wannacry | 9d793dff706f4db5ee042d8e953078093298578849151593641db17e479b739d

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2024, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4e6c5f2e8ed845b2a3b03db18c169284_JaffaCakes118.dll
Size 5.0MB
Sample240517-e5axhshd41
SHA256 9d793dff706f4db5ee042d8e953078093298578849151593641db17e479b739d
MD5 4e6c5f2e8ed845b2a3b03db18c169284
SHA1 902602d945d54c528acf71134a57490126118b7c
SHA512 7479fc1c3e61bee61661733832d5135d05b5a7b34c61b4d4441cc1df1b29b9be177f06334e03e1a6ee581770b46d8c6d7d90109b7026f437a4c60cd8b03ce798
SSDEEP 98304:+DqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2:+DqPe1Cxcxk3ZAEUadzR8yc4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3362) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 3 IoCs

pid	Process
2972	mssecsvc.exe
4516	mssecsvc.exe
2996	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3472 wrote to memory of 3952	3472	rundll32.exe	84
PID 3472 wrote to memory of 3952	3472	rundll32.exe	84
PID 3472 wrote to memory of 3952	3472	rundll32.exe	84
PID 3952 wrote to memory of 2972	3952	rundll32.exe	85
PID 3952 wrote to memory of 2972	3952	rundll32.exe	85
PID 3952 wrote to memory of 2972	3952	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4e6c5f2e8ed845b2a3b03db18c169284_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3472
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4e6c5f2e8ed845b2a3b03db18c169284_JaffaCakes118.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:3952
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:2972
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:2996

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 545b7a1966206b6cc47cbbe3f74008898dec644a79d36c6ff9c7941d83fc9ef3
MD5 9a99b7154faa6c48660d3dca1ea8ff61
SHA1 b0032dcab2b92a549bcba3843888210d32c44bd8
SHA512 23c63bb6d2f5039eab075c140609b11574e6075e8b621a85a9561741948a7401b06b38cac58217e6b976f5eff738c3cf652668f4f5c9f022f2e73c1ebbf3768d
SSDEEP 98304:yDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2:yDqPe1Cxcxk3ZAEUadzR8yc4
MD5 SHA1 SHA512 SSDEEP

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 c1c4a6518885dec0efa3d9e6bd5a51191e504e7081708c7de3f7d4c1f8c4523f
MD5 af29815495f198e50e12f45a40e61243
SHA1 466b564b77a858092b9a2d840480f64f01e93139
SHA512 12bd05d06d9c8d2f407eaac58b34d93d2f76c142b053f25375766af2d5dce78cf76cb55c0a1f6acd6b44ff7f644a1e919bef8ca6ddb74ea5edd42185be4cc648
SSDEEP 98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp22:QqPe1Cxcxk3ZAEUadzR8yc42
MD5 SHA1 SHA512 SSDEEP