wannacry | 5b4de6be0fa7c194ffedce0788448deb54ed34da26388a5fa554a3472741bf77

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13-09-2024 09:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

de29e686d671cdbc56a3cb5c292835d6_JaffaCakes118.dll
Size

5.0MB
MD5

de29e686d671cdbc56a3cb5c292835d6
SHA1

cfa871df1c513580df5a52c1da565157360dd712
SHA256

5b4de6be0fa7c194ffedce0788448deb54ed34da26388a5fa554a3472741bf77
SHA512

22093193b1d8d54156766e137ddc6944affd76094aaf797b5bd36b0b4f0b052583a9d62be6f7172687cc5ff2dfab22684adc18c19c526993a8ce98fdc6cda1c6
SSDEEP

98304:+DqPoBhz1aRxcSUDk36SAEdhvxWa9P593mX7bJ6v0:+DqPe1Cxcxk3ZAEUadzmX7bQv0

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3346) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 3 IoCs

pid	Process
2116	mssecsvc.exe
3032	mssecsvc.exe
5044	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvc.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 4856	2296	rundll32.exe	83
PID 2296 wrote to memory of 4856	2296	rundll32.exe	83
PID 2296 wrote to memory of 4856	2296	rundll32.exe	83
PID 4856 wrote to memory of 2116	4856	rundll32.exe	84
PID 4856 wrote to memory of 2116	4856	rundll32.exe	84
PID 4856 wrote to memory of 2116	4856	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\de29e686d671cdbc56a3cb5c292835d6_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\de29e686d671cdbc56a3cb5c292835d6_JaffaCakes118.dll,#1
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4856
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2116
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:5044

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\mssecsvc.exe

Filesize
3.6MB

MD5
b5f9eded609339c4f3f2980118938b12

SHA1
6ad5f53ac87c80f199b85b1a913816da0671288b

SHA256
11cb4ee96a030138522bac4d17d9a4b16574474ee3213928eb9476ae31422c43

SHA512
07a998f329457a51a0a68970e489763a70dafa746f30816ce15b239ad1f726d22fc757b0a3efa8dc0ddd278f5d467765cd981741f98c64398a1558f03307c4b6

Download Submit
C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
4b453def4bfc3dee8a9d163f40676bde

SHA1
93a24bcaabcff99dffc5639327113855591f4cea

SHA256
e91b67fff3f2582641dcbb8feadc486b91ac9a1cfecbafb13d8e6fc1e2e96741

SHA512
b2890fc355863d215908adc18730f343bbb0980d76e051e4a46ada2f86eb12a9eae39867636180cc8b74096d1922d93ba20bb041213978e23dba12b18220419b

Download Submit