wannacry | d1df2a0fab72ebb3c8889e2d2dad722231a4f84a48b52b616352673f624da199

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/05/2024, 10:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5e9b954b8c515845290d7c35fb748559_JaffaCakes118.dll
Size 5.0MB
Sample240520-mkveesfe25
SHA256 d1df2a0fab72ebb3c8889e2d2dad722231a4f84a48b52b616352673f624da199
MD5 5e9b954b8c515845290d7c35fb748559
SHA1 485f2c2e04192571ea699ce86175fe6a03e0bce4
SHA512 4aafd953c361a75f7b1c07a3b7cae4f830a4e1551122584bff39a04124cbca249810a023ee43c22042af9a2918756c1afbd6fa14c63880c3a22bebce2017b6e3
SSDEEP 98304:+DqPoBQk36SAEdhvxWa9P593R8yAVp2H:+DqPtk3ZAEUadzR8yc4H
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3266) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 3 IoCs

pid	Process
5008	mssecsvc.exe
3608	mssecsvc.exe
836	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 1848	1684	rundll32.exe	83
PID 1684 wrote to memory of 1848	1684	rundll32.exe	83
PID 1684 wrote to memory of 1848	1684	rundll32.exe	83
PID 1848 wrote to memory of 5008	1848	rundll32.exe	84
PID 1848 wrote to memory of 5008	1848	rundll32.exe	84
PID 1848 wrote to memory of 5008	1848	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e9b954b8c515845290d7c35fb748559_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e9b954b8c515845290d7c35fb748559_JaffaCakes118.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1848
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:5008
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:836

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:3608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 10bb606f3ddc164ff302a03e0e534b6be3f485d1a9858b21978bb0cfd3df06ac
MD5 d0eed9be07964df59b247650b813c5a7
SHA1 d1dd0d719345bf8d23437587fa44a8b3e6aa6000
SHA512 bb2be5908e2bda6475d4f05b3267ab0b2442d208ef531c68853361d1e0b4b9450a184bcda4beb7603375ddf6514a39b68c34e2ae88a2ed355dd1359b12691f67
SSDEEP 98304:yDqPoBQk36SAEdhvxWa9P593R8yAVp2HI:yDqPtk3ZAEUadzR8yc4HI
MD5 SHA1 SHA512 SSDEEP

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 776f61e107b616a5008acb1794f359ac875cd0ed861be3730c60d8f42da977a8
MD5 9cf8869d9823f4ddac798510ab63e347
SHA1 56093197311a8edae0c3813756fa6a5813cad436
SHA512 ace5d0b5b15bda0726685576e10225fb5881ebe0b8ebdb28686f430cd4f4f679e46d7ae19976ec4406d57cb69f72265f30f6863de4b1b21ef79ebd34969a1dbe
SSDEEP 49152:nQqMSPbcBVcHkQo6SAARdhnvxJM0H9PAMEcaEau3R8yAH1plAHj:QqPoBQk36SAEdhvxWa9P593R8yAVp2Hj
MD5 SHA1 SHA512 SSDEEP