wannacry | f495d34a21134295ddf1425fd4f471b659fd46e8d35e954bcd02b81b3dfdd3ee

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
20-05-2024 22:41

Target

612b79c7d1edab76db51047ccb5f85c1_JaffaCakes118.dll
Size

5.0MB
MD5

612b79c7d1edab76db51047ccb5f85c1
SHA1

cf3b6de3fc093574d3a4f580cbc0ae8bbea19dbf
SHA256

f495d34a21134295ddf1425fd4f471b659fd46e8d35e954bcd02b81b3dfdd3ee
SHA512

560b591d7dd743f2cc37899be411bbf6d9c84e8f2f4cb5b71b967b0b6b813b4b34b151af6ec62caa3c326e54f429cebef768180129c78322f1bd8f99d2c6b97d
SSDEEP

49152:SnAQqMSPbcBVQej/1INRx+TSqTJ6SAARdhnvxJM0H9PAMEcaEau3I:+DqPoBhz1aRxcSUJ6SAEdhvxWa9P593

Score

10^/10

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3207) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Executes dropped EXE 3 IoCs

Processes:

mssecsvc.exemssecsvc.exetasksche.exe

pid process

1784 mssecsvc.exe
3840 mssecsvc.exe
4064 tasksche.exe
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Drops file in Windows directory 2 IoCs

Processes:

rundll32.exemssecsvc.exe

description ioc process

File created C:\WINDOWS\mssecsvc.exe rundll32.exe
File created C:\WINDOWS\tasksche.exe mssecsvc.exe

description	ioc	process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

mssecsvc.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 668 wrote to memory of 908	668	rundll32.exe	rundll32.exe
PID 668 wrote to memory of 908	668	rundll32.exe	rundll32.exe
PID 668 wrote to memory of 908	668	rundll32.exe	rundll32.exe
PID 908 wrote to memory of 1784	908	rundll32.exe	mssecsvc.exe
PID 908 wrote to memory of 1784	908	rundll32.exe	mssecsvc.exe
PID 908 wrote to memory of 1784	908	rundll32.exe	mssecsvc.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\612b79c7d1edab76db51047ccb5f85c1_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:668
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\612b79c7d1edab76db51047ccb5f85c1_JaffaCakes118.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:908
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:1784
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:4064

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Windows\mssecsvc.exe

Filesize
3.6MB

MD5
9570b5044470f6f611b4fbadf5653907

SHA1
b88a572230b25e22353242fd45b9f3693720c257

SHA256
84241ef8713eff74e07edfa1678922b22bf9faf39ff36c1bb96ce6f9b846a006

SHA512
e9e97ac7b91f9493e2257db5129a83c2774c517fb284c6ebd142864f9fa42f91f71d07aee99fb9b5c268e13f502687a0bc9e06b627a006d657b76f0c19768ffb

Download Submit
C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
cb72f9f69e4f4535683fec1183d4005d

SHA1
f931593bc4c090d6ca2f739b64531efd69b1e4e4

SHA256
ad2e976654f81ac59aca04747e12d8975b4e2ceaae559c105ed7021e7e122ba8

SHA512
aa75c74d748561b70349e414dc28812184f842eb13a4094f18beae82dbe31699f89361e0dfefa7616460f3318c54e7ba2e6c85962601a8d161129396242f628e

Download Submit