Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29-05-2024 11:20
Static task
static1
Behavioral task
behavioral1
Sample
8090ed29e8afa2d04b54ee0cf4b573c8_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8090ed29e8afa2d04b54ee0cf4b573c8_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
8090ed29e8afa2d04b54ee0cf4b573c8_JaffaCakes118.dll
-
Size
5.0MB
-
MD5
8090ed29e8afa2d04b54ee0cf4b573c8
-
SHA1
642913feed72e220aa168f5a1343379125cf5acf
-
SHA256
50513f3e383da1173175067c95f20bb81bd00b33cb85d4dd41c341d91a23290a
-
SHA512
9b8e5c7fd79b9763571c494a5bf2a8c556bd72dcb1fa86b113654f8e627760992784ca97f52668fdfe40b16db21c750deea35433bbba8c0ca91ed0f190ee5c1d
-
SSDEEP
49152:znAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9P:TDqPoBhz1aRxcSUDk36SAEdhvxWa9P
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (3329) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 3 IoCs
Processes:
mssecsvc.exemssecsvc.exetasksche.exepid process 1956 mssecsvc.exe 2944 mssecsvc.exe 2744 tasksche.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in System32 directory 1 IoCs
Processes:
mssecsvc.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvc.exe -
Drops file in Windows directory 2 IoCs
Processes:
rundll32.exemssecsvc.exedescription ioc process File created C:\WINDOWS\mssecsvc.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvc.exe -
Modifies data under HKEY_USERS 24 IoCs
Processes:
mssecsvc.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7B274256-EC98-4E65-A3E0-0501880B15E6}\WpadNetworkName = "Network 3" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-7f-59-f5-bc-6f\WpadDecisionTime = e0467043bab1da01 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-7f-59-f5-bc-6f\WpadDecision = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7B274256-EC98-4E65-A3E0-0501880B15E6} mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7B274256-EC98-4E65-A3E0-0501880B15E6}\WpadDecisionTime = e0467043bab1da01 mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00ef000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7B274256-EC98-4E65-A3E0-0501880B15E6}\WpadDecisionReason = "1" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7B274256-EC98-4E65-A3E0-0501880B15E6}\52-7f-59-f5-bc-6f mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-7f-59-f5-bc-6f\WpadDecisionReason = "1" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-7f-59-f5-bc-6f mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7B274256-EC98-4E65-A3E0-0501880B15E6}\WpadDecision = "0" mssecsvc.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 2724 wrote to memory of 2024 2724 rundll32.exe rundll32.exe PID 2724 wrote to memory of 2024 2724 rundll32.exe rundll32.exe PID 2724 wrote to memory of 2024 2724 rundll32.exe rundll32.exe PID 2724 wrote to memory of 2024 2724 rundll32.exe rundll32.exe PID 2724 wrote to memory of 2024 2724 rundll32.exe rundll32.exe PID 2724 wrote to memory of 2024 2724 rundll32.exe rundll32.exe PID 2724 wrote to memory of 2024 2724 rundll32.exe rundll32.exe PID 2024 wrote to memory of 1956 2024 rundll32.exe mssecsvc.exe PID 2024 wrote to memory of 1956 2024 rundll32.exe mssecsvc.exe PID 2024 wrote to memory of 1956 2024 rundll32.exe mssecsvc.exe PID 2024 wrote to memory of 1956 2024 rundll32.exe mssecsvc.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8090ed29e8afa2d04b54ee0cf4b573c8_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8090ed29e8afa2d04b54ee0cf4b573c8_JaffaCakes118.dll,#12⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1956 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i4⤵
- Executes dropped EXE
PID:2744
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2944
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\mssecsvc.exeFilesize
3.6MB
MD58ac1c3352614af029408c394f0e14b7c
SHA1a8c032fd3ab54e544c00ce01899d35e9e647bbbf
SHA2564b5ea02dde4ea71dc8736619df3cf533e82902f84fe93299065cf286430bad9e
SHA5124c16f4e5b0b65f706f22f5296a48f5b333af07af03a9162ae4e235db6cc13e48642b44a5c49187c050b6e3ed28c6b40cf36ae7eb48e78c8f0a3e023dd27c2d0e
-
C:\Windows\tasksche.exeFilesize
3.4MB
MD5e9ac2d4229bcf4d8fee4fb6b7e15906c
SHA12be97a9acf9e0d7953c2fb6d53b2fe3ce78b4fa1
SHA2569c5a895409b0aa24d9accb7970187c73d5935e602a4201fcc66582c89049123f
SHA512cb5b17a66f21078a3be8a012eda7e92617aa5dc3ef4768c009fd13194090b1191f90d0c606766088af60109c6b975088c9b1987e3c7d76e17c8d74fed4e6b8f6