wannacry | 376b1959b46f61a2e625f9ad968e18e65e09380300d1ced80270a4d9947b0cde

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17-06-2024 01:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b61a7de42bce5f5ba271c2798cba3deb_JaffaCakes118.dll
Size

5.0MB
MD5

b61a7de42bce5f5ba271c2798cba3deb
SHA1

b2f2c9305182148c69bb41bb2aa8ad84cc8d806c
SHA256

376b1959b46f61a2e625f9ad968e18e65e09380300d1ced80270a4d9947b0cde
SHA512

04bff42326aeaefc33e4b62a91bd7aae5101b7a2f24f4f37f662d9d233af99ceb34423830fa97887a78ddceffda8be13acd643cf5d9ebaff4d34c2fe8ecbd2d5
SSDEEP

98304:TDqPoBhz1aRxcSUDk36SAEdhvxWa9P593H:TDqPe1Cxcxk3ZAEUadzH

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (2679) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Executes dropped EXE 3 IoCs

Processes:

mssecsvc.exemssecsvc.exetasksche.exe

pid process

3208 mssecsvc.exe
1208 mssecsvc.exe
3552 tasksche.exe
Drops file in Windows directory 2 IoCs

Processes:

rundll32.exemssecsvc.exe

description ioc process

File created C:\WINDOWS\mssecsvc.exe rundll32.exe
File created C:\WINDOWS\tasksche.exe mssecsvc.exe

pid	process
3208	mssecsvc.exe
1208	mssecsvc.exe
3552	tasksche.exe

description	ioc	process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

mssecsvc.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 3584 wrote to memory of 116	3584	rundll32.exe	rundll32.exe
PID 3584 wrote to memory of 116	3584	rundll32.exe	rundll32.exe
PID 3584 wrote to memory of 116	3584	rundll32.exe	rundll32.exe
PID 116 wrote to memory of 3208	116	rundll32.exe	mssecsvc.exe
PID 116 wrote to memory of 3208	116	rundll32.exe	mssecsvc.exe
PID 116 wrote to memory of 3208	116	rundll32.exe	mssecsvc.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b61a7de42bce5f5ba271c2798cba3deb_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3584

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b61a7de42bce5f5ba271c2798cba3deb_JaffaCakes118.dll,#1
2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:116

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe
3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3208

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
4⤵
- Executes dropped EXE
PID:3552

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:1208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\mssecsvc.exe

Filesize
3.6MB

MD5
f93f6ccac08d3ff21e3c32c68f724738

SHA1
3bee4a1dc0065580a5210c319658d4195ca20d85

SHA256
7482d4202ac7d7eea35b4a0f8d12af6e0b5551d63ebe780584f49f1ee6729c13

SHA512
54fff2a937cc2a522d4a42ee061a24926ac83d141e2b6c479bf3c036c4065661f04bd744708a272e1c22b5ce28a4778b597ab90f7f216844f5499a067815243b

Download Submit
C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
043235ff25f1ca885f2f7941649c1dc8

SHA1
8a403573e794e6bde261d1693bb3fae0b5b8a83d

SHA256
5fe12b9573a0cb28cdc81f17d6aa1654ecd8319cdefb259b53283e81429df344

SHA512
51cf2b55f333ab9308e5e4e53664763d7afbb437cac29f356d1441ce509516b841ca27eb781f65e760aee7a3a1ce66b21677699a7882a05d10d0a774d29e104f

Download Submit