Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    18-05-2024 03:16

General

  • Target

    52cd053b0ecf5d351a4c376029d78ae0_JaffaCakes118.dll

  • Size

    5.0MB

  • MD5

    52cd053b0ecf5d351a4c376029d78ae0

  • SHA1

    770035329cd2ca417f5d1e23782d067244d4064e

  • SHA256

    4aa61b6b79b54ee13829fe08476e23bbeb325e31d4cf486bd86ff061b4bab022

  • SHA512

    12f6e931219352d6f67cbf28c6caa108bc2bfc6735bc1532c279fefb230821602549344a4418a68ea63cb13dd32d27a3d2d128c1804944f01aea305d3ce602ff

  • SSDEEP

    98304:TDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVpEmFe:TDqPe1Cxcxk3ZAEUadzR8yc

Malware Config

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

  • Contacts a large (3315) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Executes dropped EXE 3 IoCs
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies data under HKEY_USERS 24 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\52cd053b0ecf5d351a4c376029d78ae0_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2060
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\52cd053b0ecf5d351a4c376029d78ae0_JaffaCakes118.dll,#1
      2⤵
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:2096
      • C:\WINDOWS\mssecsvc.exe
        C:\WINDOWS\mssecsvc.exe
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        PID:2104
        • C:\WINDOWS\tasksche.exe
          C:\WINDOWS\tasksche.exe /i
          4⤵
          • Executes dropped EXE
          PID:2724
  • C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe -m security
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Modifies data under HKEY_USERS
    PID:2628

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\mssecsvc.exe

    Filesize

    3.6MB

    MD5

    ad8ba4f4893de54d7107a0e8dc34012a

    SHA1

    651ea10d2297f6423f5e33adb6b59c7e3daa1d3e

    SHA256

    4065abe54cdfc6811acc9e95cd133df0dd357c6cd9e8b410d65b42ac11ef7d86

    SHA512

    2e955901dd8fe0e93d459f79703ad7da2349e04307779d46a1a502e96ff9726314775790742e072ca07321003f9c3c8aa93f522faeda5f920d87ba1c89a2ac8a

  • C:\Windows\tasksche.exe

    Filesize

    3.4MB

    MD5

    7d1151fe53162651bbc4bf86527604ea

    SHA1

    144a39099ecae3e48eadc3307aef854a0f6751ae

    SHA256

    19c5e5586f40847930b5d5af9942809602bbfc2fed1c2d78fd3ec7a3334c9ee3

    SHA512

    69174a0bc599146fc5c9de5efa6736c9c4ffe9ea05111d15d797b12bf1a0056140d233cd3df4478b981a19252c209a2fe5605c27e49daf0b5fb47250287eb345