Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
09-05-2024 16:07
Static task
static1
Behavioral task
behavioral1
Sample
2ac49bb17e14808c9b89ff634f68c76c_JaffaCakes118.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2ac49bb17e14808c9b89ff634f68c76c_JaffaCakes118.dll
Resource
win10v2004-20240426-en
General
-
Target
2ac49bb17e14808c9b89ff634f68c76c_JaffaCakes118.dll
-
Size
5.0MB
-
MD5
2ac49bb17e14808c9b89ff634f68c76c
-
SHA1
36ec6217088aead551a74574d3b17d5a96e22636
-
SHA256
991467da8144b1661411aaac090ad75c7f68c7277bfe43ec52537e03766d5605
-
SHA512
58057ede26e8f19b0ecb9bd2be102071896fcd3a2bc75c8b990371195d0074bc829efcc0175c45cb4a90082cd5d74a8cb3d8e4480ba559ee257a7c13cdcc4e4b
-
SSDEEP
24576:SbLgddQhfdmMSirYbcMNgef0IRdhAdm7SdO6LLuYAMEcpcL7nEautETA:SnAQqMSPbcBVIRdhnmdAMEcaEaue
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (3321) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 3 IoCs
Processes:
mssecsvc.exemssecsvc.exetasksche.exepid process 3044 mssecsvc.exe 1644 mssecsvc.exe 2648 tasksche.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in System32 directory 1 IoCs
Processes:
mssecsvc.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvc.exe -
Drops file in Windows directory 2 IoCs
Processes:
rundll32.exemssecsvc.exedescription ioc process File created C:\WINDOWS\mssecsvc.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvc.exe -
Modifies data under HKEY_USERS 24 IoCs
Processes:
mssecsvc.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\96-50-f9-f5-4c-41\WpadDecisionReason = "1" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2B449418-8E9A-4EC0-9EB4-692E90704461}\WpadDecisionTime = c0cf89002ba2da01 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2B449418-8E9A-4EC0-9EB4-692E90704461}\WpadDecision = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\96-50-f9-f5-4c-41 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2B449418-8E9A-4EC0-9EB4-692E90704461}\96-50-f9-f5-4c-41 mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\96-50-f9-f5-4c-41\WpadDecisionTime = c0cf89002ba2da01 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f008e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2B449418-8E9A-4EC0-9EB4-692E90704461} mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2B449418-8E9A-4EC0-9EB4-692E90704461}\WpadDecisionReason = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2B449418-8E9A-4EC0-9EB4-692E90704461}\WpadNetworkName = "Network 3" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\96-50-f9-f5-4c-41\WpadDecision = "0" mssecsvc.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 2984 wrote to memory of 3004 2984 rundll32.exe rundll32.exe PID 2984 wrote to memory of 3004 2984 rundll32.exe rundll32.exe PID 2984 wrote to memory of 3004 2984 rundll32.exe rundll32.exe PID 2984 wrote to memory of 3004 2984 rundll32.exe rundll32.exe PID 2984 wrote to memory of 3004 2984 rundll32.exe rundll32.exe PID 2984 wrote to memory of 3004 2984 rundll32.exe rundll32.exe PID 2984 wrote to memory of 3004 2984 rundll32.exe rundll32.exe PID 3004 wrote to memory of 3044 3004 rundll32.exe mssecsvc.exe PID 3004 wrote to memory of 3044 3004 rundll32.exe mssecsvc.exe PID 3004 wrote to memory of 3044 3004 rundll32.exe mssecsvc.exe PID 3004 wrote to memory of 3044 3004 rundll32.exe mssecsvc.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2ac49bb17e14808c9b89ff634f68c76c_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2ac49bb17e14808c9b89ff634f68c76c_JaffaCakes118.dll,#12⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3044 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i4⤵
- Executes dropped EXE
PID:2648
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1644
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\mssecsvc.exeFilesize
3.6MB
MD53fc13f7056c4d897f7497a485e73123a
SHA123524c5b74e008769fd8b6d59902ecf23af54db5
SHA256f783299151572aab278005770c83643fcea2bedc8c6e4d45c8da8a08585240b5
SHA51200865597ee281cb88df3449d8cc165850a3b32f4b05f9f01a98b69dd8db8564ae73fe7f3f4bd65559d902e1662e81ee775b51a35579e7fe65a550bfb522e5003
-
C:\Windows\tasksche.exeFilesize
3.4MB
MD57577dfb78dc6772bb71ef5b00974828e
SHA1f4f61bbdf1963ee42908207784f722b7ec94efc8
SHA256551b3b8cbe9d86e6042561461ccb86608dad651d0604ef5f6c3204f4c1698262
SHA5122b20228adf5cd02762462cf41ac3835709574e82678badafb99aa40692ac4822e761562e963325f45957a074bdc448e77afa626d28219c1f87862a5697043f37