wannacry | 25e8141ba936fb55e0e7a6dfdf911870f11285dd48532feb8ac2a9495539b23a

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21-08-2024 06:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b27277135d9e2f8256c091534198aa6e_JaffaCakes118.dll
Size

5.0MB
MD5

b27277135d9e2f8256c091534198aa6e
SHA1

c81a4b9d02510c06176b87b03ebb354bbde94057
SHA256

25e8141ba936fb55e0e7a6dfdf911870f11285dd48532feb8ac2a9495539b23a
SHA512

a85ea6b2fe1e3154ed869eb1727f110f25d6a464f1ee2b30394f0bfea210c9b3ae779faf94783be205e2b77bb465967938a0e37e3f97677d99867f524cbed09c
SSDEEP

98304:+DqPoB31aRxcSUDk36SAEdhvxWa9P593R8yAVp2s:+DqP01Cxcxk3ZAEUadzR8yc4s

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3300) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 3 IoCs

pid	Process
2584	mssecsvc.exe
4468	mssecsvc.exe
4960	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvc.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 1840	5020	rundll32.exe	91
PID 5020 wrote to memory of 1840	5020	rundll32.exe	91
PID 5020 wrote to memory of 1840	5020	rundll32.exe	91
PID 1840 wrote to memory of 2584	1840	rundll32.exe	92
PID 1840 wrote to memory of 2584	1840	rundll32.exe	92
PID 1840 wrote to memory of 2584	1840	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b27277135d9e2f8256c091534198aa6e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b27277135d9e2f8256c091534198aa6e_JaffaCakes118.dll,#1
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1840
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2584
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:4960

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:4468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4264,i,10065386245627775856,6567048529106473151,262144 --variations-seed-version --mojo-platform-channel-handle=1964 /prefetch:8
1⤵
PID:1828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\mssecsvc.exe

Filesize
3.6MB

MD5
cd38f327636b95f97e8c5f9213260365

SHA1
e821b7cf859cd92607fa1971af0bd3ad86f2bda5

SHA256
44246267cb8bdf63ca12ea830417136725898b85698bbaee559eeba8058677df

SHA512
e0a830a02c914918d73171f95aaff3f043660dd6f07a2146365506c06c0344c7fd61362cde648d468b132b452e102e40e4499d8b9e95c994ca3b01daa15180bb

Download Submit
C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
4c719cacbc1bf37826c8a9c8419065d5

SHA1
5729776e488b60d265e127ca6b5f6591103ca587

SHA256
ff01ad34f6c8044bdc1a655675000727f4a67217ab00470a9088bf4b597d4338

SHA512
bf741185452a9c54459b604413a8e306e53742b3e6f482d355daccbca32249a2651c4a1b31ce5fea8e76ae74bf01958f2507452968e815aec4c9fdebca125794

Download Submit