wannacry | 237dafdc4f0acaab253ae642694589c5a92f170d3f7f08872f77cffef861fd34

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
31-08-2024 07:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cc6474bd901801f5cca50d886e7dbc44_JaffaCakes118.dll
Size

5.0MB
MD5

cc6474bd901801f5cca50d886e7dbc44
SHA1

35dcdf51b1eacff2df686a5b3844bd6e70b2fc3d
SHA256

237dafdc4f0acaab253ae642694589c5a92f170d3f7f08872f77cffef861fd34
SHA512

3b9a58afa5ff859f250128647918eaafa8b279ac66cd599ee47c3e922e140111ab9daa211537c676b4c4eb82d34c31d443251bfb9129f2eb355eb739247e220a
SSDEEP

49152:SnAQqMSPbcBVq6SAARdhnvxJM0H9PAMEcaEau3R8yAH1plAH:+DqPoB86SAEdhvxWa9P593R8yAVp2H

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3367) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 3 IoCs

pid	Process
2028	mssecsvc.exe
1444	mssecsvc.exe
1576	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2040	2364	rundll32.exe	84
PID 2364 wrote to memory of 2040	2364	rundll32.exe	84
PID 2364 wrote to memory of 2040	2364	rundll32.exe	84
PID 2040 wrote to memory of 2028	2040	rundll32.exe	85
PID 2040 wrote to memory of 2028	2040	rundll32.exe	85
PID 2040 wrote to memory of 2028	2040	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cc6474bd901801f5cca50d886e7dbc44_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cc6474bd901801f5cca50d886e7dbc44_JaffaCakes118.dll,#1
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2040
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2028
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:1576

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\mssecsvc.exe

Filesize
3.6MB

MD5
c77f3e4709880981d1dd1160eeefc011

SHA1
957a5eb45f3ea06ddd232599bae5e1e4661db88a

SHA256
e38e40389df06eaf0e442c05819b6ceb7c43b65344dcbc7c8bce4b73132d92bb

SHA512
ca121cf2329e78a70b8d4e8d9714d61ec0b36624b58e4c59c4ff1fe222f282552cbd4d7857111344f8b90b228f3df86fd1fa4dbf98e958e498adb4eb79d41e77

Download Submit
C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
3900fdfb448da34d13c08503c536d9de

SHA1
caf080721e15e6d6664ebbec0ca944e24ff36fed

SHA256
13d04c0977a75e765a03c6c217b5944a6381848643eca4043134def039167724

SHA512
3c1472b29253251344570e17b2171a317a35d9f3d4ee9bf9430ea7930f9699d68a428a0616a2d96ef4fa5b95c334f2377ed81e1dc7bd2d425cfb559e3e29f4f7

Download Submit