wannacry | d4815e140756483d9fc9bc4aa5700504ae605cae146c30791ab2af81e7151cad

General

Target

c7595b1085a6bc7f1bdf81a22ef6b820_JaffaCakes118.dll
Size

5.0MB
MD5

c7595b1085a6bc7f1bdf81a22ef6b820
SHA1

4dc7cf889f1d7872ffdaa34fc9c2178aa430f259
SHA256

d4815e140756483d9fc9bc4aa5700504ae605cae146c30791ab2af81e7151cad
SHA512

df878824bef175b32ec77ca216735a5a27b47f019c127e0d3d116989b25c84dec0ff2ec242d5e0e76b6e2d89fa3d0fb362ba303fccaf3715fff26c2305b1cc74
SSDEEP

49152:znAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SA0vxJM0H9DAH1plA:TDqPoBhz1aRxcSUDk36SA8xWa9DAVp2

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3126) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 3 IoCs

pid	Process
2524	mssecsvc.exe
2156	mssecsvc.exe
2920	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	mssecsvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvc.exe

Modifies data under HKEY_USERS 24 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F4FFF30C-3122-40E3-AAAD-6C4972CFCDFD}	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F4FFF30C-3122-40E3-AAAD-6C4972CFCDFD}\WpadDecisionReason = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F4FFF30C-3122-40E3-AAAD-6C4972CFCDFD}\WpadDecision = "0"	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F4FFF30C-3122-40E3-AAAD-6C4972CFCDFD}\WpadNetworkName = "Network 3"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\86-7f-b6-95-1a-36	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\86-7f-b6-95-1a-36\WpadDecision = "0"	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\86-7f-b6-95-1a-36\WpadDecisionReason = "1"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\86-7f-b6-95-1a-36\WpadDecisionTime = 504003b072f9da01	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0033000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F4FFF30C-3122-40E3-AAAD-6C4972CFCDFD}\WpadDecisionTime = 504003b072f9da01	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F4FFF30C-3122-40E3-AAAD-6C4972CFCDFD}\86-7f-b6-95-1a-36	mssecsvc.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 2060	2408	rundll32.exe	30
PID 2408 wrote to memory of 2060	2408	rundll32.exe	30
PID 2408 wrote to memory of 2060	2408	rundll32.exe	30
PID 2408 wrote to memory of 2060	2408	rundll32.exe	30
PID 2408 wrote to memory of 2060	2408	rundll32.exe	30
PID 2408 wrote to memory of 2060	2408	rundll32.exe	30
PID 2408 wrote to memory of 2060	2408	rundll32.exe	30
PID 2060 wrote to memory of 2524	2060	rundll32.exe	31
PID 2060 wrote to memory of 2524	2060	rundll32.exe	31
PID 2060 wrote to memory of 2524	2060	rundll32.exe	31
PID 2060 wrote to memory of 2524	2060	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c7595b1085a6bc7f1bdf81a22ef6b820_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c7595b1085a6bc7f1bdf81a22ef6b820_JaffaCakes118.dll,#1
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2060
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2524
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:2920

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

2

T1046

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\mssecsvc.exe

Filesize
3.6MB

MD5
00dc5da70c8df466cfb8d5d3ed6bf0d1

SHA1
c84a660036e064f27a77eb0a4cd7badb62371c8e

SHA256
017acbabbcfd9e579af9095d77e83181165de10fb04a40697b6801593fa2dd8d

SHA512
9e00f41cdcf1e2416352d9f2ebe8871184ea5a248c72955e272ca1f137c9743715836b695f3fc04343438f7ac98ec2eca1d2875661d9466a3d0960c4e4901d43

Download Submit
C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
ff60bf4157e2d76fd985a1043886cafb

SHA1
6cf4f3a6e3d1ae95a8ab97b08514c6909b3599be

SHA256
ef6124fa6041b086a5472db92c1f46c48029625bfc8dc0044b0816debc1e2f70

SHA512
a3375f761ac10590b8a7145e081752c485b57aee8b9882b21697f6255fcab32392703a8e8b8263dac9195acc84a063dc8c4c838256860788e71a172155959f73

Download Submit

Analysis

Sharing