Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
31-05-2024 08:04
Static task
static1
Behavioral task
behavioral1
Sample
8656409feada07aaff61398cfbdb9210_JaffaCakes118.dll
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
8656409feada07aaff61398cfbdb9210_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
8656409feada07aaff61398cfbdb9210_JaffaCakes118.dll
-
Size
5.0MB
-
MD5
8656409feada07aaff61398cfbdb9210
-
SHA1
060063fa8089968f22fcab0fdceda81b0eb9e0ea
-
SHA256
2c6bd4b55e8c4e65c81b3ccd1ac3dc7443044ffd4755a82591eddc692e64f26b
-
SHA512
11b98bc4eb130268fa05db6715b68146aa6adb917fae475ceb7fb130f4467a4ab3406c9f64c2a04636107518842f01a836ed591c2fbce796c5747beffce3376e
-
SSDEEP
98304:+8qPoBhz1aRxcSUDk36SA7xWa9P593R8yAVp2H:+8qPe1Cxcxk3ZAkadzR8yc4H
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (3217) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 3 IoCs
Processes:
mssecsvc.exemssecsvc.exetasksche.exepid process 2312 mssecsvc.exe 2244 mssecsvc.exe 2612 tasksche.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in System32 directory 1 IoCs
Processes:
mssecsvc.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvc.exe -
Drops file in Windows directory 2 IoCs
Processes:
rundll32.exemssecsvc.exedescription ioc process File created C:\WINDOWS\mssecsvc.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvc.exe -
Modifies data under HKEY_USERS 1 IoCs
Processes:
mssecsvc.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 3012 wrote to memory of 2124 3012 rundll32.exe rundll32.exe PID 3012 wrote to memory of 2124 3012 rundll32.exe rundll32.exe PID 3012 wrote to memory of 2124 3012 rundll32.exe rundll32.exe PID 3012 wrote to memory of 2124 3012 rundll32.exe rundll32.exe PID 3012 wrote to memory of 2124 3012 rundll32.exe rundll32.exe PID 3012 wrote to memory of 2124 3012 rundll32.exe rundll32.exe PID 3012 wrote to memory of 2124 3012 rundll32.exe rundll32.exe PID 2124 wrote to memory of 2312 2124 rundll32.exe mssecsvc.exe PID 2124 wrote to memory of 2312 2124 rundll32.exe mssecsvc.exe PID 2124 wrote to memory of 2312 2124 rundll32.exe mssecsvc.exe PID 2124 wrote to memory of 2312 2124 rundll32.exe mssecsvc.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8656409feada07aaff61398cfbdb9210_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8656409feada07aaff61398cfbdb9210_JaffaCakes118.dll,#12⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2312 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i4⤵
- Executes dropped EXE
PID:2612
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2244
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\mssecsvc.exeFilesize
3.6MB
MD5157a5dcea7c7e14bbb08b01fbfabd0bd
SHA1994ab6c622a592a1482013d698926576ce140e54
SHA2561cc756a41e128e04b5efb7e70824ced967753c7003cd9de8e4ef56a7187de99d
SHA512755d208def9e785546c417a0b47ff3de886b2ee200930cc73ea49babdc94514dc732ad680f45f817ca24c1c6dc2a30c318991a4d785f57d04d3bc348124e5607
-
C:\Windows\tasksche.exeFilesize
3.4MB
MD594ff6fc10c93b9370a8e767b71cec0b5
SHA14b5c1bf5fe236914ab7bd19f909de5380b09d65a
SHA256b657ab2c954e255f0ec16a9182728312fae77462f206881caf65ebc3854b85c0
SHA5121b96f910def2c5fc1d0d307cddd94e8ecd0fa8004671d9a55b1ecc9c29a2fa6785e20fa2d4818f0e413789234f633deee02302567a4526cbf08155e879b97cea
-
memory/2244-8-0x0000000000400000-0x0000000000A6B000-memory.dmpFilesize
6.4MB
-
memory/2244-15-0x0000000000400000-0x0000000000A6B000-memory.dmpFilesize
6.4MB
-
memory/2312-6-0x0000000000400000-0x0000000000A6B000-memory.dmpFilesize
6.4MB
-
memory/2312-14-0x0000000000400000-0x0000000000A6B000-memory.dmpFilesize
6.4MB