wannacry | 13f92702aa70783241bf7ba3b6a6b2de9bcbd728cd38af5a8d2146ca6a59dcbe

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24-09-2024 08:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f33dc28c6f7f645b51022740002f7f27_JaffaCakes118.dll
Size

5.0MB
MD5

f33dc28c6f7f645b51022740002f7f27
SHA1

60b99690e404ed740a0797c6672cbf95d8315e3b
SHA256

13f92702aa70783241bf7ba3b6a6b2de9bcbd728cd38af5a8d2146ca6a59dcbe
SHA512

90f45af1b51b1a47923279ae82f2578e55af40c6a738238ec0ac03945db052d8566d13f6e0b1a0e6d5011cddeabc58bc3e2262a5231765fa414719f1eb172f6b
SSDEEP

24576:SbLgddQhfdmMSirYbcMNgef0QeQjG/D8kIqRYoAdNLKz6626M+ODs+DH3Dwv:SnAQqMSPbcBVQej/1INRx+ih8v

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3283) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 3 IoCs

pid	Process
3992	mssecsvc.exe
2924	mssecsvc.exe
3920	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvc.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 4724	4856	rundll32.exe	82
PID 4856 wrote to memory of 4724	4856	rundll32.exe	82
PID 4856 wrote to memory of 4724	4856	rundll32.exe	82
PID 4724 wrote to memory of 3992	4724	rundll32.exe	83
PID 4724 wrote to memory of 3992	4724	rundll32.exe	83
PID 4724 wrote to memory of 3992	4724	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f33dc28c6f7f645b51022740002f7f27_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f33dc28c6f7f645b51022740002f7f27_JaffaCakes118.dll,#1
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4724
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:3992
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:3920

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\mssecsvc.exe

Filesize
3.6MB

MD5
f90171f3ce49cf5577869a404b24db0b

SHA1
2e7c6ef2c7112561aa6ac489cf5958aaf0a4fd8d

SHA256
45d841c9114b67b6bd41bb9b005214eaad03c827ff6d6271ba514a0549f27c98

SHA512
ac6b506fa94b0ae3934ee5ab811029b587fc4dbbf95f4ce2c20104dea66d8e5afce2fe2075e8dfb8dfc506f8aeedaa90ccf918fa40b6c8fef0f6f6951c9a6742

Download Submit
C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
ba72e9b21073b24c5b7e5cfc3e3a6ee8

SHA1
11173fbbcad2ab23d0bc39192fe093842c53f164

SHA256
e139f1184013555a29ef0f78428107783f5fbde413ec44a105c8477b785c1f37

SHA512
3ad6d435d439ff3a071686796e85ad0a64b59a0d9563b6410e3e95ccd1b98a44e8192dd418baff7db6832cb756f2392f8589e9f9947dcc92200e8e08955eab64

Download Submit