wannacry | b7abdb377c1c28b4722d97093e022a8cee120102b7524c0c9f3e2a04d7ac0e95

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 22:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

77035824023eb4fc733ec1ef27a7a669_JaffaCakes118.dll
Size

5.0MB
MD5

77035824023eb4fc733ec1ef27a7a669
SHA1

50dcafea069c6b351a949873a170508dfa71e848
SHA256

b7abdb377c1c28b4722d97093e022a8cee120102b7524c0c9f3e2a04d7ac0e95
SHA512

edacfa391a18087a51aa3e1a7794cde8622d34d6934047387908177795835b8a5acb41c2884aee1624b95d5ed4ae20e7aa96af3749d58985bf669f35cfe63008
SSDEEP

49152:SnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H95elMKsv:+DqPoBhz1aRxcSUDk36SAEdhvxWa9

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3246) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Executes dropped EXE 3 IoCs

Processes:

mssecsvc.exemssecsvc.exetasksche.exe

pid process

212 mssecsvc.exe
2464 mssecsvc.exe
4320 tasksche.exe
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Drops file in Windows directory 2 IoCs

Processes:

rundll32.exemssecsvc.exe

description ioc process

File created C:\WINDOWS\mssecsvc.exe rundll32.exe
File created C:\WINDOWS\tasksche.exe mssecsvc.exe

pid	process
212	mssecsvc.exe
2464	mssecsvc.exe
4320	tasksche.exe

description	ioc	process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

mssecsvc.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 3932 wrote to memory of 1880	3932	rundll32.exe	rundll32.exe
PID 3932 wrote to memory of 1880	3932	rundll32.exe	rundll32.exe
PID 3932 wrote to memory of 1880	3932	rundll32.exe	rundll32.exe
PID 1880 wrote to memory of 212	1880	rundll32.exe	mssecsvc.exe
PID 1880 wrote to memory of 212	1880	rundll32.exe	mssecsvc.exe
PID 1880 wrote to memory of 212	1880	rundll32.exe	mssecsvc.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\77035824023eb4fc733ec1ef27a7a669_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3932

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\77035824023eb4fc733ec1ef27a7a669_JaffaCakes118.dll,#1
2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1880

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe
3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:212

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
4⤵
- Executes dropped EXE
PID:4320

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:2464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4216,i,14486271492189381216,15799931579469722648,262144 --variations-seed-version --mojo-platform-channel-handle=4072 /prefetch:8
1⤵
PID:3932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\mssecsvc.exe
Filesize
3.6MB

MD5
6d8ac76fe9d7f6d788d76b869affd933

SHA1
da5294f4a79d8f9af29fd15709061ef6843ee940

SHA256
beed9c3272e744daf676c3c3a478d9e39b6e6629260549670ea5e7d09bd704ba

SHA512
01be687f7de964428e46a185f3381fd735824a6d2249a83d48ad005c3d402098e5e0718ae9110a44f4b2da72117196248ea12c6de38207684c191da934920f5b

Download Submit
C:\Windows\tasksche.exe
Filesize
3.4MB

MD5
52231d8f6092ff9adb61e055607aaf44

SHA1
9d1d6e24a55a6ee4f26d28bbb7c1549d1b5b358b

SHA256
1092297edb12d3025f36bf2c8b23335cc77b963d0984632c86a61854021f3bfb

SHA512
3c4fa52df40324e7a9dce764135c30118bace5ed0d3ccb417073e6ba0595120d35eb0e43b5a3b75a1365d6064032d5c901846fbd6c4b0803b8f7fdab1721f062

Download Submit