wannacry | 9debc5e72e428bf4bab1de706af71d56297db1fb0647c4f7afb0ab445d3f7807

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 04:40

Target

6d5b8b99056a0b2e5700472f3edfcaf6_JaffaCakes118.dll
Size

5.0MB
MD5

6d5b8b99056a0b2e5700472f3edfcaf6
SHA1

d17e4bdfc3aeacd46959c5fca60b51c4563648c4
SHA256

9debc5e72e428bf4bab1de706af71d56297db1fb0647c4f7afb0ab445d3f7807
SHA512

59975e14be89dbc7152f864bef0a8ce232076dd40aebda159ee1193ce1832454f6219bd685c54a78de5a9820e217b04ccc949fb8d72d6e0ec5b2ecdf23031b26
SSDEEP

98304:+8cPoBhz+aRxcSUDk36SAEdhvxWa9P593R8yAVp2H:+8cPe+Cxcxk3ZAEUadzR8yc4H

Score

10^/10

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3357) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Executes dropped EXE 3 IoCs

Processes:

mssecsvc.exemssecsvc.exetasksche.exe

pid process

5076 mssecsvc.exe
2452 mssecsvc.exe
3452 tasksche.exe
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Drops file in Windows directory 2 IoCs

Processes:

rundll32.exemssecsvc.exe

description ioc process

File created C:\WINDOWS\mssecsvc.exe rundll32.exe
File created C:\WINDOWS\tasksche.exe mssecsvc.exe

description	ioc	process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2252 wrote to memory of 224	2252	rundll32.exe	rundll32.exe
PID 2252 wrote to memory of 224	2252	rundll32.exe	rundll32.exe
PID 2252 wrote to memory of 224	2252	rundll32.exe	rundll32.exe
PID 224 wrote to memory of 5076	224	rundll32.exe	mssecsvc.exe
PID 224 wrote to memory of 5076	224	rundll32.exe	mssecsvc.exe
PID 224 wrote to memory of 5076	224	rundll32.exe	mssecsvc.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6d5b8b99056a0b2e5700472f3edfcaf6_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6d5b8b99056a0b2e5700472f3edfcaf6_JaffaCakes118.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:224
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:5076
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:3452

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
PID:2452

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\WINDOWS\mssecsvc.exe

Filesize
3.6MB

MD5
52106ec28b42c45f1fa6f47490caf074

SHA1
737c65bb1a7b44c35aee735ab4a552a1db406d4a

SHA256
57991b108c95a9b89dc8b791a4acbde0f733400ada952872e0df32dbe2ceac18

SHA512
d348dd6b961a6509c350cab09fc831f764816abf414b5ba566812195f6a0b53b38c2e0157eea01ec200f71c5ce6e62642123f621ab4f04569920c115b55c2e1d

Download Submit
C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
27b97c24e767ff1d1b9302c89e4ff007

SHA1
fcbe2979b6fe94b483914e3527f7f3fc84516170

SHA256
95613a93ce9f940b9cd828efdce24001e222e4265419d4a01119015875228f28

SHA512
8f4cafd0656c2745cefdacaf84f07736ec3d012fa4cade43a3bb2a035447e9b8805e37c3000e5f6498f7691f2445548bf9372744421d754d52a9033ecbdca3fb

Download Submit