Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
11-06-2024 08:03
Static task
static1
Behavioral task
behavioral1
Sample
9d81c50361a2ef2b18c754eb9625143c_JaffaCakes118.dll
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
9d81c50361a2ef2b18c754eb9625143c_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
9d81c50361a2ef2b18c754eb9625143c_JaffaCakes118.dll
-
Size
5.0MB
-
MD5
9d81c50361a2ef2b18c754eb9625143c
-
SHA1
ae6bcee32bfbdb752061e24b5a39a2821d13594a
-
SHA256
d93476e8a77436c20fbd4c27ed2eea9508b65e9c89a15eeae3f327cbb211c4db
-
SHA512
0f5f7c073a550df1944b46517416dda1877ecdb18facd553d571a2d9682c8808a3cb916aff25fdf245b91c7883100eefbc4f1cbd0613282add652bf05170a72a
-
SSDEEP
49152:SnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0HY:+DqPoBhz1aRxcSUDk36SAEdhvxWa
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (2673) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 3 IoCs
Processes:
mssecsvc.exemssecsvc.exetasksche.exepid process 2732 mssecsvc.exe 2636 mssecsvc.exe 2480 tasksche.exe -
Drops file in System32 directory 1 IoCs
Processes:
mssecsvc.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvc.exe -
Drops file in Windows directory 2 IoCs
Processes:
rundll32.exemssecsvc.exedescription ioc process File created C:\WINDOWS\mssecsvc.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvc.exe -
Modifies data under HKEY_USERS 24 IoCs
Processes:
mssecsvc.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{198D975C-AC69-4FE2-B647-555B59A31385}\WpadDecisionReason = "1" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\22-b2-86-34-b4-c1 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\22-b2-86-34-b4-c1\WpadDecisionReason = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\22-b2-86-34-b4-c1\WpadDecision = "0" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{198D975C-AC69-4FE2-B647-555B59A31385}\22-b2-86-34-b4-c1 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00d6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{198D975C-AC69-4FE2-B647-555B59A31385}\WpadDecisionTime = 807735e7d5bbda01 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{198D975C-AC69-4FE2-B647-555B59A31385}\WpadDecision = "0" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{198D975C-AC69-4FE2-B647-555B59A31385}\WpadNetworkName = "Network 3" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{198D975C-AC69-4FE2-B647-555B59A31385} mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\22-b2-86-34-b4-c1\WpadDecisionTime = 807735e7d5bbda01 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvc.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 2936 wrote to memory of 2804 2936 rundll32.exe rundll32.exe PID 2936 wrote to memory of 2804 2936 rundll32.exe rundll32.exe PID 2936 wrote to memory of 2804 2936 rundll32.exe rundll32.exe PID 2936 wrote to memory of 2804 2936 rundll32.exe rundll32.exe PID 2936 wrote to memory of 2804 2936 rundll32.exe rundll32.exe PID 2936 wrote to memory of 2804 2936 rundll32.exe rundll32.exe PID 2936 wrote to memory of 2804 2936 rundll32.exe rundll32.exe PID 2804 wrote to memory of 2732 2804 rundll32.exe mssecsvc.exe PID 2804 wrote to memory of 2732 2804 rundll32.exe mssecsvc.exe PID 2804 wrote to memory of 2732 2804 rundll32.exe mssecsvc.exe PID 2804 wrote to memory of 2732 2804 rundll32.exe mssecsvc.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9d81c50361a2ef2b18c754eb9625143c_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9d81c50361a2ef2b18c754eb9625143c_JaffaCakes118.dll,#12⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2732 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i4⤵
- Executes dropped EXE
PID:2480
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2636
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.6MB
MD5b24d91e4565a2469b307629197b79e6e
SHA16ebef10c62603e6f483dd1c0a285e8e5ac0c35a3
SHA2566f8af7b2bb8f09f33b793e6106e68f0c26707cb8cb79f42e6bbba3bf50868f41
SHA5120f97b254c68ec9ce46af48dcd3a48b8c07494cacab759ee006cccff52a711998ec26d0a3cb9b4102c220b599dbe1d79ad5a3226806ded25b9940d0277b3e6cfa
-
Filesize
3.4MB
MD5924f4b9cd7172359495f38f678f4a2a9
SHA1d1c18d2c67c08c2ace72d62454b1df97e064d813
SHA256e99bc8bf46e522afff858ec0ade4310b14bf8874a984953510e1455976ec0d3a
SHA512dfcf914772645210e03347f3b04aaffc09c9af345420e6d1038572b4ee062c17a8b054daaf416e2b92dfa5c0b9a599ced967d291a2a8b243cdd13c2e7b2dc681