wannacry | 3bc4276c6bb5dbc8e7c840d78871819dafe3b2bf645bcc4bddcc301f756fabcc

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 02:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4440fa0e843bc60a876c220162995060_JaffaCakes118.dll
Size 5.0MB
Sample240515-dd53xaec52
SHA256 3bc4276c6bb5dbc8e7c840d78871819dafe3b2bf645bcc4bddcc301f756fabcc
MD5 4440fa0e843bc60a876c220162995060
SHA1 fb5d4b3a34f6416d925fc142a824fa5b939f5f00
SHA512 e51e1e3f226aeb0053849cc5107acf6efe76ed93858c2ba33514e7f79bd242ad89898af9bf1590d024a41702d3efd4b741b82a75093fd2ded47818707f4865b1
SSDEEP 98304:+DqPoBhz1ZxcSUDk36SAEdhvxWa9P593R8yAVp2H:+DqPe1Zxcxk3ZAEUadzR8yc4H
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3359) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 3 IoCs

pid	Process
2212	mssecsvc.exe
4580	mssecsvc.exe
3604	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 576 wrote to memory of 3464	576	rundll32.exe	81
PID 576 wrote to memory of 3464	576	rundll32.exe	81
PID 576 wrote to memory of 3464	576	rundll32.exe	81
PID 3464 wrote to memory of 2212	3464	rundll32.exe	82
PID 3464 wrote to memory of 2212	3464	rundll32.exe	82
PID 3464 wrote to memory of 2212	3464	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4440fa0e843bc60a876c220162995060_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:576
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4440fa0e843bc60a876c220162995060_JaffaCakes118.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:3464
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:2212
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:3604

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 4d3b7999a7531f72cced4b88425a6603418369139d7fe12a8c7c1e8c9b874826
MD5 b3176962327f205cd9dc69d44bffa31d
SHA1 5aee05c5a97717c9789f7e86547d84931b8d4d59
SHA512 02a5877a55a6a45c701d905dde3b044d45e7d9594ae3b09fb16ba3c04744d7459061ccd3517bbde52eadb165aa008668c180e8044edf8369bd029c6058a07c20
SSDEEP 98304:yDqPoBhz1ZxcSUDk36SAEdhvxWa9P593R8yAVp2HI:yDqPe1Zxcxk3ZAEUadzR8yc4HI
MD5 SHA1 SHA512 SSDEEP

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 3e2ceb1c20998be3ec9aa55a4ee5c7ac6e0572f98dbe00faeadcafc4c4fcbe3d
MD5 70fff8bd70923aa4484a681e4b31d699
SHA1 1e6bb736eba0a2462cf2305a8794fd7d44a95653
SHA512 1965d535763334cafb73a2d564fe738e22f6375269e4c1c6355a6c444f7258fe177b0551cb6bc08307e3e076249b0f926e73bdd6d3f7fc6f0fb5f08efe9ba01f
SSDEEP 98304:QqPoBhz1ZxcSUDk36SAEdhvxWa9P593R8yAVp2Hj:QqPe1Zxcxk3ZAEUadzR8yc4Hj
MD5 SHA1 SHA512 SSDEEP