wannacry | 8f2bebe91bc094481c0f08c356d6807fe0981ca86115418fa4c8bf1a0b9380ca

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22-09-2024 17:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f27d3943f18548c0f2d572d63e120493_JaffaCakes118.dll
Size

5.0MB
MD5

f27d3943f18548c0f2d572d63e120493
SHA1

f0c965e91bd85b2b551331011c705eb3cc125186
SHA256

8f2bebe91bc094481c0f08c356d6807fe0981ca86115418fa4c8bf1a0b9380ca
SHA512

cf887429fa2aa53461f3b90c5bdc839d37ff1b9de4e2baa54827a7ed01f67bb301f8c0f9a1281be29c671e8962cdac82a31a88ecfbd584cb2e1983e7c90700e4
SSDEEP

49152:SnAQqMSPbcBVQejU+TSqTdX1HkQo6SAANvc:+DqPoBhwcSUDk36SA

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3276) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 3 IoCs

pid	Process
3928	mssecsvc.exe
3752	mssecsvc.exe
2920	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvc.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1836 wrote to memory of 332	1836	rundll32.exe	82
PID 1836 wrote to memory of 332	1836	rundll32.exe	82
PID 1836 wrote to memory of 332	1836	rundll32.exe	82
PID 332 wrote to memory of 3928	332	rundll32.exe	83
PID 332 wrote to memory of 3928	332	rundll32.exe	83
PID 332 wrote to memory of 3928	332	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f27d3943f18548c0f2d572d63e120493_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1836
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f27d3943f18548c0f2d572d63e120493_JaffaCakes118.dll,#1
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:332
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:3928
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:2920

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:3752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\mssecsvc.exe

Filesize
3.6MB

MD5
df842d3333f8f2053320d26976b218c6

SHA1
03f4a6457d8ce157816ca3e76403d5b50ae72a55

SHA256
51f609a24f58e4c7dab06eb54672ae71796df37379a4d7cb894363347bda23af

SHA512
27aaed57fe7ba78c0cdec038c90608066c071d4c538f317410ab39d2a38850b2fed1ee952b2f0ff6614a6a1136d704890667783a34102d83fa05c007b080f394

Download Submit
C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
8cac10227e38382514b199f69f131f08

SHA1
328140bdf74880e925ba4751f256452a6476d623

SHA256
e957c6b0d95f3a76d425db475c350514b2c284264625438501f4387d5ae18d63

SHA512
a79b76fad71f156e83cb71340265b9c9c717d38deafb2968a02ad4c34bdb5fc77acc0e1cf87398a901364a4914a17716bb1e1b74f0d3e63d76fdc7c9911df5db

Download Submit