wannacry | 011e16a72ac0a2cb71d4f3a001bac0047f9578b176452ae3041942575a00a8a2

General

Target
011e16a72ac0a2cb71d4f3a001bac0047f9578b176452ae3041942575a00a8a2.dll
Size 5.0MB
Sample260311-wl6crafw2s
SHA256 011e16a72ac0a2cb71d4f3a001bac0047f9578b176452ae3041942575a00a8a2
MD5 928765bf46b1e554454c45b6cec1a8fd
SHA1 fec57d7257a6d8fa5984bfcba8da7e05e3aca7ae
SHA512 11bf159da7caa07b4305ebd72c5f18dc71bc18ce4d06e1d76436b0cfa908cc29c4b827be8b58719c12700a5e00dc9153e9d6b48f796045e254339abbf21d0ce1
SSDEEP 12288:T1bLgmluCti62lIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+D:RbLguripdmMSirYbcMNgef0
TLSH
T17E3612A6719C40F4C20A7230E4774A16F6B77C3E21B9960FEF908F652D53B92B624B53
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery wannacry ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Wannacry family
wannacry
Contacts a large (2675) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 3 IoCs

pid	Process
4936	mssecsvr.exe
996	mssecsvr.exe
5092	tasksche.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvr.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvr.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2496	5092	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvr.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvr.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3968 wrote to memory of 2220	3968	rundll32.exe	79
PID 2220 wrote to memory of 4936	2220	rundll32.exe	80
PID 4936 wrote to memory of 5092	4936	mssecsvr.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\011e16a72ac0a2cb71d4f3a001bac0047f9578b176452ae3041942575a00a8a2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\011e16a72ac0a2cb71d4f3a001bac0047f9578b176452ae3041942575a00a8a2.dll,#1
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\WINDOWS\mssecsvr.exe
    C:\WINDOWS\mssecsvr.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4936
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:5092
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 8
        5⤵
        Program crash
        
        PID:2496

C:\WINDOWS\mssecsvr.exe
C:\WINDOWS\mssecsvr.exe -m security
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5092 -ip 5092
1⤵
PID:3176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

1

T1046

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvr.exe

Path C:\Windows\mssecsvr.exe
Size 2.2MB
SHA256 1702720309963f6e0ed9967258147e0496e567a18febcef9654060888054e18d
MD5 ee2891d959c4e269135ea6966620eaf1
SHA1 ebff26bfd2207095244b506e70548bc4479d849f
SHA512 585877ac63c66c23ed57c22d88e6448da6371bb99d838779ba8011b66a54edcae4e79c586ab72283775e70ace0b04fdc031a3520f089d70c5a0c7afcc5fa2141
SSDEEP 12288:e1bLgmluCti62lIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+D:QbLguripdmMSirYbcMNgef0
TLSH
T1B2B522A6719C40F4C20A7230E4774A25F6B77C7E21B9960FEF908F652D53B92B224B53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 2.0MB
SHA256 750c5a133f721dddda0cb1ffc65e51a6c3e9d3443ea6694ae9714c85c03bc0f1
MD5 601e39021f2e338ce7c7d9be7c7069f3
SHA1 fc8a78857efdb966249ca918c2dddd033bba7c2e
SHA512 e2a2c072ad65ff4ce529fe1cb9373628a415aefa9ff6b95e96a7d99ab8a4fa6eeef0fbbd5bce3ae7094239febe82dff924378f3c6316980fe2cdd9b0f40aca3f
SSDEEP 12288:nti62lIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+D:tipdmMSirYbcMNgef0
TLSH
T1ED9523F2B0A121B1E70A7670F539590779E9567A30FA7A1AFFD00E50B846E63D3043D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/996-8-0x0000000001CB0000-0x0000000001D4C000-memory.dmp

Download

memory/2220-4-0x00000000006A0000-0x00000000006BA000-memory.dmp

Download

memory/4936-5-0x00000000032B0000-0x000000000334C000-memory.dmp

Download

memory/4936-12-0x00000000032B0000-0x000000000334C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads