wannacry | 672a2ff15bf6db8941c0318d572289a03224f6d3670ec8d9d89761c97f5672f0

Analysis

max time kernel
154s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29-05-2024 02:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7f49197d5c24d409c7788733d9a6691d_JaffaCakes118.dll
Size

5.0MB
MD5

7f49197d5c24d409c7788733d9a6691d
SHA1

385542727cb1c053e4bf0bcc7df3eac6d7676de3
SHA256

672a2ff15bf6db8941c0318d572289a03224f6d3670ec8d9d89761c97f5672f0
SHA512

41ea340fa7e3dc9a4f0bf52a5f3a43bb5129725362848c838296d774abb6074fb6b367c2e2bbdc9e3f2390f2accb943a594546203e1ce0c5a59c2365422b5f25
SSDEEP

98304:+DqPoBhz1aRxcSUDk36SAEdhvxWa9P59Uc/:+DqPe1Cxcxk3ZAEUadv

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (2619) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Executes dropped EXE 3 IoCs

Processes:

mssecsvc.exemssecsvc.exetasksche.exe

pid process

2604 mssecsvc.exe
2108 mssecsvc.exe
4060 tasksche.exe
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Drops file in Windows directory 2 IoCs

Processes:

rundll32.exemssecsvc.exe

description ioc process

File created C:\WINDOWS\mssecsvc.exe rundll32.exe
File created C:\WINDOWS\tasksche.exe mssecsvc.exe

pid	process
2604	mssecsvc.exe
2108	mssecsvc.exe
4060	tasksche.exe

description	ioc	process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

mssecsvc.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2132 wrote to memory of 2120	2132	rundll32.exe	rundll32.exe
PID 2132 wrote to memory of 2120	2132	rundll32.exe	rundll32.exe
PID 2132 wrote to memory of 2120	2132	rundll32.exe	rundll32.exe
PID 2120 wrote to memory of 2604	2120	rundll32.exe	mssecsvc.exe
PID 2120 wrote to memory of 2604	2120	rundll32.exe	mssecsvc.exe
PID 2120 wrote to memory of 2604	2120	rundll32.exe	mssecsvc.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7f49197d5c24d409c7788733d9a6691d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2132

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7f49197d5c24d409c7788733d9a6691d_JaffaCakes118.dll,#1
2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2120

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe
3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2604

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
4⤵
- Executes dropped EXE
PID:4060

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:2108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4092 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:8
1⤵
PID:4972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\mssecsvc.exe
Filesize
3.6MB

MD5
4c191ceedf068722262c9017c403ab7f

SHA1
b3abf0e6b5028d78b8690553b89ce1187ce04e38

SHA256
334852c16dc9068402ef1b5769eb2d162c964fb2fda08a41f6059b045a73167a

SHA512
434b0ae00c392a364f49d3f9e49d729355385798e9c7c1bd68259097348c3fbeab2951eed066fa5444e8bedd371c879ae89a1b93c490e9392ca8514509d1a939

Download Submit
C:\Windows\tasksche.exe
Filesize
3.4MB

MD5
03ab7e15db3770aca81bf40984996596

SHA1
518e2b1cd65da706537151ed63601b6a03179762

SHA256
a18fd9a0cd29de9728d47d9462fa45f42fee5059e51524c6041c29df349ea42a

SHA512
77a2016550381d60bad0dcd36a04bbcb794cf48074c8c871708ed8fd074a17d5ecb2ffc552a8c255055de492a0b1fb9999686e8aa8fe8758a3e6dd5c7ba46381

Download Submit