wannacry | 6a2d4d9632ced5505b1c7cf21193f088372d6312eee0150a54c74cdbe2ddc610

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08-09-2024 05:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d3a0568469c434f9d260bce9474ff021_JaffaCakes118.dll
Size

5.0MB
MD5

d3a0568469c434f9d260bce9474ff021
SHA1

d78451084086682c78347ba8f7ab33db3a0f72ea
SHA256

6a2d4d9632ced5505b1c7cf21193f088372d6312eee0150a54c74cdbe2ddc610
SHA512

1d971c566ce316c3334377b4905a2c8fc0c05a776910d0b0ba3dd42d50cf53ea51877bdb1bb5dd76884845f633a3bb1c3873ecc83c86ca904ef3c84b01dd00a8
SSDEEP

24576:SbLgddQhfdmMSirYbcMNgef0QeQjG8W4C7mwk0KbNCt:SnAQqMSPbcBVQejBBJriNE

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3101) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 3 IoCs

pid	Process
2340	mssecsvc.exe
440	mssecsvc.exe
5032	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 4916	2252	rundll32.exe	83
PID 2252 wrote to memory of 4916	2252	rundll32.exe	83
PID 2252 wrote to memory of 4916	2252	rundll32.exe	83
PID 4916 wrote to memory of 2340	4916	rundll32.exe	85
PID 4916 wrote to memory of 2340	4916	rundll32.exe	85
PID 4916 wrote to memory of 2340	4916	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3a0568469c434f9d260bce9474ff021_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3a0568469c434f9d260bce9474ff021_JaffaCakes118.dll,#1
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4916
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2340
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:5032

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\mssecsvc.exe

Filesize
3.6MB

MD5
6a60ae7829fb0fae205184ac8d458aba

SHA1
6388aad9530e4dd590722db4ad1f13ac3116fce0

SHA256
aad4a8b8d9956166d6ef2b92be58a46b8864081dc1d39acdf6600f5efcc82da8

SHA512
498785287086d39505fca0fe016bc6c9eb29c55c3f9ab899fa5711558ffeb62de3f079c82c63c36185c264bee234d06ca27fd82e5fcb41249364de0f250dd192

Download Submit
C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
03467a1b353540ccd1a6c022f7941f24

SHA1
863656e118b22f3ff142f989cf2752364304c46e

SHA256
0ebbdd04d735854992185445fd3e4412275e979e3352270733adaca591a3940b

SHA512
4ce1c271d39372dcd9c6341133f089d708c8030835740cac4de5b0db5e4c31a2b53dc5f5cc17819143ed4379b94712787c040d0f590d6e6ca0c93dcee3de2b66

Download Submit