Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 08:47
Static task
static1
Behavioral task
behavioral1
Sample
5e2fc4083c7a3d3ae48db936719e9afe_JaffaCakes118.dll
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
5e2fc4083c7a3d3ae48db936719e9afe_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
5e2fc4083c7a3d3ae48db936719e9afe_JaffaCakes118.dll
-
Size
5.0MB
-
MD5
5e2fc4083c7a3d3ae48db936719e9afe
-
SHA1
35235de1a0d049e206c71e2d4a59fbdfe313dc9a
-
SHA256
3cc41535d45641cd4feeaaddc518b537e73157af9c9c293c5752df9f9d89b8d3
-
SHA512
2fc59371b02522b3a88a2e78dc7b1c77b5068109d56ed9967ddc1dbd6f381ddd2e9cd740735940f9b6afdb8a4bf6f661f16f606a9d653f585d926d57a88fe0ba
-
SSDEEP
49152:znAQqMSPbcBVPINRx+TSqTduxJM0H9PAMEcaEau3R8yAH1plAH:TDqPoBRaRxcSUUxWa9P593R8yAVp2H
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (3283) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 3 IoCs
Processes:
mssecsvc.exemssecsvc.exetasksche.exepid process 2984 mssecsvc.exe 2704 mssecsvc.exe 2496 tasksche.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in System32 directory 1 IoCs
Processes:
mssecsvc.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvc.exe -
Drops file in Windows directory 2 IoCs
Processes:
rundll32.exemssecsvc.exedescription ioc process File created C:\WINDOWS\mssecsvc.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvc.exe -
Modifies data under HKEY_USERS 24 IoCs
Processes:
mssecsvc.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F4FF00F6-A4DD-4B14-BCAB-3C6B83DF5BAF} mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1e-8e-dc-46-8e-2b mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F4FF00F6-A4DD-4B14-BCAB-3C6B83DF5BAF}\1e-8e-dc-46-8e-2b mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1e-8e-dc-46-8e-2b\WpadDecisionReason = "1" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1e-8e-dc-46-8e-2b\WpadDecisionTime = 6042125092aada01 mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00c7000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F4FF00F6-A4DD-4B14-BCAB-3C6B83DF5BAF}\WpadDecision = "0" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1e-8e-dc-46-8e-2b\WpadDecision = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F4FF00F6-A4DD-4B14-BCAB-3C6B83DF5BAF}\WpadDecisionReason = "1" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F4FF00F6-A4DD-4B14-BCAB-3C6B83DF5BAF}\WpadNetworkName = "Network 3" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F4FF00F6-A4DD-4B14-BCAB-3C6B83DF5BAF}\WpadDecisionTime = 6042125092aada01 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvc.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 2424 wrote to memory of 2056 2424 rundll32.exe rundll32.exe PID 2424 wrote to memory of 2056 2424 rundll32.exe rundll32.exe PID 2424 wrote to memory of 2056 2424 rundll32.exe rundll32.exe PID 2424 wrote to memory of 2056 2424 rundll32.exe rundll32.exe PID 2424 wrote to memory of 2056 2424 rundll32.exe rundll32.exe PID 2424 wrote to memory of 2056 2424 rundll32.exe rundll32.exe PID 2424 wrote to memory of 2056 2424 rundll32.exe rundll32.exe PID 2056 wrote to memory of 2984 2056 rundll32.exe mssecsvc.exe PID 2056 wrote to memory of 2984 2056 rundll32.exe mssecsvc.exe PID 2056 wrote to memory of 2984 2056 rundll32.exe mssecsvc.exe PID 2056 wrote to memory of 2984 2056 rundll32.exe mssecsvc.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5e2fc4083c7a3d3ae48db936719e9afe_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5e2fc4083c7a3d3ae48db936719e9afe_JaffaCakes118.dll,#12⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2984 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i4⤵
- Executes dropped EXE
PID:2496
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2704
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.6MB
MD506711856e7b3cd075b62432c991bea0f
SHA12309d57e39bb99f5c0e38f92cbd43263c2bdcee6
SHA256ed0e16d75612cc00c3b92016726d3ac29e108fbc964acab850f6357326959b11
SHA5124aed31b6ed683b7d17ed51091f98fb6f53f621f0fb2bbb2cd2f205c622e046c95a3e3873391e30b830903f6676a44a5c2a099d7a7c614e12668d46a96e199dd9
-
Filesize
3.4MB
MD5b7d5149cc560e814dfb249951f8fa31c
SHA100affa7e8af78f9e93d1a7f1a5641e076deef84e
SHA25637d5a9743a6b1042de662def353524da39b3d183249f67d5c79179426fcd6ec0
SHA51255701686b1f4189f1ac1c46a9aa9e0bcef84d7d3ef8a739960d7ba1cece020be5a8aaaefb025dbe51e47c298c2feeb1520a35453ab75c09a20c09f2a8f573ed2