Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
31-05-2024 19:37
Static task
static1
Behavioral task
behavioral1
Sample
881e9916951118c60daeeec26aed4a53_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
881e9916951118c60daeeec26aed4a53_JaffaCakes118.dll
Resource
win10v2004-20240426-en
General
-
Target
881e9916951118c60daeeec26aed4a53_JaffaCakes118.dll
-
Size
5.0MB
-
MD5
881e9916951118c60daeeec26aed4a53
-
SHA1
65b6245adf5fb8f59151e3e29e7485fc92d8d252
-
SHA256
320e16527e1f75a55984e61fcee900fc070a12ae85b5a163bc00cda76b6b9ce6
-
SHA512
bc51b4594a4b7d504cd3fe4a3baca278edf3342ba79dfd461112dc219fb6fe356b356231d88f521834a359d72e90dff531f0b8d1a3a963ed110af37818a3b02b
-
SSDEEP
98304:+DqPoBhz1aRxcSUDk36SAEdhvxWa9P5ep:+DqPe1Cxcxk3ZAEUadM
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (3206) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 3 IoCs
Processes:
mssecsvc.exemssecsvc.exetasksche.exepid process 712 mssecsvc.exe 3016 mssecsvc.exe 4720 tasksche.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in Windows directory 2 IoCs
Processes:
mssecsvc.exerundll32.exedescription ioc process File created C:\WINDOWS\tasksche.exe mssecsvc.exe File created C:\WINDOWS\mssecsvc.exe rundll32.exe -
Modifies data under HKEY_USERS 5 IoCs
Processes:
mssecsvc.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" mssecsvc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 2956 wrote to memory of 5100 2956 rundll32.exe rundll32.exe PID 2956 wrote to memory of 5100 2956 rundll32.exe rundll32.exe PID 2956 wrote to memory of 5100 2956 rundll32.exe rundll32.exe PID 5100 wrote to memory of 712 5100 rundll32.exe mssecsvc.exe PID 5100 wrote to memory of 712 5100 rundll32.exe mssecsvc.exe PID 5100 wrote to memory of 712 5100 rundll32.exe mssecsvc.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\881e9916951118c60daeeec26aed4a53_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\881e9916951118c60daeeec26aed4a53_JaffaCakes118.dll,#12⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:712 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i4⤵
- Executes dropped EXE
PID:4720
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:3016
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\mssecsvc.exeFilesize
3.6MB
MD5e0afec59159536ea29c1b33c7cf5ab13
SHA18f72c18f360b45f426aef3360aa4ce00d78e60f0
SHA25626cc8ccd880ab77cec78dbbd147c925bb4ae91b478953b12d821c63e4b613179
SHA5122532443a65ad2dcf8cad2f3777e50a01c09be7244932dcd22d7b5426d663c6ac4d09d6b82bca17d57da08f6fc70f8d37fa9f71290552f7ba469dd2da801fe412
-
C:\Windows\tasksche.exeFilesize
3.4MB
MD5e097f84fa7676b5387336354f3e3341c
SHA10102f4a126889a305d2421f9beb2e2205b0a8651
SHA25692a99121c40a2553a8d454424eecc326936911fb697194a8f84a9020a4bf5066
SHA5124a12420bd7d4935f5e7dfc52a914bb0cba8a88c906f0e77fd00d4d04d336b4d9d6ab4ea0325c8760411afb63a54dcb8b115c28b42e6470908c56025c2b8abe84