wannacry | 917cae9858292d53f7df36e77902feb24356df753e264a9810d7f5a6afaed77f

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 01:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
48ffcb9ce1f4a1f343a1a61c50d3158b_JaffaCakes118.dll
Size 5.0MB
Sample240516-b64dnseh5t
SHA256 917cae9858292d53f7df36e77902feb24356df753e264a9810d7f5a6afaed77f
MD5 48ffcb9ce1f4a1f343a1a61c50d3158b
SHA1 8d53f6804659cf85a13d3f06d7436352ba69cf63
SHA512 e17601c11a9d448c8ee600c79194dd0074d2c48b4ce15ddcf13255272988d914e6b5e2e77edccaa9a390cb5bd8465d463e7792bd43d319f05e0d219111415b70
SSDEEP 49152:znAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9zb:TDqPoBhz1aRxcSUDk36SAEdhvxWa9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3284) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 3 IoCs

pid	Process
3128	mssecsvc.exe
1612	mssecsvc.exe
2124	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4012 wrote to memory of 3788	4012	rundll32.exe	83
PID 4012 wrote to memory of 3788	4012	rundll32.exe	83
PID 4012 wrote to memory of 3788	4012	rundll32.exe	83
PID 3788 wrote to memory of 3128	3788	rundll32.exe	84
PID 3788 wrote to memory of 3128	3788	rundll32.exe	84
PID 3788 wrote to memory of 3128	3788	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\48ffcb9ce1f4a1f343a1a61c50d3158b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\48ffcb9ce1f4a1f343a1a61c50d3158b_JaffaCakes118.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:3788
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:3128
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:2124

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:1612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 57c7a385bf60be82d33b802f0115724a926da622aefe578ffcb7d2003d8a7bdc
MD5 5ea3437f676be32ca76df137f55dc68c
SHA1 dbdb42e533353650d64c92e487fd4a0a533bca30
SHA512 de92611a38eb70b0881ded745006cbabc1fe7bda26a97691ed72ba54b86cee40a4e917b2f464566fe957054da762863231974260788157c0e3a8fa71e2505a2a
SSDEEP 49152:XnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9zbB:XDqPoBhz1aRxcSUDk36SAEdhvxWa9x
MD5 SHA1 SHA512 SSDEEP

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 6d2d307f7a28dda7fbafb6ac19ce10c8643d2d85197ed941bb3283669c14e165
MD5 d39512515a2f3e6008cc036887f93f1a
SHA1 ee8a4b939dc9250e6bdd0107677369030ae21959
SHA512 c2f539b6bd901a6561ad764a412f60b3d0ef734c6608ca070336f88a533ec81b57665a78dcb13e0274a6631e5df98bf3f0983b3d45267383df8df19ebd5d94f3
SSDEEP 49152:nQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9zbc:QqPoBhz1aRxcSUDk36SAEdhvxWa9M
MD5 SHA1 SHA512 SSDEEP