Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 10:31
Static task
static1
Behavioral task
behavioral1
Sample
6e344b6b1c9fd13c81b90ef87f7891b4_JaffaCakes118.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
6e344b6b1c9fd13c81b90ef87f7891b4_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
6e344b6b1c9fd13c81b90ef87f7891b4_JaffaCakes118.dll
-
Size
5.0MB
-
MD5
6e344b6b1c9fd13c81b90ef87f7891b4
-
SHA1
983bcf211b0a506cf31203694d54416c52b2f1aa
-
SHA256
4acc32f5b088b82bd0b849e40e22c99825a57b0d03cc2f1a6655d633c03f542f
-
SHA512
326a5d9040fa7a6a43abde242edb97e5552003e30d0d5186c7bd6fcb2375245d226e7da92dfaceddcaa5fb9cf7cd2d7fa8f835887543b56931d4cf437bf3213c
-
SSDEEP
98304:PDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2K:PDqPe1Cxcxk3ZAEUadzR8yc4K
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (3203) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 2 IoCs
Processes:
mssecsvc.exemssecsvc.exepid process 1580 mssecsvc.exe 2704 mssecsvc.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in System32 directory 1 IoCs
Processes:
mssecsvc.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvc.exe -
Drops file in Windows directory 2 IoCs
Processes:
rundll32.exemssecsvc.exedescription ioc process File created C:\WINDOWS\mssecsvc.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvc.exe -
Modifies data under HKEY_USERS 24 IoCs
Processes:
mssecsvc.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1966DC90-6F93-469F-A026-6571FB8734E0} mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1966DC90-6F93-469F-A026-6571FB8734E0}\WpadDecision = "0" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0038000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\36-2a-5f-36-bb-1f mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\36-2a-5f-36-bb-1f\WpadDecision = "0" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\36-2a-5f-36-bb-1f\WpadDecisionTime = 3034349ac5adda01 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1966DC90-6F93-469F-A026-6571FB8734E0}\WpadDecisionReason = "1" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1966DC90-6F93-469F-A026-6571FB8734E0}\WpadNetworkName = "Network 3" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\36-2a-5f-36-bb-1f\WpadDecisionReason = "1" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1966DC90-6F93-469F-A026-6571FB8734E0}\36-2a-5f-36-bb-1f mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1966DC90-6F93-469F-A026-6571FB8734E0}\WpadDecisionTime = 3034349ac5adda01 mssecsvc.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
mssecsvc.exemssecsvc.exepid process 1580 mssecsvc.exe 2704 mssecsvc.exe -
Suspicious behavior: MapViewOfSection 43 IoCs
Processes:
mssecsvc.exemssecsvc.exepid process 1580 mssecsvc.exe 1580 mssecsvc.exe 1580 mssecsvc.exe 1580 mssecsvc.exe 1580 mssecsvc.exe 1580 mssecsvc.exe 1580 mssecsvc.exe 1580 mssecsvc.exe 1580 mssecsvc.exe 1580 mssecsvc.exe 1580 mssecsvc.exe 1580 mssecsvc.exe 1580 mssecsvc.exe 1580 mssecsvc.exe 1580 mssecsvc.exe 1580 mssecsvc.exe 1580 mssecsvc.exe 1580 mssecsvc.exe 1580 mssecsvc.exe 1580 mssecsvc.exe 1580 mssecsvc.exe 2704 mssecsvc.exe 2704 mssecsvc.exe 2704 mssecsvc.exe 2704 mssecsvc.exe 2704 mssecsvc.exe 2704 mssecsvc.exe 2704 mssecsvc.exe 2704 mssecsvc.exe 2704 mssecsvc.exe 2704 mssecsvc.exe 2704 mssecsvc.exe 2704 mssecsvc.exe 2704 mssecsvc.exe 2704 mssecsvc.exe 2704 mssecsvc.exe 2704 mssecsvc.exe 2704 mssecsvc.exe 2704 mssecsvc.exe 2704 mssecsvc.exe 2704 mssecsvc.exe 2704 mssecsvc.exe 2704 mssecsvc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
mssecsvc.exemssecsvc.exedescription pid process Token: SeDebugPrivilege 1580 mssecsvc.exe Token: SeDebugPrivilege 2704 mssecsvc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
rundll32.exerundll32.exemssecsvc.exedescription pid process target process PID 2364 wrote to memory of 2372 2364 rundll32.exe rundll32.exe PID 2364 wrote to memory of 2372 2364 rundll32.exe rundll32.exe PID 2364 wrote to memory of 2372 2364 rundll32.exe rundll32.exe PID 2364 wrote to memory of 2372 2364 rundll32.exe rundll32.exe PID 2364 wrote to memory of 2372 2364 rundll32.exe rundll32.exe PID 2364 wrote to memory of 2372 2364 rundll32.exe rundll32.exe PID 2364 wrote to memory of 2372 2364 rundll32.exe rundll32.exe PID 2372 wrote to memory of 1580 2372 rundll32.exe mssecsvc.exe PID 2372 wrote to memory of 1580 2372 rundll32.exe mssecsvc.exe PID 2372 wrote to memory of 1580 2372 rundll32.exe mssecsvc.exe PID 2372 wrote to memory of 1580 2372 rundll32.exe mssecsvc.exe PID 1580 wrote to memory of 384 1580 mssecsvc.exe wininit.exe PID 1580 wrote to memory of 384 1580 mssecsvc.exe wininit.exe PID 1580 wrote to memory of 384 1580 mssecsvc.exe wininit.exe PID 1580 wrote to memory of 384 1580 mssecsvc.exe wininit.exe PID 1580 wrote to memory of 384 1580 mssecsvc.exe wininit.exe PID 1580 wrote to memory of 384 1580 mssecsvc.exe wininit.exe PID 1580 wrote to memory of 384 1580 mssecsvc.exe wininit.exe PID 1580 wrote to memory of 392 1580 mssecsvc.exe csrss.exe PID 1580 wrote to memory of 392 1580 mssecsvc.exe csrss.exe PID 1580 wrote to memory of 392 1580 