wannacry | ed1e8661710ed3dd7a0c51ad89d612880808a29f643b5e870654b38659cb334a

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 07:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
38e60525fdf507e7eca01343066d3b94_JaffaCakes118.exe
Size 3.6MB
Sample240512-h3ttdshe75
SHA256 ed1e8661710ed3dd7a0c51ad89d612880808a29f643b5e870654b38659cb334a
MD5 38e60525fdf507e7eca01343066d3b94
SHA1 6c51990e8099ed024dda33da912936898e7a1eaf
SHA512 0c3eb1ee891456c7b3358e6eec70b2e23686c31438863ffedb6276011b1cbe468d8154b190e62d7bbb7a7ca9f8ac14cd822d8590ead4b6880440ffc3355155f5
SSDEEP 24576:VbLgdeJMSirYbcMNgem/D8kIqRYoAdNLKz6626M+v6N0PrlLlukqAH1pNZtA0p+s:VnjJMSPbcBb/1INRx+40hlEAH1plAHI
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3328) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 1 IoCs

pid	Process
4384	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	38e60525fdf507e7eca01343066d3b94_JaffaCakes118.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
604	4384	WerFault.exe	82
4064	4384	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 4384	4896	38e60525fdf507e7eca01343066d3b94_JaffaCakes118.exe	82
PID 4896 wrote to memory of 4384	4896	38e60525fdf507e7eca01343066d3b94_JaffaCakes118.exe	82
PID 4896 wrote to memory of 4384	4896	38e60525fdf507e7eca01343066d3b94_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\38e60525fdf507e7eca01343066d3b94_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\38e60525fdf507e7eca01343066d3b94_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4896
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:4384
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4384 -s 220
    3⤵
    - Program crash
    PID:604
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4384 -s 268
    3⤵
    - Program crash
    PID:4064

C:\Users\Admin\AppData\Local\Temp\38e60525fdf507e7eca01343066d3b94_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\38e60525fdf507e7eca01343066d3b94_JaffaCakes118.exe -m security
1⤵
PID:2168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4384 -ip 4384
1⤵
PID:376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4384 -ip 4384
1⤵
PID:1884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tasksche.exe

Path C:\WINDOWS\tasksche.exe
Size 3.4MB
SHA256 db1274085b0cde20c106cfb960a23b1f178488a26e81f45fd3ac2f2dcf7960a1
MD5 f4a366d844efe3d39a7558dc36bcdd08
SHA1 da06d2da77974d20e17cda81cc64933b70a3ace0
SHA512 50949243d29e4c4d3a3d394f1e1343b06cdf4a6ca2c42c35c76ec5f30c0a66431f2dabbb4625a178f2beeeabe8e807276d35b8361c309bd6db35f6120048e46f
SSDEEP 24576:nJMSirYbcMNgem/D8kIqRYoAdNLKz6626M+v6N0PrlLlukqAH1pNZtA0p+9XEkj:nJMSPbcBb/1INRx+40hlEAH1plAHj
MD5 SHA1 SHA512 SSDEEP

Submit Download