wannacry | 7b8749dd344ddf31957170efc80a2182fa53414436e09b169a99f404bd88ffa3

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15-07-2024 06:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

48873aa5ecae0c477169eacd4f7f120a_JaffaCakes118.dll
Size

5.0MB
MD5

48873aa5ecae0c477169eacd4f7f120a
SHA1

bde076efc39dd693d2c6e26345f8b74259af3362
SHA256

7b8749dd344ddf31957170efc80a2182fa53414436e09b169a99f404bd88ffa3
SHA512

0714b355a1a9a89ffda1b5cb2c4f6c8acbcd5da9afd5f2442733b54adc18926e426a80e5ab14fe3dc4af8ac97b47d496e3a1f2cbb6326b3acbf6e344b1527ee1
SSDEEP

12288:T1bLgmluCYQhMbaIMu7L5NVErCA4z2g6rTcbvz6SdSNs:RbLguqQhfdmMSirYbr6SA

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (2107) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Executes dropped EXE 2 IoCs

Processes:

mssecsvr.exemssecsvr.exe

pid process

1380 mssecsvr.exe
5012 mssecsvr.exe
Drops file in Windows directory 2 IoCs

Processes:

rundll32.exemssecsvr.exe

description ioc process

File created C:\WINDOWS\mssecsvr.exe rundll32.exe
File created C:\WINDOWS\tasksche.exe mssecsvr.exe

pid	process
1380	mssecsvr.exe
5012	mssecsvr.exe

description	ioc	process
File created	C:\WINDOWS\mssecsvr.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvr.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

mssecsvr.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvr.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 4352 wrote to memory of 668	4352	rundll32.exe	rundll32.exe
PID 4352 wrote to memory of 668	4352	rundll32.exe	rundll32.exe
PID 4352 wrote to memory of 668	4352	rundll32.exe	rundll32.exe
PID 668 wrote to memory of 1380	668	rundll32.exe	mssecsvr.exe
PID 668 wrote to memory of 1380	668	rundll32.exe	mssecsvr.exe
PID 668 wrote to memory of 1380	668	rundll32.exe	mssecsvr.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\48873aa5ecae0c477169eacd4f7f120a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4352

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\48873aa5ecae0c477169eacd4f7f120a_JaffaCakes118.dll,#1
2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:668

C:\WINDOWS\mssecsvr.exe
C:\WINDOWS\mssecsvr.exe
3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1380

C:\WINDOWS\mssecsvr.exe
C:\WINDOWS\mssecsvr.exe -m security
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:5012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\mssecsvr.exe

Filesize
2.2MB

MD5
d5bf81e39e7c75570f14ccb883c3cab8

SHA1
15b2dc179a303539d146e5162a20b6b2830df59b

SHA256
dfba9797efc71345fdabc25a2bbeb8c1ae31b09406f548fa84c8afca1ccafb2d

SHA512
137fb8661a6faf1737b094a45187b527f05c65aa602c8735f46d397619cb0966a1bd84304018cd388b44107a438ca9c71b7c09d8ac3320a72e17d1c296e67207

Download Submit