wannacry | cda44f585ff94fa76df7bc7194843b015ebc1f625a3ff1f462f5199c8f223db2

General

Target
cda44f585ff94fa76df7bc7194843b015ebc1f625a3ff1f462f5199c8f223db2.dll
Size 5.0MB
Sample261027-dd92vsce66
SHA256 cda44f585ff94fa76df7bc7194843b015ebc1f625a3ff1f462f5199c8f223db2
MD5 7607dde863c45124876f7565474ab1c8
SHA1 a48aba07fe75a04ffbd4e36073f086eadc667517
SHA512 04026835c85aabfcf04e6015fd5b29c6721ee39d708b1bb61da6d3437c426dfd7768c0aba9b990f4c0fc9c5ae07b53378561d3c2fdb7f81c305e708c867e2521
SSDEEP 24576:RbLguriIfEcQdIvrYbcMNgef0QeQjG/D8kIqRYoAd/Admv:RnpEjbcBVQej/1I/nv
TLSH
T1BF36136634ECC071D503163098ABCB62E5BABC392679654F7F904F3A2E23B92D715B43
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery wannacry ransomware worm

Malware Config

Signatures

Family: Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3376) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 3 IoCs

pid	Process
4936	mssecsvr.exe
2604	mssecsvr.exe
876	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvr.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvr.exe
File created	C:\Windows\__tmp_rar_sfx_access_check_240742578	tasksche.exe
File created	C:\Windows\eee.exe	tasksche.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	mssecsvr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	mssecsvr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	mssecsvr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	mssecsvr.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasksche.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvr.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 448 wrote to memory of 632	448	rundll32.exe	85
PID 632 wrote to memory of 4936	632	rundll32.exe	86
PID 4936 wrote to memory of 876	4936	mssecsvr.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cda44f585ff94fa76df7bc7194843b015ebc1f625a3ff1f462f5199c8f223db2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:448
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cda44f585ff94fa76df7bc7194843b015ebc1f625a3ff1f462f5199c8f223db2.dll,#1
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:632
- - C:\WINDOWS\mssecsvr.exe
    C:\WINDOWS\mssecsvr.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4936
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      PID:876

C:\WINDOWS\mssecsvr.exe
C:\WINDOWS\mssecsvr.exe -m security
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

2

T1046

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvr.exe

Path C:\Windows\mssecsvr.exe
Size 2.2MB
SHA256 ed2157ae6f7247fe30e474de04234c5287f375a956bf7f1cad3450b35419f12b
MD5 e8ce4df366859a89b4c4a55bd7ed2b5c
SHA1 c3f346539bf484c95001e4504df44a2eed6cb246
SHA512 2d053e141dfb3d6ec8ce0d089cb6fc735ab97c9bfb23cef6fd686a896b723f2728b87beb1e0f9d74c797a7ac284c2b0e8574008f3294b861b56fc9ddf9d75aa7
SSDEEP 24576:QbLguriIfEcQdIvrYbcMNgef0QeQjG/D8kIqRYoAd/Admvn:QnpEjbcBVQej/1I/nvn
TLSH
T1DCB5136534ACC071D503163098ABCB62E5BABC392679A54F7F904F3E2E23B92D715B43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 2.0MB
SHA256 82ad33b130c53b0e2b9648131dcb7dd529028d8eddf69ebf238ba645e48b52a7
MD5 2913420b26ae84cfad6461419e83c7ba
SHA1 03cdf5501d59d29d9d941832ce9d0978a809a0fa
SHA512 878ed64fe271cebb61fba9ed569b1188e3fd3ff1b652ad950d80b5c2e67c91d00519a3bf3ba4314d30b0f7f884a003b339d80b936ac16a8ec4eff276453f78f2
SSDEEP 24576:tiIfEcQdIvrYbcMNgef0QeQjG/D8kIqRYoAd/Admvm:XEjbcBVQej/1I/nvm
TLSH
T1809523B130A5D071D713163458EACB62A4BDB93526A6794BBFD00E3E7D20FA6C706783
MD5 SHA1 SHA512 SSDEEP TLSH