Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
06-05-2024 13:57
Static task
static1
Behavioral task
behavioral1
Sample
1cd189d20cacd41f7f5b39ffc5e68ba1_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1cd189d20cacd41f7f5b39ffc5e68ba1_JaffaCakes118.dll
Resource
win10v2004-20240419-en
General
-
Target
1cd189d20cacd41f7f5b39ffc5e68ba1_JaffaCakes118.dll
-
Size
5.0MB
-
MD5
1cd189d20cacd41f7f5b39ffc5e68ba1
-
SHA1
f315a8ae206cf5cbd37378f91fda78dd4b8c314d
-
SHA256
b1fa3ea8a7772409ca68333e3d8f3de0eb7539b61adf1607e5044a62be06b0de
-
SHA512
0710d528c151b0446819e578d55f805c4e61edfc9336968cf6298391403033d40ddf03b02700d522589b148e8b6a7dc0d0c9a8e0451e54a9b1c1ed5777d1dfab
-
SSDEEP
98304:+DqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2:+DqPe1Cxcxk3ZAEUadzR8yc4
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (3009) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 3 IoCs
Processes:
mssecsvc.exemssecsvc.exetasksche.exepid process 1888 mssecsvc.exe 3040 mssecsvc.exe 2480 tasksche.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in System32 directory 1 IoCs
Processes:
mssecsvc.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvc.exe -
Drops file in Windows directory 2 IoCs
Processes:
rundll32.exemssecsvc.exedescription ioc process File created C:\WINDOWS\mssecsvc.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvc.exe -
Modifies data under HKEY_USERS 24 IoCs
Processes:
mssecsvc.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{059C0EE3-4216-4428-B4BF-2730C7C9FB29}\WpadDecision = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{059C0EE3-4216-4428-B4BF-2730C7C9FB29}\8a-64-7e-e2-70-ca mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{059C0EE3-4216-4428-B4BF-2730C7C9FB29}\WpadDecisionReason = "1" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{059C0EE3-4216-4428-B4BF-2730C7C9FB29}\WpadDecisionTime = e092e04fbd9fda01 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8a-64-7e-e2-70-ca mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8a-64-7e-e2-70-ca\WpadDecisionReason = "1" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8a-64-7e-e2-70-ca\WpadDecisionTime = e092e04fbd9fda01 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8a-64-7e-e2-70-ca\WpadDecision = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{059C0EE3-4216-4428-B4BF-2730C7C9FB29} mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0079000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{059C0EE3-4216-4428-B4BF-2730C7C9FB29}\WpadNetworkName = "Network 3" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mssecsvc.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 2292 wrote to memory of 1500 2292 rundll32.exe rundll32.exe PID 2292 wrote to memory of 1500 2292 rundll32.exe rundll32.exe PID 2292 wrote to memory of 1500 2292 rundll32.exe rundll32.exe PID 2292 wrote to memory of 1500 2292 rundll32.exe rundll32.exe PID 2292 wrote to memory of 1500 2292 rundll32.exe rundll32.exe PID 2292 wrote to memory of 1500 2292 rundll32.exe rundll32.exe PID 2292 wrote to memory of 1500 2292 rundll32.exe rundll32.exe PID 1500 wrote to memory of 1888 1500 rundll32.exe mssecsvc.exe PID 1500 wrote to memory of 1888 1500 rundll32.exe mssecsvc.exe PID 1500 wrote to memory of 1888 1500 rundll32.exe mssecsvc.exe PID 1500 wrote to memory of 1888 1500 rundll32.exe mssecsvc.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1cd189d20cacd41f7f5b39ffc5e68ba1_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1cd189d20cacd41f7f5b39ffc5e68ba1_JaffaCakes118.dll,#12⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1888 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i4⤵
- Executes dropped EXE
PID:2480
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3040
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\mssecsvc.exeFilesize
3.6MB
MD54a9815b8312314be39102cd74ef8441c
SHA1625de2c76e7ae28ed839ec44a1faad849f7895b1
SHA256191724d26ea2ee0337d891f04480c0a2c20a26c8f661cb9ba40590933428c1f7
SHA5128e50a6d842c7bb3c4733bf97e9d2c6339cf6a9a8c41656a8e5eb6f04eae9733f623578ed5a0a6dc8bf4dd1444dfa0965d3edc8c6960b2ae03753b68e0e92f489
-
C:\Windows\tasksche.exeFilesize
3.4MB
MD5cfd3f33766aac90f99074c5d063636e7
SHA1e84a369096409770d2f028ad3e6c16f21628a583
SHA256845316a109f3e76911ca4691755bbfda91daf21d89c7cf22168a824eeab3cf64
SHA512ec9161f2d4b18738b5040d3e58684a15bfe7f12810bae29cdec1ef2c853cf7100c49a831a17e13884e3cd176b1f4ecae19fb0f7a11f3005cd2b35e56fa957eac