Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    20-05-2024 10:31

General

  • Target

    5e9b954b8c515845290d7c35fb748559_JaffaCakes118.dll

  • Size

    5.0MB

  • MD5

    5e9b954b8c515845290d7c35fb748559

  • SHA1

    485f2c2e04192571ea699ce86175fe6a03e0bce4

  • SHA256

    d1df2a0fab72ebb3c8889e2d2dad722231a4f84a48b52b616352673f624da199

  • SHA512

    4aafd953c361a75f7b1c07a3b7cae4f830a4e1551122584bff39a04124cbca249810a023ee43c22042af9a2918756c1afbd6fa14c63880c3a22bebce2017b6e3

  • SSDEEP

    98304:+DqPoBQk36SAEdhvxWa9P593R8yAVp2H:+DqPtk3ZAEUadzR8yc4H

Malware Config

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

  • Contacts a large (3269) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Executes dropped EXE 3 IoCs
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies data under HKEY_USERS 24 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e9b954b8c515845290d7c35fb748559_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2020
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e9b954b8c515845290d7c35fb748559_JaffaCakes118.dll,#1
      2⤵
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:1816
      • C:\WINDOWS\mssecsvc.exe
        C:\WINDOWS\mssecsvc.exe
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        PID:1712
        • C:\WINDOWS\tasksche.exe
          C:\WINDOWS\tasksche.exe /i
          4⤵
          • Executes dropped EXE
          PID:2572
  • C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe -m security
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Modifies data under HKEY_USERS
    PID:3036

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\mssecsvc.exe

    Filesize

    3.6MB

    MD5

    d0eed9be07964df59b247650b813c5a7

    SHA1

    d1dd0d719345bf8d23437587fa44a8b3e6aa6000

    SHA256

    10bb606f3ddc164ff302a03e0e534b6be3f485d1a9858b21978bb0cfd3df06ac

    SHA512

    bb2be5908e2bda6475d4f05b3267ab0b2442d208ef531c68853361d1e0b4b9450a184bcda4beb7603375ddf6514a39b68c34e2ae88a2ed355dd1359b12691f67

  • C:\Windows\tasksche.exe

    Filesize

    3.4MB

    MD5

    9cf8869d9823f4ddac798510ab63e347

    SHA1

    56093197311a8edae0c3813756fa6a5813cad436

    SHA256

    776f61e107b616a5008acb1794f359ac875cd0ed861be3730c60d8f42da977a8

    SHA512

    ace5d0b5b15bda0726685576e10225fb5881ebe0b8ebdb28686f430cd4f4f679e46d7ae19976ec4406d57cb69f72265f30f6863de4b1b21ef79ebd34969a1dbe