wannacry | 8d7b45158a36521b29feaa85ade3e1c5a17217983296f3621e74f00f1ca11ffa

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 17:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6bc69762e985011d54b061ad9974aa98_JaffaCakes118.dll
Size 5.0MB
Sample240523-wgf73aba92
SHA256 8d7b45158a36521b29feaa85ade3e1c5a17217983296f3621e74f00f1ca11ffa
MD5 6bc69762e985011d54b061ad9974aa98
SHA1 9aa0849bd79bb31928c8643b6e12f40b2fdedbb4
SHA512 6ea02c93ab905c2ee6e6df55d5f8c48a7931af0cb133ad1d7738a7d03486f2bfdd4854df22f35937e2f929aacdb1f6d099a93d447dcb34cd6a0dae75888bdeaf
SSDEEP 49152:JnjQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9P:d8qPoBhz1aRxcSUDk36SAEdhvxWa9P
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3383) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 3 IoCs

pid	Process
1820	mssecsvc.exe
1092	mssecsvc.exe
4032	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 1228	2660	rundll32.exe	85
PID 2660 wrote to memory of 1228	2660	rundll32.exe	85
PID 2660 wrote to memory of 1228	2660	rundll32.exe	85
PID 1228 wrote to memory of 1820	1228	rundll32.exe	86
PID 1228 wrote to memory of 1820	1228	rundll32.exe	86
PID 1228 wrote to memory of 1820	1228	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6bc69762e985011d54b061ad9974aa98_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6bc69762e985011d54b061ad9974aa98_JaffaCakes118.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1228
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:1820
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:4032

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
PID:1092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 446cdf7c462dec2304799b8fe65a01cccb0f9b96068a874e73bdbf476103a08a
MD5 076f36cfd60a202e33524171e67f0980
SHA1 c4fe7bb04f0fddf06b00d2c29062cc1d9d48e165
SHA512 ed6cb392d0948e520a7b8e72519fcd4107412d17349c2a213f10e36e2f94e069ff4fcbeb2367ec570c3f1304392fb425f476abf2502941d66e8dc9b2e4c9a3e7
SSDEEP 49152:VnjQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9P:Z8qPoBhz1aRxcSUDk36SAEdhvxWa9P
MD5 SHA1 SHA512 SSDEEP

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 dddcdf89c4e65ddd1a2146810284ffbef3128cad0c010bc88b6d5e94c1ffd119
MD5 8e3b802bafd4556bfc3c0d95e1426469
SHA1 b9b8bbe2b9e02aaec62dc7d6be44a2b10749410a
SHA512 fbf02d87bf489faad73e43fd26309fdf98b3a3295a5f33ee83dace8e4f4d8c05675efe913839c6323a2edb4e21a72041fa304312733005ecbbadb0719a9f918a
SSDEEP 49152:nQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9P:QqPoBhz1aRxcSUDk36SAEdhvxWa9P
MD5 SHA1 SHA512 SSDEEP