wannacry | b1fa3ea8a7772409ca68333e3d8f3de0eb7539b61adf1607e5044a62be06b0de

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
06-05-2024 13:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1cd189d20cacd41f7f5b39ffc5e68ba1_JaffaCakes118.dll
Size

5.0MB
MD5

1cd189d20cacd41f7f5b39ffc5e68ba1
SHA1

f315a8ae206cf5cbd37378f91fda78dd4b8c314d
SHA256

b1fa3ea8a7772409ca68333e3d8f3de0eb7539b61adf1607e5044a62be06b0de
SHA512

0710d528c151b0446819e578d55f805c4e61edfc9336968cf6298391403033d40ddf03b02700d522589b148e8b6a7dc0d0c9a8e0451e54a9b1c1ed5777d1dfab
SSDEEP

98304:+DqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2:+DqPe1Cxcxk3ZAEUadzR8yc4

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3336) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Executes dropped EXE 3 IoCs

Processes:

mssecsvc.exemssecsvc.exetasksche.exe

pid process

3112 mssecsvc.exe
4552 mssecsvc.exe
1284 tasksche.exe
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Drops file in Windows directory 2 IoCs

Processes:

rundll32.exemssecsvc.exe

description ioc process

File created C:\WINDOWS\mssecsvc.exe rundll32.exe
File created C:\WINDOWS\tasksche.exe mssecsvc.exe

pid	process
3112	mssecsvc.exe
4552	mssecsvc.exe
1284	tasksche.exe

description	ioc	process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

mssecsvc.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 3096 wrote to memory of 4788	3096	rundll32.exe	rundll32.exe
PID 3096 wrote to memory of 4788	3096	rundll32.exe	rundll32.exe
PID 3096 wrote to memory of 4788	3096	rundll32.exe	rundll32.exe
PID 4788 wrote to memory of 3112	4788	rundll32.exe	mssecsvc.exe
PID 4788 wrote to memory of 3112	4788	rundll32.exe	mssecsvc.exe
PID 4788 wrote to memory of 3112	4788	rundll32.exe	mssecsvc.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1cd189d20cacd41f7f5b39ffc5e68ba1_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3096

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1cd189d20cacd41f7f5b39ffc5e68ba1_JaffaCakes118.dll,#1
2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4788

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe
3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3112

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
4⤵
- Executes dropped EXE
PID:1284

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\mssecsvc.exe
Filesize
3.6MB

MD5
4a9815b8312314be39102cd74ef8441c

SHA1
625de2c76e7ae28ed839ec44a1faad849f7895b1

SHA256
191724d26ea2ee0337d891f04480c0a2c20a26c8f661cb9ba40590933428c1f7

SHA512
8e50a6d842c7bb3c4733bf97e9d2c6339cf6a9a8c41656a8e5eb6f04eae9733f623578ed5a0a6dc8bf4dd1444dfa0965d3edc8c6960b2ae03753b68e0e92f489

Download Submit
C:\Windows\tasksche.exe
Filesize
3.4MB

MD5
cfd3f33766aac90f99074c5d063636e7

SHA1
e84a369096409770d2f028ad3e6c16f21628a583

SHA256
845316a109f3e76911ca4691755bbfda91daf21d89c7cf22168a824eeab3cf64

SHA512
ec9161f2d4b18738b5040d3e58684a15bfe7f12810bae29cdec1ef2c853cf7100c49a831a17e13884e3cd176b1f4ecae19fb0f7a11f3005cd2b35e56fa957eac

Download Submit