wannacry | 3a3ac12868676fe2f37ca52bde0d436c8757bc6a4895d4d435fcacc4f0619819

General

Target

a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe
Size

3.4MB
MD5

a9efa5efd2ed938506a419bfd08cd5d4
SHA1

13b5d6eca4409817c854d7fbd723d3bd3191ec73
SHA256

3a3ac12868676fe2f37ca52bde0d436c8757bc6a4895d4d435fcacc4f0619819
SHA512

4cb49609461b809884d6803a5c9da17910f03f894dfd94d101e42baa08381125d490ac5036ffeb5b4fcc4f28a8e51c623a6a577c781ab6877c1b142665be1538
SSDEEP

1536:Ao1Jfsh3MKNQugai+nN9S4A3v9q/j92FPVeaibszu93cLV/:AozecK+7hdV9qbmoaGDcLV

Score

10^/10

wannacry ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe

pid process

1096 a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe

Suspicious behavior: MapViewOfSection 21 IoCs

Processes:

a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe

pid	process
1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe
1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe
1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe
1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe
1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe
1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe
1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe
1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe
1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe
1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe
1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe
1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe
1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe
1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe
1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe
1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe
1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe
1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe
1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe
1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe
1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 1096 a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe

description	pid	process	target process
PID 1096 wrote to memory of 380	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	wininit.exe
PID 1096 wrote to memory of 380	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	wininit.exe
PID 1096 wrote to memory of 380	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	wininit.exe
PID 1096 wrote to memory of 380	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	wininit.exe
PID 1096 wrote to memory of 380	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	wininit.exe
PID 1096 wrote to memory of 380	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	wininit.exe
PID 1096 wrote to memory of 380	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	wininit.exe
PID 1096 wrote to memory of 396	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	csrss.exe
PID 1096 wrote to memory of 396	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	csrss.exe
PID 1096 wrote to memory of 396	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	csrss.exe
PID 1096 wrote to memory of 396	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	csrss.exe
PID 1096 wrote to memory of 396	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	csrss.exe
PID 1096 wrote to memory of 396	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	csrss.exe
PID 1096 wrote to memory of 396	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	csrss.exe
PID 1096 wrote to memory of 432	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	winlogon.exe
PID 1096 wrote to memory of 432	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	winlogon.exe
PID 1096 wrote to memory of 432	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	winlogon.exe
PID 1096 wrote to memory of 432	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	winlogon.exe
PID 1096 wrote to memory of 432	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	winlogon.exe
PID 1096 wrote to memory of 432	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	winlogon.exe
PID 1096 wrote to memory of 432	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	winlogon.exe
PID 1096 wrote to memory of 480	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	services.exe
PID 1096 wrote to memory of 480	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	services.exe
PID 1096 wrote to memory of 480	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	services.exe
PID 1096 wrote to memory of 480	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	services.exe
PID 1096 wrote to memory of 480	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	services.exe
PID 1096 wrote to memory of 480	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	services.exe
PID 1096 wrote to memory of 480	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	services.exe
PID 1096 wrote to memory of 488	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	lsass.exe
PID 1096 wrote to memory of 488	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	lsass.exe
PID 1096 wrote to memory of 488	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	lsass.exe
PID 1096 wrote to memory of 488	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	lsass.exe
PID 1096 wrote to memory of 488	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	lsass.exe
PID 1096 wrote to memory of 488	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	lsass.exe
PID 1096 wrote to memory of 488	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	lsass.exe
PID 1096 wrote to memory of 496	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	lsm.exe
PID 1096 wrote to memory of 496	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	lsm.exe
PID 1096 wrote to memory of 496	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	lsm.exe
PID 1096 wrote to memory of 496	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	lsm.exe
PID 1096 wrote to memory of 496	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	lsm.exe
PID 1096 wrote to memory of 496	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	lsm.exe
PID 1096 wrote to memory of 496	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	lsm.exe
PID 1096 wrote to memory of 600	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	svchost.exe
PID 1096 wrote to memory of 600	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	svchost.exe
PID 1096 wrote to memory of 600	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	svchost.exe
PID 1096 wrote to memory of 600	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	svchost.exe
PID 1096 wrote to memory of 600	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	svchost.exe
PID 1096 wrote to memory of 600	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	svchost.exe
PID 1096 wrote to memory of 600	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	svchost.exe
PID 1096 wrote to memory of 676	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	svchost.exe
PID 1096 wrote to memory of 676	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	svchost.exe
PID 1096 wrote to memory of 676	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	svchost.exe
PID 1096 wrote to memory of 676	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	svchost.exe
PID 1096 wrote to memory of 676	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	svchost.exe
PID 1096 wrote to memory of 676	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	svchost.exe
PID 1096 wrote to memory of 676	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	svchost.exe
PID 1096 wrote to memory of 752	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	svchost.exe
PID 1096 wrote to memory of 752	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	svchost.exe
PID 1096 wrote to memory of 752	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	svchost.exe
PID 1096 wrote to memory of 752	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	svchost.exe
PID 1096 wrote to memory of 752	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	svchost.exe
PID 1096 wrote to memory of 752	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	svchost.exe
PID 1096 wrote to memory of 752	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	svchost.exe
PID 1096 wrote to memory of 816	1096	a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe	svchost.exe

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:380

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
2⤵
PID:480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
3⤵
PID:600

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
4⤵
PID:1852

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS
3⤵
PID:676

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
3⤵
PID:752

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
3⤵
PID:816

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
4⤵
PID:1304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
3⤵
PID:848

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
3⤵
PID:988

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService
3⤵
PID:296

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
3⤵
PID:912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
3⤵
PID:400

C:\Windows\system32\taskhost.exe
"taskhost.exe"
3⤵
PID:1224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
3⤵
PID:2956

C:\Windows\system32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
3⤵
PID:2108

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
2⤵
PID:488

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
2⤵
PID:496

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:396

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:432

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1340

C:\Users\Admin\AppData\Local\Temp\a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a9efa5efd2ed938506a419bfd08cd5d4_JaffaCakes118.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1096

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1096-0-0x0000000000400000-0x0000000000762000-memory.dmp

Filesize
3.4MB

Download
memory/1096-2-0x0000000077160000-0x0000000077161000-memory.dmp

Filesize
4KB

Download
memory/1096-1-0x000000007715F000-0x0000000077160000-memory.dmp

Filesize
4KB

Download
memory/1096-3-0x0000000000400000-0x0000000000762000-memory.dmp

Filesize
3.4MB

Download

Analysis

Sharing