Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
02-06-2024 16:04
Static task
static1
Behavioral task
behavioral1
Sample
8ea435211e07717c7859f4286eb4519b_JaffaCakes118.dll
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
8ea435211e07717c7859f4286eb4519b_JaffaCakes118.dll
Resource
win10v2004-20240426-en
General
-
Target
8ea435211e07717c7859f4286eb4519b_JaffaCakes118.dll
-
Size
5.0MB
-
MD5
8ea435211e07717c7859f4286eb4519b
-
SHA1
e77f3687afe9f530b16615196dddeed67a2f504b
-
SHA256
41d2c0c73ee48f44866b80d5066350414b8120e8a6fc339617fcb6d202294163
-
SHA512
7a3ae4e6ae25f51873cbd99486b87e99f95456aecd1bf3b9bfac0d6f1ffae885893ac07f831b6538dac88b90eaa4b11947d6f2450267ef9691568746ac7a9fcb
-
SSDEEP
98304:TDqPoBtk36SAEdhvxWa9P593R8yAVp2H:TDqPck3ZAEUadzR8yc4H
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (3104) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 3 IoCs
Processes:
mssecsvc.exemssecsvc.exetasksche.exepid process 3064 mssecsvc.exe 2648 mssecsvc.exe 2644 tasksche.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in System32 directory 1 IoCs
Processes:
mssecsvc.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvc.exe -
Drops file in Windows directory 2 IoCs
Processes:
rundll32.exemssecsvc.exedescription ioc process File created C:\WINDOWS\mssecsvc.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvc.exe -
Modifies data under HKEY_USERS 24 IoCs
Processes:
mssecsvc.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\22-00-ba-a0-30-b3\WpadDecisionTime = 5070438706b5da01 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{21F9738D-D762-40DD-9DC7-403F81DEA17D}\WpadDecisionReason = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{21F9738D-D762-40DD-9DC7-403F81DEA17D}\WpadDecision = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{21F9738D-D762-40DD-9DC7-403F81DEA17D}\22-00-ba-a0-30-b3 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\22-00-ba-a0-30-b3\WpadDecision = "0" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{21F9738D-D762-40DD-9DC7-403F81DEA17D} mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{21F9738D-D762-40DD-9DC7-403F81DEA17D}\WpadDecisionTime = 5070438706b5da01 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\22-00-ba-a0-30-b3 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{21F9738D-D762-40DD-9DC7-403F81DEA17D}\WpadNetworkName = "Network 3" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\22-00-ba-a0-30-b3\WpadDecisionReason = "1" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0071000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 2320 wrote to memory of 2640 2320 rundll32.exe rundll32.exe PID 2320 wrote to memory of 2640 2320 rundll32.exe rundll32.exe PID 2320 wrote to memory of 2640 2320 rundll32.exe rundll32.exe PID 2320 wrote to memory of 2640 2320 rundll32.exe rundll32.exe PID 2320 wrote to memory of 2640 2320 rundll32.exe rundll32.exe PID 2320 wrote to memory of 2640 2320 rundll32.exe rundll32.exe PID 2320 wrote to memory of 2640 2320 rundll32.exe rundll32.exe PID 2640 wrote to memory of 3064 2640 rundll32.exe mssecsvc.exe PID 2640 wrote to memory of 3064 2640 rundll32.exe mssecsvc.exe PID 2640 wrote to memory of 3064 2640 rundll32.exe mssecsvc.exe PID 2640 wrote to memory of 3064 2640 rundll32.exe mssecsvc.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8ea435211e07717c7859f4286eb4519b_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8ea435211e07717c7859f4286eb4519b_JaffaCakes118.dll,#12⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3064 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i4⤵
- Executes dropped EXE
PID:2644
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2648
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\mssecsvc.exeFilesize
3.6MB
MD527d702f71eca8cbb89cbf03dc00a6c03
SHA1a13405a3b5d6a8b0262651097171c81b8e7bc549
SHA2569aa2a79b40288178664d878d717df867a89e34ea7b02b06aed51b607aaa40a56
SHA5124007b402b8cea54496ad876f9595af03a71450ecda09259fde8179ff513a311083789dacdab2c9b2f854d7fd6b999d931b41bd6814c36ded95a202fc8c5298bd
-
C:\Windows\tasksche.exeFilesize
3.4MB
MD580722f97b01b733d3b80ba1585c85f22
SHA103acec22b7ac1b110248e2124818e98c2e6764a9
SHA256ca9b73d4fe343bbc136159cd1f8d7655faa1ac48f35c4a71f396fe25339c3f67
SHA512fe21dfa01a5e2cd3cb279016fcbcd1531c0d23e427cc91f1aa743ca2ad6c66ad456f9b7940a8075ebe561fe821c76f5b3917d738262cae9648b319768cfe222b