wannacry | 3ed9aa7e2e3eb4fa3b843e03a267f287cb6fa96e720f216e8c8dc51e0342dd3a

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16/07/2024, 17:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4f53357da304a79b6cb55fd8de9a094c_JaffaCakes118.dll
Size 5.0MB
Sample240716-vyn4kasfnm
SHA256 3ed9aa7e2e3eb4fa3b843e03a267f287cb6fa96e720f216e8c8dc51e0342dd3a
MD5 4f53357da304a79b6cb55fd8de9a094c
SHA1 9c5c47270b57100cb7b3b03684c4f284bca65454
SHA512 d939fedd902bb1d8c279765edc825b3c5947d5bc45ec070840a9e9357bf46f28bef6f38c59549e9c77323c226bac0586002b7104403ee5295b7d240ce4c378d2
SSDEEP 12288:TQbLgmluyQhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+DHeQYSUjEXFy:MbLguVQhfdmMSirYbcMNgef0QeQjGZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (2084) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 2 IoCs

pid	Process
2300	mssecsvr.exe
4960	mssecsvr.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvr.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvr.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvr.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 1176	4548	rundll32.exe	83
PID 4548 wrote to memory of 1176	4548	rundll32.exe	83
PID 4548 wrote to memory of 1176	4548	rundll32.exe	83
PID 1176 wrote to memory of 2300	1176	rundll32.exe	85
PID 1176 wrote to memory of 2300	1176	rundll32.exe	85
PID 1176 wrote to memory of 2300	1176	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4f53357da304a79b6cb55fd8de9a094c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4f53357da304a79b6cb55fd8de9a094c_JaffaCakes118.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1176
- - C:\WINDOWS\mssecsvr.exe
    C:\WINDOWS\mssecsvr.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:2300

C:\WINDOWS\mssecsvr.exe
C:\WINDOWS\mssecsvr.exe -m security
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvr.exe

Path C:\Windows\mssecsvr.exe
Size 2.2MB
SHA256 daac74d376cdbcec144a430ed069c6776bf444491690e67af6e04495b32c7cdd
MD5 27252ec19ef563b68c895c0cbfa9624e
SHA1 bdf1ea9b2b018bd9cef77ce20f6d569ad2210c1a
SHA512 58abe6da32f3438197dc597bbc131024f7e2b371918b2159d046b039c2dce0b40ff6cdacaf4b80ee171cf6ac58f247d3d7a5b79cef30b537649b387939039e52
SSDEEP 12288:eQbLgmluyQhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+DHeQYSUjEXFg:VbLguVQhfdmMSirYbcMNgef0QeQjGZn
MD5 SHA1 SHA512 SSDEEP

Submit Download