wannacry | a4b97fd561d49eb3a43fcb259c5352840254a188e73d5d75768ad3bafa9fa58f

General

Target
a4b97fd561d49eb3a43fcb259c5352840254a188e73d5d75768ad3bafa9fa58f.dll
Size 5.0MB
Sample260106-kmwddsen2v
SHA256 a4b97fd561d49eb3a43fcb259c5352840254a188e73d5d75768ad3bafa9fa58f
MD5 d88af4a1a1efa273fd33b262696f530e
SHA1 4f78e93b059758f62216313355a5233d0da314a3
SHA512 a372ede66cb56c086cdce770f4cf84ad2b5cc035f49cd4c0cc8423214a0ab34bb251c9d5b33ae1fb4363ffb0be73550e7798c2e6a379a68cccf7698a2837f2ed
SSDEEP 24576:ubLgurgDdmMSirYbcMNgef0QeQjG/D8kIqJASk+RdhAdmvctA0p+9XEk:unsEMSPbcBVQej/NAARdhnvoAH
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery wannacry ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Wannacry family
wannacry
Contacts a large (3336) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 3 IoCs

pid	Process
432	mssecsvr.exe
1100	mssecsvr.exe
4164	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvr.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvr.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3440	4164	WerFault.exe	80

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Modifies data under HKEY_USERS 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	mssecsvr.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5152 wrote to memory of 4896	5152	rundll32.exe	77
PID 4896 wrote to memory of 432	4896	rundll32.exe	78
PID 432 wrote to memory of 4164	432	mssecsvr.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a4b97fd561d49eb3a43fcb259c5352840254a188e73d5d75768ad3bafa9fa58f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5152
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a4b97fd561d49eb3a43fcb259c5352840254a188e73d5d75768ad3bafa9fa58f.dll,#1
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4896
- - C:\WINDOWS\mssecsvr.exe
    C:\WINDOWS\mssecsvr.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:432
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:4164
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4164 -s 8
        5⤵
        Program crash
        
        PID:3440

C:\WINDOWS\mssecsvr.exe
C:\WINDOWS\mssecsvr.exe -m security
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4164 -ip 4164
1⤵
PID:5232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

2

T1046

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvr.exe

Path C:\Windows\mssecsvr.exe
Size 3.6MB
SHA256 9af88b60c7b7bd7e940e2459a351b40614da4fc5c558c695874df753a1f1b139
MD5 c5777e0bc34e1899c90cc028b9b2e9d8
SHA1 065f19a9e05cbaf0061a88d3d6441638995fe84c
SHA512 7ef2b05ac1e2a2a97286949d8e48939ea868b8634b533ba03b11553b1d3d1f9f8c0078b97c36a0f1e734111a24b447e0e184cb47c9773f63bfe54ea872c79c53
SSDEEP 24576:tbLgurgDdmMSirYbcMNgef0QeQjG/D8kIqJASk+RdhAdmvctA0p+9XEkI:tnsEMSPbcBVQej/NAARdhnvoAHI
MD5 SHA1 SHA512 SSDEEP

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 2.0MB
SHA256 9e77f8ff05bc002952a0f1fd47c98f82612cbb45bd4fdea7f06f52ca35ceac75
MD5 ac8c4749bf6969b683d35a61de2211b2
SHA1 da0334e84ec05b61982e9717d61ca73fd37225f1
SHA512 5e64ebc51e7b96b21cd754b26c98897c05b779eca93ebeb60dba3e441ac310039aac2aa0d48a919adaf20456cbe815c13675168e375f9d8a6c5a60ca1cf2b7f2
SSDEEP 24576:tgDdmMSirYbcMNgef0QeQjG/D8kIqJASk+RdhAdmvm:SEMSPbcBVQej/NAARdhnvm
MD5 SHA1 SHA512 SSDEEP