wannacry | e6a3ac4235b6ef444de81213a9c13c6ab5f208f67a240afb5e9182ff538425a5

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
18-07-2024 03:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

560c8d8b51659d30527fe62dcc0cb4e5_JaffaCakes118.dll
Size

5.0MB
MD5

560c8d8b51659d30527fe62dcc0cb4e5
SHA1

5ef485f0841f6d79fe07f9ab3b53d4a6176f005d
SHA256

e6a3ac4235b6ef444de81213a9c13c6ab5f208f67a240afb5e9182ff538425a5
SHA512

55fdf414559f7bb63963b56cbb65c031796d8127b6ac8d75d1fb3bfdf0f7139ef77e1c694f31455b7eff5ebb5d0c63e54d1d1c1eab4f437cb443ca7d868ff2ae
SSDEEP

49152:znAQqMSPbcBVQej/1INRx+TSqTdX1HkQo69:TDqPoBhz1aRxcSUDk369

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3068) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 3 IoCs

pid	Process
2088	mssecsvc.exe
4984	mssecsvc.exe
1488	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 728 wrote to memory of 3536	728	rundll32.exe	83
PID 728 wrote to memory of 3536	728	rundll32.exe	83
PID 728 wrote to memory of 3536	728	rundll32.exe	83
PID 3536 wrote to memory of 2088	3536	rundll32.exe	84
PID 3536 wrote to memory of 2088	3536	rundll32.exe	84
PID 3536 wrote to memory of 2088	3536	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\560c8d8b51659d30527fe62dcc0cb4e5_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\560c8d8b51659d30527fe62dcc0cb4e5_JaffaCakes118.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:3536
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:2088
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:1488

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\mssecsvc.exe

Filesize
3.6MB

MD5
111499d873815c3d6face3a8480f286d

SHA1
6a05bfc9806784884ca6c260bbdb5785fca2762d

SHA256
971f763939910cc04c170936ad2467e592678a301997aa80adde2e94040afe28

SHA512
e7ba9fa467498e8db5df1c03f315bbbfbea1429268778ac792346bd5e050bfe1db310ccab887a78d162831b885c3a1c3e67a5bd16b300a9aaacd1edd41cf83fd

Download Submit
C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
b71a10d0e3f3255cdce7903784d380a7

SHA1
46ac26d48c204458cca61147fbfb356b8b468a8e

SHA256
571305f8160f8b4bf8063845763578794f215e3c525b198881d0e38e2f70e89c

SHA512
23204156ce4afd6b5ec24a906c7c9ed88c23a1483b089f7d0151be731105079f84d22a46a5912359d096afa8e9dc90a778d50025ba83b8714ad91f0ffaaa8017

Download Submit