Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11-06-2024 08:40
Static task
static1
Behavioral task
behavioral1
Sample
9d9585c4a7fcdaa359f5c9524ed79e10_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9d9585c4a7fcdaa359f5c9524ed79e10_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
9d9585c4a7fcdaa359f5c9524ed79e10_JaffaCakes118.dll
-
Size
5.0MB
-
MD5
9d9585c4a7fcdaa359f5c9524ed79e10
-
SHA1
c924f26d718df11d193555a7a148f61ef49b4acf
-
SHA256
ad4883a754743db81809cc13dd42a5e0e4e3732ef0f9f250aa8f8db84ad3adec
-
SHA512
59ad376962bc5d640b71e4f0cde71ac0dbc018306ffd752262c50d69de3da9e6ae225e55186aa1078836eebedc3fc171a991223d2ab65caf873e8f2a324b87ca
-
SSDEEP
49152:SnAQqMSPbcBVHS6SAAjEau3R8yAH1plAH:+DqPoBxS6SA53R8yAVp2H
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (3256) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 3 IoCs
Processes:
mssecsvc.exemssecsvc.exetasksche.exepid process 832 mssecsvc.exe 2944 mssecsvc.exe 2568 tasksche.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in System32 directory 1 IoCs
Processes:
mssecsvc.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvc.exe -
Drops file in Windows directory 2 IoCs
Processes:
rundll32.exemssecsvc.exedescription ioc process File created C:\WINDOWS\mssecsvc.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvc.exe -
Modifies data under HKEY_USERS 24 IoCs
Processes:
mssecsvc.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7B274256-EC98-4E65-A3E0-0501880B15E6} mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7B274256-EC98-4E65-A3E0-0501880B15E6}\WpadDecisionTime = 60a9f307dbbbda01 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7B274256-EC98-4E65-A3E0-0501880B15E6}\WpadDecision = "0" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7B274256-EC98-4E65-A3E0-0501880B15E6}\WpadNetworkName = "Network 3" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-7f-59-f5-bc-6f\WpadDecision = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-7f-59-f5-bc-6f mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7B274256-EC98-4E65-A3E0-0501880B15E6}\52-7f-59-f5-bc-6f mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-7f-59-f5-bc-6f\WpadDecisionTime = 60a9f307dbbbda01 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00ef000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7B274256-EC98-4E65-A3E0-0501880B15E6}\WpadDecisionReason = "1" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-7f-59-f5-bc-6f\WpadDecisionReason = "1" mssecsvc.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 3028 wrote to memory of 2320 3028 rundll32.exe rundll32.exe PID 3028 wrote to memory of 2320 3028 rundll32.exe rundll32.exe PID 3028 wrote to memory of 2320 3028 rundll32.exe rundll32.exe PID 3028 wrote to memory of 2320 3028 rundll32.exe rundll32.exe PID 3028 wrote to memory of 2320 3028 rundll32.exe rundll32.exe PID 3028 wrote to memory of 2320 3028 rundll32.exe rundll32.exe PID 3028 wrote to memory of 2320 3028 rundll32.exe rundll32.exe PID 2320 wrote to memory of 832 2320 rundll32.exe mssecsvc.exe PID 2320 wrote to memory of 832 2320 rundll32.exe mssecsvc.exe PID 2320 wrote to memory of 832 2320 rundll32.exe mssecsvc.exe PID 2320 wrote to memory of 832 2320 rundll32.exe mssecsvc.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9d9585c4a7fcdaa359f5c9524ed79e10_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9d9585c4a7fcdaa359f5c9524ed79e10_JaffaCakes118.dll,#12⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:832 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i4⤵
- Executes dropped EXE
PID:2568
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2944
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.6MB
MD52cfc8a3adc98b3395b7abc64d0cb3d41
SHA13d3721efdc7c8df3639c8b2af0a8204dd854dee0
SHA2563052e5388792de337a2102b79fe31254007e005a63e7bf1179a5296bca9d5c44
SHA512df9c6d68ba515ecbfb63a827080de716f99335f75791b0ae3150633865c466501f34c6fbd1819cc7fb9aabc6869eb35e5ccc5cd365e4e2d1fa41c9b092845724
-
Filesize
3.4MB
MD53894c0959aef497a8ee3b46fa80ee66e
SHA1c2ce2523300b1516da89012ef079b8e8cb922f39
SHA256ba10e3e9f7a449bd6cf4089b9724007fc5d83c7a6516a7bf879e9a4a25564f93
SHA5127816f5d54febcbfec4de4e4ecab8ef01288a6ccf3fe1d0a118118e7d30b12cbbd1dd80b5703531ebbd3716767866301050439e937a5321782d131fd243d342a5