wannacry | 2afeaccb7fdf6d07c4d8f437bbb58adad9bd0b227e9349a25016bd3a115fd118

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
31-05-2024 09:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

868f1599ae2b356fdc27bdbafae43ca6_JaffaCakes118.dll
Size

5.0MB
MD5

868f1599ae2b356fdc27bdbafae43ca6
SHA1

bc0fdeaf919774b8b5e69a04cb6d76e852367589
SHA256

2afeaccb7fdf6d07c4d8f437bbb58adad9bd0b227e9349a25016bd3a115fd118
SHA512

1839140ef722cab5d60796e4f9a56c9caa71508e452701c22f08cd5bf090429329f315ba04bd1e13eb74f8536d067f9d70fdc7c52306f8dfa2927ad6cf2e5bcb
SSDEEP

49152:SnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAAVAMEcaEau3RCgHAD:+DqPoBhz1aRxcSUDk36SA6593R

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3355) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Executes dropped EXE 3 IoCs

Processes:

mssecsvc.exemssecsvc.exetasksche.exe

pid process

3736 mssecsvc.exe
4800 mssecsvc.exe
2808 tasksche.exe
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Drops file in Windows directory 2 IoCs

Processes:

rundll32.exemssecsvc.exe

description ioc process

File created C:\WINDOWS\mssecsvc.exe rundll32.exe
File created C:\WINDOWS\tasksche.exe mssecsvc.exe

pid	process
3736	mssecsvc.exe
4800	mssecsvc.exe
2808	tasksche.exe

description	ioc	process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

mssecsvc.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 3936 wrote to memory of 3820	3936	rundll32.exe	rundll32.exe
PID 3936 wrote to memory of 3820	3936	rundll32.exe	rundll32.exe
PID 3936 wrote to memory of 3820	3936	rundll32.exe	rundll32.exe
PID 3820 wrote to memory of 3736	3820	rundll32.exe	mssecsvc.exe
PID 3820 wrote to memory of 3736	3820	rundll32.exe	mssecsvc.exe
PID 3820 wrote to memory of 3736	3820	rundll32.exe	mssecsvc.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\868f1599ae2b356fdc27bdbafae43ca6_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3936

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\868f1599ae2b356fdc27bdbafae43ca6_JaffaCakes118.dll,#1
2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3820

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe
3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3736

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
4⤵
- Executes dropped EXE
PID:2808

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\mssecsvc.exe
Filesize
3.6MB

MD5
b66b59512338bad332a602c2ae512451

SHA1
8a284481795f8138d75aa062a7d5fb4f32a796ac

SHA256
aac6b21e9fe5580d72170e398fe8a66a76729a860ea710e2d826336414363438

SHA512
7535a16b0ae97668e781e831f40711e54d5a535321bec00676758c7ec44a203ab1886e7e17ef0298d5496552b1f30865790eb9ac2b723555f6a9413a5830bed0

Download Submit
C:\Windows\tasksche.exe
Filesize
3.4MB

MD5
3fff988af3f2bcc308278678800ba203

SHA1
cc767aad48dba273423ef7ab0c51025d86179135

SHA256
eb66210b36f1d2c4b5588eedbf78f85b00c59a2561f21e1643f062961440eb71

SHA512
e7da085c91c6b3da4111fc80cd7ecbf8f638495011f98fbb5493c7ab61257e42da8b9bdbe1da2de84d6b9f2fbd058d1b3cb50dd68d03f1fc266e8da0de8529dd

Download Submit