wannacry | 7160df3b9435eab5e5cc458250447dd2e02277b44df34f2fefeae59eba93d657

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
29-05-2024 03:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7f6d93e9834b0aaf7cee7730a74911da_JaffaCakes118.dll
Size

5.0MB
MD5

7f6d93e9834b0aaf7cee7730a74911da
SHA1

f0c9ea2fb89acc331b1a54ef1034bed8b3200fd0
SHA256

7160df3b9435eab5e5cc458250447dd2e02277b44df34f2fefeae59eba93d657
SHA512

2f62cfc9b67a756214578899a3290bcb59c491a1f3e3f52e73444a2c94781d4fdc515cd625309fb58d303b6734041d1bc642aa40969ddb324920c1d4524f9d2a
SSDEEP

49152:JnjQqMSPbcBVQej/dINRx+TSqTdX1HkQo6SAARdhnvxJM0H9PAMEcaEa:d8qPoBhzdaRxcSUDk36SAEdhvxWa9P5

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3280) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Executes dropped EXE 3 IoCs

Processes:

mssecsvc.exemssecsvc.exetasksche.exe

pid process

2076 mssecsvc.exe
2676 mssecsvc.exe
2640 tasksche.exe
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

pid	process
2076	mssecsvc.exe
2676	mssecsvc.exe
2640	tasksche.exe

Drops file in System32 directory 1 IoCs

Processes:

mssecsvc.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	mssecsvc.exe

Drops file in Windows directory 2 IoCs

Processes:

rundll32.exemssecsvc.exe

description ioc process

File created C:\WINDOWS\mssecsvc.exe rundll32.exe
File created C:\WINDOWS\tasksche.exe mssecsvc.exe
Modifies data under HKEY_USERS 1 IoCs

Processes:

mssecsvc.exe

description ioc process

Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe

description	ioc	process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvc.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2236 wrote to memory of 2232	2236	rundll32.exe	rundll32.exe
PID 2236 wrote to memory of 2232	2236	rundll32.exe	rundll32.exe
PID 2236 wrote to memory of 2232	2236	rundll32.exe	rundll32.exe
PID 2236 wrote to memory of 2232	2236	rundll32.exe	rundll32.exe
PID 2236 wrote to memory of 2232	2236	rundll32.exe	rundll32.exe
PID 2236 wrote to memory of 2232	2236	rundll32.exe	rundll32.exe
PID 2236 wrote to memory of 2232	2236	rundll32.exe	rundll32.exe
PID 2232 wrote to memory of 2076	2232	rundll32.exe	mssecsvc.exe
PID 2232 wrote to memory of 2076	2232	rundll32.exe	mssecsvc.exe
PID 2232 wrote to memory of 2076	2232	rundll32.exe	mssecsvc.exe
PID 2232 wrote to memory of 2076	2232	rundll32.exe	mssecsvc.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7f6d93e9834b0aaf7cee7730a74911da_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2236

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7f6d93e9834b0aaf7cee7730a74911da_JaffaCakes118.dll,#1
2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2232

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe
3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2076

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
4⤵
- Executes dropped EXE
PID:2640

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\mssecsvc.exe
Filesize
3.6MB

MD5
4a318dde3f6fd8e29a4fc081d6e5d036

SHA1
2c92f88ff06ab59fdf555d51bce8932619154d40

SHA256
4271161dec448725d7cf12ff4fe2dad5d2523e2b744ba883ae0f7bd2c28bdc0f

SHA512
2c05852cfac4ea166f3ce0c3e63945b24593fa88d8a301748644420869998682bbd85adec0ff71d8959b820f5af495268e1c5914e4a2a24e768af08855745003

Download Submit
C:\Windows\tasksche.exe
Filesize
3.4MB

MD5
124c8169db86fd0a69627ef027413b21

SHA1
442a9bc215b4d5aa8736587b7472ed161322943d

SHA256
59037cfa76bfc4e0cc8965596f0f3e4ca86a5940ec0537b86c6ceeffd7e687b7

SHA512
d0cbbff0fd4f67564b86f1ae1c75ccafed4c5573ab5ed1b5655453dad5913af95d149ed41441cbcb61e9da4ed5799813b4a8f7592c993ab370b737efc21de095

Download Submit