wannacry | 3d492ae73efacaf4eda545e5ab9ac4da31eb0150e1623b7d80fbacf6343722a1

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
18/06/2024, 14:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bc59684b5022145c6299f01b984cecd2_JaffaCakes118.dll
Size 5.0MB
Sample240618-rfqmwsxapb
SHA256 3d492ae73efacaf4eda545e5ab9ac4da31eb0150e1623b7d80fbacf6343722a1
MD5 bc59684b5022145c6299f01b984cecd2
SHA1 73d27d95025ce81d7d37a305568a1349c8c03940
SHA512 82fd9d854897f7d49b18b8e0197e680b42a4e5a1ee0a8a01dcbf87daa01b147dae3bd18b0cda18e9affe33461bf273017ac9a1c74881bb164503bad3c8ada8a2
SSDEEP 98304:+DqPoBhz1aRxcSUDk36SAEdhvxWa9P53AV/:+DqPe1Cxcxk3ZAEUad9A
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (2690) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 3 IoCs

pid	Process
2828	mssecsvc.exe
2292	mssecsvc.exe
3760	tasksche.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 3132	1680	rundll32.exe	82
PID 1680 wrote to memory of 3132	1680	rundll32.exe	82
PID 1680 wrote to memory of 3132	1680	rundll32.exe	82
PID 3132 wrote to memory of 2828	3132	rundll32.exe	83
PID 3132 wrote to memory of 2828	3132	rundll32.exe	83
PID 3132 wrote to memory of 2828	3132	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bc59684b5022145c6299f01b984cecd2_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bc59684b5022145c6299f01b984cecd2_JaffaCakes118.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:3132
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:2828
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:3760

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:2292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 8a7425ef508f689ea7a10a3ea27b93a1e15f4c5f10ffc06ffedfa8d02717b4d3
MD5 1c1079233bc85d6b06fa6ea74f163293
SHA1 ecddde028f03e6aad420f5646f13829392d314fc
SHA512 d88b3f19f8327a8adc527b1148d0d100a19e0803aa14a1a9fa4282111059284bc82fb1c49188fc00925dda8c643de72f3eb0b01f5441311f15cfe0ba3519b6d5
SSDEEP 98304:yDqPoBhz1aRxcSUDk36SAEdhvxWa9P53AV/V:yDqPe1Cxcxk3ZAEUad9AV
MD5 SHA1 SHA512 SSDEEP

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 3471c963c8045f319b8fef6983a8320c7f47a15dc254049741ecaf9727e744cb
MD5 07b0f168fce72efc3213ad1cb04b5c58
SHA1 76e007ebee710b0bf8f7e29e50e5e6406e5064c8
SHA512 8ff6e29e2f8442e5be8fbc48b890fedd0369954837b870561a7efaf2108c728b206400d7624b61523dc39c01b22d9b7d26f42b75f12776dff7fe5f4a9a9882b6
SSDEEP 98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P53AV/v:QqPe1Cxcxk3ZAEUad9Av
MD5 SHA1 SHA512 SSDEEP