wannacry | 0d4245b5b2282c6f37e0b24f9c12c2f7034a4aa35334c87c1aa8dfe271e35d14

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23-09-2024 18:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f2e2d36f1ca62d2ca0e2d2048ff9bd8f_JaffaCakes118.dll
Size

5.0MB
MD5

f2e2d36f1ca62d2ca0e2d2048ff9bd8f
SHA1

2e6b1cc6d6be41f90b5c775148ebc234a54f5d3b
SHA256

0d4245b5b2282c6f37e0b24f9c12c2f7034a4aa35334c87c1aa8dfe271e35d14
SHA512

4bdb9c83d251b252ef06c30b28b4f8101aacb2aed8b7c36acd68b96472eb415c1d15f487cc5231f0124ee3a8a3f21ac9dac08b6c1183b1d8afa3f89b329af694
SSDEEP

24576:SbLgddQhfdmMSirYbcMNgef0QeQjG/D8kIqRYoAdNL7DauvgI8+75ST:SnAQqMSPbcBVQej/1INPuLN

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3216) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 3 IoCs

pid	Process
1756	mssecsvc.exe
4040	mssecsvc.exe
760	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvc.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 1484	2888	rundll32.exe	82
PID 2888 wrote to memory of 1484	2888	rundll32.exe	82
PID 2888 wrote to memory of 1484	2888	rundll32.exe	82
PID 1484 wrote to memory of 1756	1484	rundll32.exe	83
PID 1484 wrote to memory of 1756	1484	rundll32.exe	83
PID 1484 wrote to memory of 1756	1484	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f2e2d36f1ca62d2ca0e2d2048ff9bd8f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f2e2d36f1ca62d2ca0e2d2048ff9bd8f_JaffaCakes118.dll,#1
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1484
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:1756
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:760

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:4040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\mssecsvc.exe

Filesize
3.6MB

MD5
de1ab747d4a2cf7e84cd2eedaaa2214a

SHA1
4969d236ccd15328389686e1a3133eee11fc7bef

SHA256
25f78904f9b1c189c89dbc27810a3b796e0edbef3426351e5287586bd3a98d6a

SHA512
6f46ff5be93c8b5b6aecd0489fd03cf792d20532f084607200ce89dab995f5cf115d1c67bc96504c4e5705ab67e5bde2a97212528881c25a5f0ace3562f6fccd

Download Submit
C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
11192ae4e995f992a50966cf0d009b63

SHA1
90c50c76879e5a69829f62e0e61397bce43cda75

SHA256
b47dc85dadcd2977a7a6e4b32e9e84780f199d594da335df0c705e39d0117ee0

SHA512
ba14019e518b1c973d97bdabe9e6baf293c1b11b6b7715fecf6c20d64984818d49ba35a464160de9ab7fb5a3fab83093d34099b4f139f774a87c1f7dbb153025

Download Submit