wannacry | 1c0c5c64a2269a0479814cafc612940ba1d842c95ca57974f66da0482b89ec4f

Analysis

max time kernel
150s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-06-2024 00:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

88e1eb906b7b52fc9e553e8618fc75ba_JaffaCakes118.dll
Size

5.0MB
MD5

88e1eb906b7b52fc9e553e8618fc75ba
SHA1

afb8cdd9f4b7e482736e38a00b823dc17aa7285f
SHA256

1c0c5c64a2269a0479814cafc612940ba1d842c95ca57974f66da0482b89ec4f
SHA512

01b1b70a0f560e427eda3d22e1e1c9e2d5cff2f4436e9599cf2265b2ec93ead11d355b5598a7b29c94e31c0a5c630ff85ef09e8ac088e414cc0ad1acc86a7baf
SSDEEP

98304:TDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2iV:TDqPe1Cxcxk3ZAEUadzR8yc4O

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3277) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Executes dropped EXE 3 IoCs

Processes:

mssecsvc.exemssecsvc.exetasksche.exe

pid process

3096 mssecsvc.exe
3188 mssecsvc.exe
2952 tasksche.exe
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Drops file in Windows directory 2 IoCs

Processes:

rundll32.exemssecsvc.exe

description ioc process

File created C:\WINDOWS\mssecsvc.exe rundll32.exe
File created C:\WINDOWS\tasksche.exe mssecsvc.exe

pid	process
3096	mssecsvc.exe
3188	mssecsvc.exe
2952	tasksche.exe

description	ioc	process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

mssecsvc.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 4964 wrote to memory of 3968	4964	rundll32.exe	rundll32.exe
PID 4964 wrote to memory of 3968	4964	rundll32.exe	rundll32.exe
PID 4964 wrote to memory of 3968	4964	rundll32.exe	rundll32.exe
PID 3968 wrote to memory of 3096	3968	rundll32.exe	mssecsvc.exe
PID 3968 wrote to memory of 3096	3968	rundll32.exe	mssecsvc.exe
PID 3968 wrote to memory of 3096	3968	rundll32.exe	mssecsvc.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\88e1eb906b7b52fc9e553e8618fc75ba_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4964

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\88e1eb906b7b52fc9e553e8618fc75ba_JaffaCakes118.dll,#1
2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3968

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe
3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3096

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
4⤵
- Executes dropped EXE
PID:2952

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:3188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4340,i,17096020621006928097,15544233752327415349,262144 --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:8
1⤵
PID:1108

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\mssecsvc.exe
Filesize
3.6MB

MD5
779b667c20fbf62faf9c7d8bc33c091c

SHA1
3a67d9f1a99c40847d6d8a0c48c1756fbebd7f80

SHA256
b1190c057b2547f2e0a92be6e9e516c77783e745a53db416b2dd33c435e8effb

SHA512
411d054af8a9bfd9d395d8b7215f6f7a8f0c0693af662062c4ab87bc2dc9de9326131b5cbb1c84ae95eb95ce173b2a19cad5d4973ed7b86fcd26fde72b9278ad

Download Submit
C:\Windows\tasksche.exe
Filesize
3.4MB

MD5
004bb5877da565bc4a68dc31379128e1

SHA1
5b0cdebd7c4568b6457b2013112f73a8b8285c23

SHA256
8d7f46ac465fee96db843f38a94eca73a0d314ece7174754323c965616452b5a

SHA512
394785ad0490f7cb065c8f6184a2ac70517301a5f16e65cf7a298432a9716059a7bd70d41afc136a023d417661cae763800da4c56d8c3a57a2ca396550e2cd19

Download Submit