mssecsvc.exe csrss.exe PID 1580 wrote to memory of 392 1580 mssecsvc.exe csrss.exe PID 1580 wrote to memory of 392 1580 mssecsvc.exe csrss.exe PID 1580 wrote to memory of 392 1580 mssecsvc.exe csrss.exe PID 1580 wrote to memory of 392 1580 mssecsvc.exe csrss.exe PID 1580 wrote to memory of 432 1580 mssecsvc.exe winlogon.exe PID 1580 wrote to memory of 432 1580 mssecsvc.exe winlogon.exe PID 1580 wrote to memory of 432 1580 mssecsvc.exe winlogon.exe PID 1580 wrote to memory of 432 1580 mssecsvc.exe winlogon.exe PID 1580 wrote to memory of 432 1580 mssecsvc.exe winlogon.exe PID 1580 wrote to memory of 432 1580 mssecsvc.exe winlogon.exe PID 1580 wrote to memory of 432 1580 mssecsvc.exe winlogon.exe PID 1580 wrote to memory of 476 1580 mssecsvc.exe services.exe PID 1580 wrote to memory of 476 1580 mssecsvc.exe services.exe PID 1580 wrote to memory of 476 1580 mssecsvc.exe services.exe PID 1580 wrote to memory of 476 1580 mssecsvc.exe services.exe PID 1580 wrote to memory of 476 1580 mssecsvc.exe services.exe PID 1580 wrote to memory of 476 1580 mssecsvc.exe services.exe PID 1580 wrote to memory of 476 1580 mssecsvc.exe services.exe PID 1580 wrote to memory of 492 1580 mssecsvc.exe lsass.exe PID 1580 wrote to memory of 492 1580 mssecsvc.exe lsass.exe PID 1580 wrote to memory of 492 1580 mssecsvc.exe lsass.exe PID 1580 wrote to memory of 492 1580 mssecsvc.exe lsass.exe PID 1580 wrote to memory of 492 1580 mssecsvc.exe lsass.exe PID 1580 wrote to memory of 492 1580 mssecsvc.exe lsass.exe PID 1580 wrote to memory of 492 1580 mssecsvc.exe lsass.exe PID 1580 wrote to memory of 500 1580 mssecsvc.exe lsm.exe PID 1580 wrote to memory of 500 1580 mssecsvc.exe lsm.exe PID 1580 wrote to memory of 500 1580 mssecsvc.exe lsm.exe PID 1580 wrote to memory of 500 1580 mssecsvc.exe lsm.exe PID 1580 wrote to memory of 500 1580 mssecsvc.exe lsm.exe PID 1580 wrote to memory of 500 1580 mssecsvc.exe lsm.exe PID 1580 wrote to memory of 500 1580 mssecsvc.exe lsm.exe PID 1580 wrote to memory of 592 1580 mssecsvc.exe svchost.exe PID 1580 wrote to memory of 592 1580 mssecsvc.exe svchost.exe PID 1580 wrote to memory of 592 1580 mssecsvc.exe svchost.exe PID 1580 wrote to memory of 592 1580 mssecsvc.exe svchost.exe PID 1580 wrote to memory of 592 1580 mssecsvc.exe svchost.exe PID 1580 wrote to memory of 592 1580 mssecsvc.exe svchost.exe PID 1580 wrote to memory of 592 1580 mssecsvc.exe svchost.exe PID 1580 wrote to memory of 676 1580 mssecsvc.exe svchost.exe PID 1580 wrote to memory of 676 1580 mssecsvc.exe svchost.exe PID 1580 wrote to memory of 676 1580 mssecsvc.exe svchost.exe PID 1580 wrote to memory of 676 1580 mssecsvc.exe svchost.exe
Processes
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:384
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵PID:476
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵PID:592
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵PID:1560
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵PID:676
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵PID:744
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵PID:804
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵PID:1116
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵PID:848
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵PID:952
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵PID:108
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵PID:1040
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵PID:1052
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵PID:1136
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵PID:2076
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵PID:2340
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2704 -
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵PID:492
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:500
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:392
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:432
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1180
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6e344b6b1c9fd13c81b90ef87f7891b4_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6e344b6b1c9fd13c81b90ef87f7891b4_JaffaCakes118.dll,#13⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe4⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1580
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\mssecsvc.exeFilesize
3.6MB
MD5f084bf750af6c417177879334c4e6a23
SHA1dd51fd06f0f23a21e441839d5e7bddffc29c3f12
SHA2561f62905d40a708bffa7d64947bdc953f16eec73ec6ab33667e0566022b33248d
SHA512f34d2d9bfc38cecc934b603c01fe89856e8686e09df7227ad64e0dd596657713b202cf3eb8f2ffbf0f9082789fd1ef59faba26ada2f1f55fffc5eb8c87f7f323
-
memory/1580-6-0x0000000000400000-0x0000000000A72000-memory.dmpFilesize
6.4MB
-
memory/1580-7-0x0000000000400000-0x0000000000A72000-memory.dmpFilesize
6.4MB
-
memory/1580-12-0x0000000000400000-0x0000000000A72000-memory.dmpFilesize
6.4MB
-
memory/2704-9-0x0000000000400000-0x0000000000A72000-memory.dmpFilesize
6.4MB
-
memory/2704-13-0x0000000000400000-0x0000000000A72000-memory.dmpFilesize
6.4MB