Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
01-06-2024 02:35
Static task
static1
Behavioral task
behavioral1
Sample
8924b339676e83475bfa7c709c4d54c3_JaffaCakes118.dll
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
8924b339676e83475bfa7c709c4d54c3_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
8924b339676e83475bfa7c709c4d54c3_JaffaCakes118.dll
-
Size
5.0MB
-
MD5
8924b339676e83475bfa7c709c4d54c3
-
SHA1
5f37a2d092f8ee5dda42522a324f3bfefbcb655d
-
SHA256
e0a728802289e67afe04d45082f08da34d39dd981674b2e7ff0828721a3b5220
-
SHA512
f41dd9522309b5114f54e2ad46769bcdcdf813c2bcbd8d2f094ca15a1dbc77cfce90b95c85bf2ab2a1e384ce1edf3e105b840758a73304833ca87d838bedd6f4
-
SSDEEP
49152:znAQbNRXdhnvxJM0H9PAMEcaEau3R8yAH1plAH:TDhRXdhvxWa9P593R8yAVp2H
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (3083) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 3 IoCs
Processes:
mssecsvc.exemssecsvc.exetasksche.exepid process 1860 mssecsvc.exe 2688 mssecsvc.exe 1108 tasksche.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in System32 directory 1 IoCs
Processes:
mssecsvc.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvc.exe -
Drops file in Windows directory 2 IoCs
Processes:
rundll32.exemssecsvc.exedescription ioc process File created C:\WINDOWS\mssecsvc.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvc.exe -
Modifies data under HKEY_USERS 24 IoCs
Processes:
mssecsvc.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00d2000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DAE6EADF-EFB6-4A25-AAEC-AF3E3EEDE43A}\WpadDecisionTime = b00c6b62ccb3da01 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7a-a6-c8-69-d9-42\WpadDecision = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DAE6EADF-EFB6-4A25-AAEC-AF3E3EEDE43A}\WpadDecisionReason = "1" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7a-a6-c8-69-d9-42\WpadDecisionTime = b00c6b62ccb3da01 mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DAE6EADF-EFB6-4A25-AAEC-AF3E3EEDE43A} mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DAE6EADF-EFB6-4A25-AAEC-AF3E3EEDE43A}\7a-a6-c8-69-d9-42 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7a-a6-c8-69-d9-42\WpadDecisionReason = "1" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DAE6EADF-EFB6-4A25-AAEC-AF3E3EEDE43A}\WpadDecision = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7a-a6-c8-69-d9-42 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DAE6EADF-EFB6-4A25-AAEC-AF3E3EEDE43A}\WpadNetworkName = "Network 3" mssecsvc.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1992 wrote to memory of 1632 1992 rundll32.exe rundll32.exe PID 1992 wrote to memory of 1632 1992 rundll32.exe rundll32.exe PID 1992 wrote to memory of 1632 1992 rundll32.exe rundll32.exe PID 1992 wrote to memory of 1632 1992 rundll32.exe rundll32.exe PID 1992 wrote to memory of 1632 1992 rundll32.exe rundll32.exe PID 1992 wrote to memory of 1632 1992 rundll32.exe rundll32.exe PID 1992 wrote to memory of 1632 1992 rundll32.exe rundll32.exe PID 1632 wrote to memory of 1860 1632 rundll32.exe mssecsvc.exe PID 1632 wrote to memory of 1860 1632 rundll32.exe mssecsvc.exe PID 1632 wrote to memory of 1860 1632 rundll32.exe mssecsvc.exe PID 1632 wrote to memory of 1860 1632 rundll32.exe mssecsvc.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8924b339676e83475bfa7c709c4d54c3_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8924b339676e83475bfa7c709c4d54c3_JaffaCakes118.dll,#12⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1860 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i4⤵
- Executes dropped EXE
PID:1108
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2688
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\mssecsvc.exeFilesize
3.6MB
MD5837ad9bb9ed5e918b1ac530d607ffb20
SHA1f39a2d4a16e6a545aedf8394a8aa38e6b556f24a
SHA25619aef626421ddb69b2f8a35a7e649672f151f9a84edf8c1136881aa5113d03f8
SHA512f0a2dd9b3e12c28e53850b31f69341d7dd4b517886f92ad111b0c42221257485cdd603228370d684f0b0bf42e59312ed4f1c4f444ed32733770a3d01885db01d
-
C:\Windows\tasksche.exeFilesize
3.4MB
MD58dfaeb8472d8f536ce25f6136561d21c
SHA103a642c5a02873310c6ac2ea4a748d0036064f61
SHA2562b79efbdab50d7b080f31aeecb8a51684521d8799db84667a708738f1a3794e4
SHA512a7b4a2743bdec1b8dd3507968ae9daa68266f3d3ae9fd2a605890127433855984aa96052a993de5e8844674fd0e384d92d53ed0da64e5626ce89ce72ded3116f