818f972

SHA1
c79950f1e331f6d005e469843a6927e8d1bf641f

SHA256
0e4d85f35083e1dac36ed2533d945f4c1b81455241ac5b319680613d833e8b95

SHA512
87312affbfd18d35652f136480ff73cdc7e6933af46bcd2116603776fdc7ac57d38585459530d317d5ca2b2ae560e57ec426b70de9cfadc48625962d9aa022f0

Download Submit
memory/2164-20-0x000007FEF6540000-0x000007FEF6574000-memory.dmp

Filesize
208KB

Download
memory/2164-19-0x000000013FCC0000-0x000000013FDB8000-memory.dmp

Filesize
992KB

Download
memory/2164-21-0x000007FEF5960000-0x000007FEF5C16000-memory.dmp

Filesize
2.7MB

Download
memory/2164-22-0x000007FEF4780000-0x000007FEF5830000-memory.dmp

Filesize
16.7MB

Download

Resubmissions

Analysis

Sharing