wannacry | 5b004e212c5e936c249c8b9cd5b4864f0d5340e0dc94f9774db24d4c5e918553

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
16/09/2024, 01:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e3bb6ee38af372c8bce4d6b6ec7b8a42_JaffaCakes118.exe
Size 3.6MB
Sample240916-bkdacs1fqa
SHA256 5b004e212c5e936c249c8b9cd5b4864f0d5340e0dc94f9774db24d4c5e918553
MD5 e3bb6ee38af372c8bce4d6b6ec7b8a42
SHA1 bb76fb353e8ea16ac6e3be917419d5cb06a19087
SHA512 d0b0572856ea1daa017caebcd0b979d369d6beea3e441b336a226bf95d6c4a0559ea4d8212d943dfe34487a0fdeae06dac17df74f7834805031821c447d6c24c
SSDEEP 49152:2nAQqMSPbcBV8nvxJM0H9PAMEcaEau3R8y:yDqPoBOvxWa9P593R8y
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3288) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 1 IoCs

pid	Process
4432	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	e3bb6ee38af372c8bce4d6b6ec7b8a42_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e3bb6ee38af372c8bce4d6b6ec7b8a42_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e3bb6ee38af372c8bce4d6b6ec7b8a42_JaffaCakes118.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	e3bb6ee38af372c8bce4d6b6ec7b8a42_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	e3bb6ee38af372c8bce4d6b6ec7b8a42_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	e3bb6ee38af372c8bce4d6b6ec7b8a42_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	e3bb6ee38af372c8bce4d6b6ec7b8a42_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	e3bb6ee38af372c8bce4d6b6ec7b8a42_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\e3bb6ee38af372c8bce4d6b6ec7b8a42_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e3bb6ee38af372c8bce4d6b6ec7b8a42_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3944
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:4432

C:\Users\Admin\AppData\Local\Temp\e3bb6ee38af372c8bce4d6b6ec7b8a42_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\e3bb6ee38af372c8bce4d6b6ec7b8a42_JaffaCakes118.exe -m security
1⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:3416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1904,i,8293235976513689021,7261015831736501466,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:8
1⤵
PID:1708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 8b4a26d92e366182e1042727595b6dfaceb3d951f1ad675f796f6cd88d82d814
MD5 2fc3e5f8042451280f688bee07159e7b
SHA1 c356dbcea501aad9911717e694f4659f77473880
SHA512 bbbf333e5bc14a87835aba984370ee82759a24e0391592e1279037b3f2871eb6faf2f5683ac476170fcb620b181ffe15cec580a415e6ad93298186117e586a76
SSDEEP 49152:nQqMSPbcBV8nvxJM0H9PAMEcaEau3R8y:QqPoBOvxWa9P593R8y
MD5 SHA1 SHA512 SSDEEP

Submit Download