wannacry | 97c2547aee3f7f293c81897608c649bc144e6f9cc30293e1b23afe0e9fc5ae99

General

Target
97c2547aee3f7f293c81897608c649bc144e6f9cc30293e1b23afe0e9fc5ae99.dll
Size 5.0MB
Sample260428-be148sb12v
SHA256 97c2547aee3f7f293c81897608c649bc144e6f9cc30293e1b23afe0e9fc5ae99
MD5 bff63cefd43b6a881ffc1e61dd0215ac
SHA1 577994f635567f7cde985d655d2db1bf3a652063
SHA512 bd2208c22dac53d780ea302682691d020c26793bae96ed7b67c2b1c8c37e3d9a32f3aeac758cbb43a91152161d277152cd96043e7061963d975bb1adde211b51
SSDEEP 49152:RnnMSPbcBVQej/1INRx+TSqTdX1HkQo6SAANsRj:1nPoBhz1aRxcSUDk36SAOCj
TLSH
T1AC360205A1E51BB4D6B21FF6217B8B10537A3D5589ABA25E1760A04F0C33F1CDEE2F29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery wannacry ransomware worm

Malware Config

Signatures

Family: Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (4190) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 3 IoCs

pid	Process
2740	mssecsvr.exe
2516	mssecsvr.exe
3392	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvr.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvr.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4948	3392	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvr.exe

Modifies data under HKEY_USERS 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History	mssecsvr.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 1596	2392	rundll32.exe	79
PID 1596 wrote to memory of 2740	1596	rundll32.exe	80
PID 2740 wrote to memory of 3392	2740	mssecsvr.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\97c2547aee3f7f293c81897608c649bc144e6f9cc30293e1b23afe0e9fc5ae99.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\97c2547aee3f7f293c81897608c649bc144e6f9cc30293e1b23afe0e9fc5ae99.dll,#1
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1596
- - C:\WINDOWS\mssecsvr.exe
    C:\WINDOWS\mssecsvr.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2740
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:3392
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3392 -s 8
        5⤵
        Program crash
        
        PID:4948

C:\WINDOWS\mssecsvr.exe
C:\WINDOWS\mssecsvr.exe -m security
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3392 -ip 3392
1⤵
PID:4864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

2

T1046

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvr.exe

Path C:\Windows\mssecsvr.exe
Size 2.2MB
SHA256 e2dac9514297997ed1c43ecf9ffbaea0913d8aacf30492eef3b4caf1a1435973
MD5 2ea5c92bc1b87d962886030d9221cd0b
SHA1 b96654d3faced3801d3d4ee2fa7dba929fb75e84
SHA512 6ffd948f7f98e629088737c50bf7dfed5e44ccca19502acae52f48cf7f1480161530cbc666eb12827216257d306ded603c33cf4149bf146bfed3acddd6ea7030
SSDEEP 49152:QnnMSPbcBVQej/1INRx+TSqTdX1HkQo6SAANsRjQ:QnPoBhz1aRxcSUDk36SAOCjQ
TLSH
T1BDB50205E1E51BA4D6B21FF6217B8B10537A3D5589ABA25E1760A04F0C33F1CDEE2F29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 2.0MB
SHA256 2c4413b501263dc2f12cccf0f3103ae8cf8a4982fae8834807414956a21e5af4
MD5 5426fd8e0574e3b23f843af14cb81c2f
SHA1 458b5f8039c619ccbbcb1725eacfd5d467ab3c4c
SHA512 1f8d983f5cd7ed88ca9662edb5c8573a067dfd4d1682da75c034dc792a29668ff39c876abf7dd633eb819aa1f1dddd0b6054845f3aa274cd4790c96625cc8ef2
SSDEEP 49152:9MSPbcBVQej/1INRx+TSqTdX1HkQo6SAANsRjS:9PoBhz1aRxcSUDk36SAOCjS
TLSH
T1F4950251E1E52B64D6F21EF6227B8700137A3E55C99BA25E1660A04F1C37F1CDEE2F28
MD5 SHA1 SHA512 SSDEEP TLSH