wannacry | 23bd5057a6a3e71690c0315e3ca8bb6fb243545f9b3b148142e02c24dd8ea7bb

General

Target
23bd5057a6a3e71690c0315e3ca8bb6fb243545f9b3b148142e02c24dd8ea7bb.dll
Size 5.0MB
Sample260106-jc596sev2a
SHA256 23bd5057a6a3e71690c0315e3ca8bb6fb243545f9b3b148142e02c24dd8ea7bb
MD5 a1bbc4f908c7e79fa740abb5574e5733
SHA1 7bec90bf83835b93a718e22b2851d8561eda55d0
SHA512 60ff5501ed9af13a4e045a75fb83fe7af3bd4c0ed14fd2da5589c95fbf15df724215036f7489f1d8bd35bef4e50bda7186a3a9e401f069ca6e3c121737b7f305
SSDEEP 49152:RnpEKUv9wC7+VQej/1INRx+TSqTdX1HkQo6SAARdh:1pyv+Fhz1aRxcSUDk36SAEdh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery wannacry ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Wannacry family
wannacry
Contacts a large (3373) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 3 IoCs

pid	Process
4288	mssecsvr.exe
4872	mssecsvr.exe
900	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\eee.exe	tasksche.exe
File created	C:\WINDOWS\mssecsvr.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvr.exe
File created	C:\Windows\__tmp_rar_sfx_access_check_240612281	tasksche.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasksche.exe

Modifies data under HKEY_USERS 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvr.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 3840	4972	rundll32.exe	77
PID 3840 wrote to memory of 4288	3840	rundll32.exe	78
PID 4288 wrote to memory of 900	4288	mssecsvr.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\23bd5057a6a3e71690c0315e3ca8bb6fb243545f9b3b148142e02c24dd8ea7bb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\23bd5057a6a3e71690c0315e3ca8bb6fb243545f9b3b148142e02c24dd8ea7bb.dll,#1
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3840
- - C:\WINDOWS\mssecsvr.exe
    C:\WINDOWS\mssecsvr.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4288
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      PID:900

C:\WINDOWS\mssecsvr.exe
C:\WINDOWS\mssecsvr.exe -m security
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:4872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

2

T1046

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvr.exe

Path C:\Windows\mssecsvr.exe
Size 2.2MB
SHA256 b6e3fd29ba27dc495a840bf33c78c582d451caf5f458f1aaa349d968ece40c7e
MD5 dcc940f81eb6fd06b914bcc95b6e5895
SHA1 4c8ff7940af714436b05af7d61adf0887b11ad02
SHA512 8fa65004e4aa0c1027dcce3f22b620d3bfa27ec2c4ccf00bab89fa26ce93c4190bce5a9ef258728c236e7e3d90d56aa9a6d39fc47e41340cc4dc58166ef5addc
SSDEEP 49152:QnpEKUv9wC7+VQej/1INRx+TSqTdX1HkQo6SAARdh:Qpyv+Fhz1aRxcSUDk36SAEdh
MD5 SHA1 SHA512 SSDEEP

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 2.0MB
SHA256 21cdd121bc9d94d1e4f3a8f41bc514a35ed57d34665d9a09fd07bbbbea0c8a7d
MD5 828203615717cd67223239f3cfa2c57f
SHA1 fe2347599af7b5e3f3997f4697e1f5395808806d
SHA512 cf594f7cba0434c8e702a5e4ad2284d0957748823d58b17f4421e214189c3083482f4dc0305c43be02b556ff5df51309225bf95d1dccd04aded2d224dcafcdae
SSDEEP 49152:XEKUv9wC7+VQej/1INRx+TSqTdX1HkQo6SAARdh:Xyv+Fhz1aRxcSUDk36SAEdh
MD5 SHA1 SHA512 SSDEEP