wannacry | 83d820c4d5ec752c466bf49490e3c42de9db44dffd76b7eb869fed7653b6eac1

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27-05-2024 02:38

Target

77a34248cc10e2188124973fcb3952a9_JaffaCakes118.dll
Size

5.0MB
MD5

77a34248cc10e2188124973fcb3952a9
SHA1

3aa9b023954894a0eed23fec6ba33796290cc5b1
SHA256

83d820c4d5ec752c466bf49490e3c42de9db44dffd76b7eb869fed7653b6eac1
SHA512

eab4ee90f11ba4f89479f012afb706646de671b1dcd531b98fabf7f7453fa12cb1cee18111bbe4f018a4681290915d44492751927fa32b09ec8b8b47de53fecb
SSDEEP

98304:T8qPoBhz1aRxcSUDk36SAEdhvxWa9P59Uc/F:T8qPe1Cxcxk3ZAEUadvF

Score

10^/10

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3089) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Executes dropped EXE 3 IoCs

Processes:

mssecsvc.exemssecsvc.exetasksche.exe

pid process

2396 mssecsvc.exe
3188 mssecsvc.exe
2112 tasksche.exe
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Drops file in Windows directory 2 IoCs

Processes:

rundll32.exemssecsvc.exe

description ioc process

File created C:\WINDOWS\mssecsvc.exe rundll32.exe
File created C:\WINDOWS\tasksche.exe mssecsvc.exe

description	ioc	process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 3144 wrote to memory of 1224	3144	rundll32.exe	rundll32.exe
PID 3144 wrote to memory of 1224	3144	rundll32.exe	rundll32.exe
PID 3144 wrote to memory of 1224	3144	rundll32.exe	rundll32.exe
PID 1224 wrote to memory of 2396	1224	rundll32.exe	mssecsvc.exe
PID 1224 wrote to memory of 2396	1224	rundll32.exe	mssecsvc.exe
PID 1224 wrote to memory of 2396	1224	rundll32.exe	mssecsvc.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\77a34248cc10e2188124973fcb3952a9_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3144

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
4⤵
- Executes dropped EXE
PID:2112

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
PID:3188

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

C:\Windows\mssecsvc.exe
Filesize
3.6MB

MD5
e42e740a3c6d8c143d38ea8a16e94b63

SHA1
a3b21b288d565fb0cd7c41534980d1cef4a4312e

SHA256
c7dce150cde43791fecaf7cc049259f2fc6742bce9e36933de35ff668cf5fcb3

SHA512
707069430e93fcb14afae16e995d5dc88c8b9037844c4c49a673efabb501c3274868236b4398ad1201b131d77aa44b4aad11ebeb132d1b6cddd816c4c769a244

Download Submit
C:\Windows\tasksche.exe
Filesize
3.4MB

MD5
44662faa774ba92d7fa2dc75621fd9e4

SHA1
556f78ecfba051f09eb0cac1254f6168f1e238c2

SHA256
7d60466ffff500a7528cd2b8182a9b28698c7ba72e1e8652f50d41bc135ca52f

SHA512
c45a618824ea11b5b1db272d4bc05281826599b802916c0ac857a027d7217c6c5438a10e4c3203f63fb7c0bfca58ed2e018fb0f3d23aa4fca1a8ca99dd3195a3

Download Submit