Analysis
- max time kernel
150s - max time network
150s - platform
windows7_x64 - resource
win7-20240220-en - resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system - submitted
11/05/2024, 04:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
32b3efdf648ce7883be0f968f0c9ff52_JaffaCakes118.dll
Resource
win7-20240220-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
32b3efdf648ce7883be0f968f0c9ff52_JaffaCakes118.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 32b3efdf648ce7883be0f968f0c9ff52_JaffaCakes118.dll
- Size 5.0MB
- Sample240511-e1n9cadb3x
- SHA256 8d764975d177f564eded856e9216f0ed154042a6dae2b7a81acdd326c26dbea5
- MD5 32b3efdf648ce7883be0f968f0c9ff52
- SHA1 00275d760562de465266baa81d8f08e18f9931fc
- SHA512 653708979bc20187cef928f0c2710c69dd6f5e47aea0ab88d468242514c740564cd63985927aa4fad693ae17d83839dfbc9cb254db03769f08ff712e4fc8e784
- SSDEEP 49152:SnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAA:+DqPoBhz1aRxcSUDk36SA
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Wannacry
WannaCry is a ransomware cryptoworm.
- Contacts a large (3279) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Executes dropped EXE 3 IoCs
pid Process 2948 mssecsvc.exe 2624 mssecsvc.exe 2696 tasksche.exe - Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvc.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\WINDOWS\tasksche.exe mssecsvc.exe File created C:\WINDOWS\mssecsvc.exe rundll32.exe - Modifies data under HKEY_USERS 24 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-70-30-e2-59-87\WpadDecisionTime = 80a4df255ba3da01 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0133000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C6FE3111-72D3-4E81-BC07-5764E5CEA9F9}\WpadDecisionReason = "1" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-70-30-e2-59-87 mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C6FE3111-72D3-4E81-BC07-5764E5CEA9F9} mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-70-30-e2-59-87\WpadDecisionReason = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-70-30-e2-59-87\WpadDecision = "0" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C6FE3111-72D3-4E81-BC07-5764E5CEA9F9}\WpadDecision = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C6FE3111-72D3-4E81-BC07-5764E5CEA9F9}\06-70-30-e2-59-87 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C6FE3111-72D3-4E81-BC07-5764E5CEA9F9}\WpadDecisionTime = 80a4df255ba3da01 mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C6FE3111-72D3-4E81-BC07-5764E5CEA9F9}\WpadNetworkName = "Network 3" mssecsvc.exe - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1992 wrote to memory of 2960 1992 rundll32.exe 28 PID 1992 wrote to memory of 2960 1992 rundll32.exe 28 PID 1992 wrote to memory of 2960 1992 rundll32.exe 28 PID 1992 wrote to memory of 2960 1992 rundll32.exe 28 PID 1992 wrote to memory of 2960 1992 rundll32.exe 28 PID 1992 wrote to memory of 2960 1992 rundll32.exe 28 PID 1992 wrote to memory of 2960 1992 rundll32.exe 28 PID 2960 wrote to memory of 2948 2960 rundll32.exe 29 PID 2960 wrote to memory of 2948 2960 rundll32.exe 29 PID 2960 wrote to memory of 2948 2960 rundll32.exe 29 PID 2960 wrote to memory of 2948 2960 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\32b3efdf648ce7883be0f968f0c9ff52_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\32b3efdf648ce7883be0f968f0c9ff52_JaffaCakes118.dll,#12⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2948 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i4⤵
- Executes dropped EXE
PID:2696
-
-
-
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2624
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\mssecsvc.exe
- Size 3.6MB
- SHA256 d8ca1e199c6db534860f595f4728cdc0138e3553654cc897e4a0ae03c27eedcf
- MD5 22785c60f359a179c47fd348823876df
- SHA1 a60b6cb653f67269b6060982857ecc1454f8738c
- SHA512 534bf505f36673d9e23c4bea08d3e25b3e4325fa9efdaf16c6bba5570ca58ea35b8a053b04814d0054c708f234fd2dddb0224016f4f31b0d3987a2d8f5c66fe4
- SSDEEP 49152:2nAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAA:yDqPoBhz1aRxcSUDk36SA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\tasksche.exe
- Size 3.4MB
- SHA256 f84aa4eb7458846c58ac129227b9c1838757ed2ac3a801e4041585ce576fedec
- MD5 29c65c871d14c5f61092a6214e922507
- SHA1 c2e8769007f97c1a79e44d07924211228f2bb912
- SHA512 8cec670bc4142dd175fb8e20745a2011ddfa4332b1efbd6984aeef4827fd2c2669c2862c40059c09dddd6a446dd22916c97730c17c39a09c67ce992517c097b0
- SSDEEP 49152:nQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAA:QqPoBhz1aRxcSUDk36SA
- MD5 SHA1 SHA512 SSDEEP