wannacry | 0e1ab75ab474f63458548f47eaa4f81564a8259adb2514db69154ba1ae3f5248

Resubmissions

04/05/2024, 14:04

240504-rdknvsah48 10

04/05/2024, 13:56

240504-q81g5aag24 10

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 13:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1307057e6fadcf0d67764b9b44a679f9_JaffaCakes118.dll
Size

5.0MB
MD5

1307057e6fadcf0d67764b9b44a679f9
SHA1

4613beaee1e9b76a80fe801e1f60be094e7dcea7
SHA256

0e1ab75ab474f63458548f47eaa4f81564a8259adb2514db69154ba1ae3f5248
SHA512

9abf5383d89d6dfd4cd3b4ebe27e0724a3d1c7e131c49f48c5f57e5d3bbacc7f36842e146da421d49a544332fdc8b6ef6a692155ba662976ade3eba805261b6c
SSDEEP

98304:TDqPoBhz1aRxcSUDk36SAEdhvxWa9P593e/:TDqPe1Cxcxk3ZAEUadze/

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3042) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 3 IoCs

pid	Process
3168	mssecsvc.exe
4500	mssecsvc.exe
4256	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 2368	4140	rundll32.exe	90
PID 4140 wrote to memory of 2368	4140	rundll32.exe	90
PID 4140 wrote to memory of 2368	4140	rundll32.exe	90
PID 2368 wrote to memory of 3168	2368	rundll32.exe	91
PID 2368 wrote to memory of 3168	2368	rundll32.exe	91
PID 2368 wrote to memory of 3168	2368	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1307057e6fadcf0d67764b9b44a679f9_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1307057e6fadcf0d67764b9b44a679f9_JaffaCakes118.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2368
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:3168
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:4256

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3712 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8
1⤵
PID:2244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\mssecsvc.exe

Filesize
3.6MB

MD5
29696311e8e276907d46ff93387e4d64

SHA1
7efca2527e5d143226f6b1f7cbb46ac5461df68f

SHA256
ea3ccc9228b5715ee494cf48ac3e16e7083a819327f078b4de11e2bd97011026

SHA512
e86cde7699d8cd0dc7b83dec7ac4a0aceb8ba4063d34273fe8262be3e1677b0f9af07dd751daef175fc0131952cac05fee5f8ad30323628cb3bcef530f1759ad

Download Submit
C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
37a6bb3b2972bb680119b16b231bc500

SHA1
7932eb4f9e6a10a551de47ef35f39cf9283300ef

SHA256
39e432a8eac4cfbb092bb4abba6911b88acbdfc52f9610b9dbf595b4d5f4b726

SHA512
be846abb162f53bab50073c9903c8a1c0ddc11e6d8a6da12dd52cdba71ecb233acf561a6b1b2d3a7a95acd122f005dbb14a80f017170c703eb486575c637236d

Download Submit