wannacry | 3d6a4b20f63fa2eb9dc93db9fa7698130852df8f808aa3a893cb2be4d7a804e7

General

Target
3d6a4b20f63fa2eb9dc93db9fa7698130852df8f808aa3a893cb2be4d7a804e7.dll
Size 5.0MB
Sample261101-3rc2qady8x
SHA256 3d6a4b20f63fa2eb9dc93db9fa7698130852df8f808aa3a893cb2be4d7a804e7
MD5 f1f1d0c2094e11d312cee95a2566f602
SHA1 1e172415b45772003ddf07d5851ec8949a1cce0d
SHA512 0249e4ead646ef436b3ce1833cc274890538e4c3bd078aa69042cfcc4d550fe85f16389f0459790fbbfebe732766a4680774e5aa2c1f0757f2a9f6b58e5d45b2
SSDEEP 24576:SbLgddQhfdmMSirYbcMNgef0QeQjG/D8kIqRYoAdNLU6CbHRmkOnXTL5XIOUg+N4:SnAQqMSPbcBVQej/1INEbmQVvmd7
TLSH
T15536BE01D1D51AA0DAF21FF6216B9B10427E6F01D99BA26E2661A04F1C77F0CDDE6F2C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery wannacry ransomware worm

Malware Config

Signatures

Family: Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3360) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 3 IoCs

pid	Process
3344	mssecsvc.exe
3944	mssecsvc.exe
4696	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	mssecsvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	mssecsvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	mssecsvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	mssecsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvc.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5396 wrote to memory of 3868	5396	rundll32.exe	89
PID 3868 wrote to memory of 3344	3868	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3d6a4b20f63fa2eb9dc93db9fa7698130852df8f808aa3a893cb2be4d7a804e7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5396
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3d6a4b20f63fa2eb9dc93db9fa7698130852df8f808aa3a893cb2be4d7a804e7.dll,#1
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3868
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:3344
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:4696

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:3944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

2

T1046

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 0fab579ca90180d5c25b40a6b46d60670c9cdf8da2ad93f026ba4d55f6fae724
MD5 7449bee2f56f1adf918a68e806027d76
SHA1 525b8303745dbe38ddfc9265f810c0075fe4ee04
SHA512 6903d4dcd4543bbe881c81f5b2113fafef3aa4cad003b24f91fd46ad0b36595ef0021c1fd0835155416b02771edd81ea8db0c81f53351e24e58c629f73a7b9a2
SSDEEP 24576:2bLgddQhfdmMSirYbcMNgef0QeQjG/D8kIqRYoAdNLU6CbHRmkOnXTL5XIOUg+NZ:2nAQqMSPbcBVQej/1INEbmQVvmd7Q
TLSH
T1F106BE01D1D51AA0DAF21FF6216B9B10427E6F01D99BA26E2661A04F1C77F0CDDE6F2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 bcd433ed00477ac7d75b8b0de647525afffd2813d88ff0a91c10e044ec94f609
MD5 3c94e03808e0fdf6444c12690ed1ddbd
SHA1 4df7af7a837e79d87472794924d0d6c5e3923252
SHA512 d112557b0146b0f1a71610ea7f10b738995b4fec48d8ac5b841f5a975327a032079329c6243e407885271829c17800e3ee966b355b062ac5c0af9dd62a9169fc
SSDEEP 24576:nQhfdmMSirYbcMNgef0QeQjG/D8kIqRYoAdNLU6CbHRmkOnXTL5XIOUg+NQYPSWi:nQqMSPbcBVQej/1INEbmQVvmd7D
TLSH
T184F5AE41D1D51AA0EAF21FF6226B9710427E6F41D99BA26E1661A04F1C37F0CCDE6F2C
MD5 SHA1 SHA512 SSDEEP TLSH