wannacry | 840a7fcf572568caf246904dbf16856405059f4b2bdbea3591861d48c4716a73

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06-09-2024 22:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d0912700523af3f5bfe7371459cce884_JaffaCakes118.dll
Size

5.0MB
MD5

d0912700523af3f5bfe7371459cce884
SHA1

22e91f60b74d353c48af4b84178c966f05344ffc
SHA256

840a7fcf572568caf246904dbf16856405059f4b2bdbea3591861d48c4716a73
SHA512

d323c0dc67e575250158749cd0871034985dacf3597cf78ab5e028f3128dc8c9db72fd88f1a221faf58366d11df07d4034b2fb72e80c5b03c1d585d30abb9dee
SSDEEP

98304:d8qPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2H:d8qPe1Cxcxk3ZAEUadzR8yc4H

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3333) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 3 IoCs

pid	Process
2704	mssecsvc.exe
2816	mssecsvc.exe
2568	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	mssecsvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvc.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvc.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2252	2080	rundll32.exe	30
PID 2080 wrote to memory of 2252	2080	rundll32.exe	30
PID 2080 wrote to memory of 2252	2080	rundll32.exe	30
PID 2080 wrote to memory of 2252	2080	rundll32.exe	30
PID 2080 wrote to memory of 2252	2080	rundll32.exe	30
PID 2080 wrote to memory of 2252	2080	rundll32.exe	30
PID 2080 wrote to memory of 2252	2080	rundll32.exe	30
PID 2252 wrote to memory of 2704	2252	rundll32.exe	31
PID 2252 wrote to memory of 2704	2252	rundll32.exe	31
PID 2252 wrote to memory of 2704	2252	rundll32.exe	31
PID 2252 wrote to memory of 2704	2252	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d0912700523af3f5bfe7371459cce884_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d0912700523af3f5bfe7371459cce884_JaffaCakes118.dll,#1
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2252
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2704
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:2568

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\mssecsvc.exe

Filesize
3.6MB

MD5
f97006196932c04287cdc546f1d05d47

SHA1
0b3d3d5588d42cacbb8981c6e34e3bd1654659eb

SHA256
aa06508b5339be63169329984d5d299a2c6ffb4f37eb48e7dbf3f9fc53d90714

SHA512
5f967fd9c50ea5232c89acd28b2282959e41658457db9d591c2c50f9c20f481e49fd40c367fe9175ebc2618d8093b9747a9ffe1eb5ca5625b1dba12693d0d111

Download Submit
C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
6aac9c38c2f0c5245be2fbd2b7cf9417

SHA1
46f68b63a71e407a71d4c9c2a61844cc3b1338e5

SHA256
479dda8871369ebd1e3dbfffaf8e3290776f3824006c75884e91d9162220c7f0

SHA512
6b90cfae390295dc99f7ef74a3fab252ee79c0afd5c0af0353169b19f491ce7dfd50c05ffae57a426fc627ddac1a5570208a6f90c6f3d111fe1ac8c5b6f42184

Download Submit