wannacry | 9debc5e72e428bf4bab1de706af71d56297db1fb0647c4f7afb0ab445d3f7807

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 04:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6d5b8b99056a0b2e5700472f3edfcaf6_JaffaCakes118.dll
Size

5.0MB
MD5

6d5b8b99056a0b2e5700472f3edfcaf6
SHA1

d17e4bdfc3aeacd46959c5fca60b51c4563648c4
SHA256

9debc5e72e428bf4bab1de706af71d56297db1fb0647c4f7afb0ab445d3f7807
SHA512

59975e14be89dbc7152f864bef0a8ce232076dd40aebda159ee1193ce1832454f6219bd685c54a78de5a9820e217b04ccc949fb8d72d6e0ec5b2ecdf23031b26
SSDEEP

98304:+8cPoBhz+aRxcSUDk36SAEdhvxWa9P593R8yAVp2H:+8cPe+Cxcxk3ZAEUadzR8yc4H

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3104) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Executes dropped EXE 3 IoCs

Processes:

mssecsvc.exemssecsvc.exetasksche.exe

pid process

2876 mssecsvc.exe
2396 mssecsvc.exe
2160 tasksche.exe
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

pid	process
2876	mssecsvc.exe
2396	mssecsvc.exe
2160	tasksche.exe

Drops file in System32 directory 1 IoCs

Processes:

mssecsvc.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	mssecsvc.exe

Drops file in Windows directory 2 IoCs

Processes:

rundll32.exemssecsvc.exe

description ioc process

File created C:\WINDOWS\mssecsvc.exe rundll32.exe
File created C:\WINDOWS\tasksche.exe mssecsvc.exe
Modifies data under HKEY_USERS 1 IoCs

Processes:

mssecsvc.exe

description ioc process

Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe

description	ioc	process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvc.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 836 wrote to memory of 2436	836	rundll32.exe	rundll32.exe
PID 836 wrote to memory of 2436	836	rundll32.exe	rundll32.exe
PID 836 wrote to memory of 2436	836	rundll32.exe	rundll32.exe
PID 836 wrote to memory of 2436	836	rundll32.exe	rundll32.exe
PID 836 wrote to memory of 2436	836	rundll32.exe	rundll32.exe
PID 836 wrote to memory of 2436	836	rundll32.exe	rundll32.exe
PID 836 wrote to memory of 2436	836	rundll32.exe	rundll32.exe
PID 2436 wrote to memory of 2876	2436	rundll32.exe	mssecsvc.exe
PID 2436 wrote to memory of 2876	2436	rundll32.exe	mssecsvc.exe
PID 2436 wrote to memory of 2876	2436	rundll32.exe	mssecsvc.exe
PID 2436 wrote to memory of 2876	2436	rundll32.exe	mssecsvc.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6d5b8b99056a0b2e5700472f3edfcaf6_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:836
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6d5b8b99056a0b2e5700472f3edfcaf6_JaffaCakes118.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2436
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:2876
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:2160

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\mssecsvc.exe

Filesize
3.6MB

MD5
52106ec28b42c45f1fa6f47490caf074

SHA1
737c65bb1a7b44c35aee735ab4a552a1db406d4a

SHA256
57991b108c95a9b89dc8b791a4acbde0f733400ada952872e0df32dbe2ceac18

SHA512
d348dd6b961a6509c350cab09fc831f764816abf414b5ba566812195f6a0b53b38c2e0157eea01ec200f71c5ce6e62642123f621ab4f04569920c115b55c2e1d

Download Submit
C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
27b97c24e767ff1d1b9302c89e4ff007

SHA1
fcbe2979b6fe94b483914e3527f7f3fc84516170

SHA256
95613a93ce9f940b9cd828efdce24001e222e4265419d4a01119015875228f28

SHA512
8f4cafd0656c2745cefdacaf84f07736ec3d012fa4cade43a3bb2a035447e9b8805e37c3000e5f6498f7691f2445548bf9372744421d754d52a9033ecbdca3fb

Download Submit