wannacry | 9e92b4611ac954750cfbe08d0a70ceaf8dcf66b2cdf298627349e30ad12a365e

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25-09-2024 17:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f68cbb34d241534ad6c9d524f79888c0_JaffaCakes118.dll
Size

5.0MB
MD5

f68cbb34d241534ad6c9d524f79888c0
SHA1

d65fbe62b22810d3cea7bbd304df4588185bb71d
SHA256

9e92b4611ac954750cfbe08d0a70ceaf8dcf66b2cdf298627349e30ad12a365e
SHA512

cf644d687cfb38108507dc65d67e46308efbb9751b015569bca52ffc912baa23544cdf34c8860e83656393d8a67d559558d5a1bf3dbdec84f4bd9ed8b51f528c
SSDEEP

49152:JnjQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAA:d8qPoBhz1aRxcSUDk36SA

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3067) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 3 IoCs

pid	Process
2188	mssecsvc.exe
2508	mssecsvc.exe
2916	tasksche.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	mssecsvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvc.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvc.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2528	2060	rundll32.exe	30
PID 2060 wrote to memory of 2528	2060	rundll32.exe	30
PID 2060 wrote to memory of 2528	2060	rundll32.exe	30
PID 2060 wrote to memory of 2528	2060	rundll32.exe	30
PID 2060 wrote to memory of 2528	2060	rundll32.exe	30
PID 2060 wrote to memory of 2528	2060	rundll32.exe	30
PID 2060 wrote to memory of 2528	2060	rundll32.exe	30
PID 2528 wrote to memory of 2188	2528	rundll32.exe	31
PID 2528 wrote to memory of 2188	2528	rundll32.exe	31
PID 2528 wrote to memory of 2188	2528	rundll32.exe	31
PID 2528 wrote to memory of 2188	2528	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f68cbb34d241534ad6c9d524f79888c0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f68cbb34d241534ad6c9d524f79888c0_JaffaCakes118.dll,#1
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2528
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2188
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:2916

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\mssecsvc.exe

Filesize
3.6MB

MD5
c5ab4ad72679d9caccb749139362adbb

SHA1
5e07c023e60b96427ac218fc4e2b3e4b39ad58c3

SHA256
c67aa95681360f7e20bbc90d6e7ae9b84f43eb81155812c28843b104e607e71f

SHA512
722dc5e4c0acb7f8729967a9662b4ba57c2c73c52eaa9deefb2d94fa8d4e58daff72888646fc4e7983dd1300fbb2710c9830a77e6be2c8428fb52bc219cec089

Download Submit
C:\Windows\tasksche.exe

Filesize
3.4MB

MD5
a88d66dd7fd6fb40da424b3ecf508dee

SHA1
7137fc37daf9f2856dc9d26fbb261229a42ec64e

SHA256
6112c7300fad6614aba8f1eb37d5b156d45eb93464c70162f6f618ceb821b28f

SHA512
1220d4df598e4f705b9990cdc42fefe575f55d07d07aebd96d4bd9234509f65d0bde1d6999b96a031eee183175ba55ab2f1ced44daa5ebc772a8625f107e29dc

Download Submit