Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
12-06-2024 15:09
Static task
static1
Behavioral task
behavioral1
Sample
a119f909f723d75e958d1a8b4b7c7772_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a119f909f723d75e958d1a8b4b7c7772_JaffaCakes118.dll
Resource
win10v2004-20240226-en
General
-
Target
a119f909f723d75e958d1a8b4b7c7772_JaffaCakes118.dll
-
Size
5.0MB
-
MD5
a119f909f723d75e958d1a8b4b7c7772
-
SHA1
b9fa1802da17688666df58a5ac6b38e49603c19c
-
SHA256
412d4635deca5e3f92f67f9e870d37c6ba3425f4dc5234b08d2abf84d2267f25
-
SHA512
71fdb25be9ad09ce09ebdce9f1ba9920083f69aaf7f6001d1384d2f8ff4bd6126fefcccf9aa2c5200b4d43c6e14dc1828e2be00d49a1e09bdb6fde5b8785276a
-
SSDEEP
49152:lnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM:pDqPoBhz1aRxcSUDk36SAEdhvxW
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (3231) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 2 IoCs
Processes:
mssecsvc.exemssecsvc.exepid process 2284 mssecsvc.exe 2592 mssecsvc.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in System32 directory 1 IoCs
Processes:
mssecsvc.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvc.exe -
Drops file in Windows directory 2 IoCs
Processes:
rundll32.exemssecsvc.exedescription ioc process File created C:\WINDOWS\mssecsvc.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvc.exe -
Modifies data under HKEY_USERS 24 IoCs
Processes:
mssecsvc.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0107000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{39FFD7B2-9DA2-4408-9725-386077F80865}\WpadNetworkName = "Network 3" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\12-e8-0c-d8-7f-16 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\12-e8-0c-d8-7f-16\WpadDecisionReason = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\12-e8-0c-d8-7f-16\WpadDecision = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{39FFD7B2-9DA2-4408-9725-386077F80865}\WpadDecisionReason = "1" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{39FFD7B2-9DA2-4408-9725-386077F80865}\WpadDecisionTime = d0a51781dabcda01 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{39FFD7B2-9DA2-4408-9725-386077F80865}\12-e8-0c-d8-7f-16 mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{39FFD7B2-9DA2-4408-9725-386077F80865} mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\12-e8-0c-d8-7f-16\WpadDecisionTime = d0a51781dabcda01 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{39FFD7B2-9DA2-4408-9725-386077F80865}\WpadDecision = "0" mssecsvc.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
mssecsvc.exemssecsvc.exepid process 2284 mssecsvc.exe 2592 mssecsvc.exe -
Suspicious behavior: MapViewOfSection 43 IoCs
Processes:
mssecsvc.exemssecsvc.exepid process 2284 mssecsvc.exe 2284 mssecsvc.exe 2284 mssecsvc.exe 2284 mssecsvc.exe 2284 mssecsvc.exe 2284 mssecsvc.exe 2284 mssecsvc.exe 2284 mssecsvc.exe 2284 mssecsvc.exe 2284 mssecsvc.exe 2284 mssecsvc.exe 2284 mssecsvc.exe 2284 mssecsvc.exe 2284 mssecsvc.exe 2284 mssecsvc.exe 2284 mssecsvc.exe 2284 mssecsvc.exe 2284 mssecsvc.exe 2284 mssecsvc.exe 2284 mssecsvc.exe 2284 mssecsvc.exe 2592 mssecsvc.exe 2592 mssecsvc.exe 2592 mssecsvc.exe 2592 mssecsvc.exe 2592 mssecsvc.exe 2592 mssecsvc.exe 2592 mssecsvc.exe 2592 mssecsvc.exe 2592 mssecsvc.exe 2592 mssecsvc.exe 2592 mssecsvc.exe 2592 mssecsvc.exe 2592 mssecsvc.exe 2592 mssecsvc.exe 2592 mssecsvc.exe 2592 mssecsvc.exe 2592 mssecsvc.exe 2592 mssecsvc.exe 2592 mssecsvc.exe 2592 mssecsvc.exe 2592 mssecsvc.exe 2592 mssecsvc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
mssecsvc.exemssecsvc.exedescription pid process Token: SeDebugPrivilege 2284 mssecsvc.exe Token: SeDebugPrivilege 2592 mssecsvc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
rundll32.exerundll32.exemssecsvc.exedescription pid process target process PID 2868 wrote to memory of 2984 2868 rundll32.exe rundll32.exe PID 2868 wrote to memory of 2984 2868 rundll32.exe rundll32.exe PID 2868 wrote to memory of 2984 2868 rundll32.exe rundll32.exe PID 2868 wrote to memory of 2984 2868 rundll32.exe rundll32.exe PID 2868 wrote to memory of 2984 2868 rundll32.exe rundll32.exe PID 2868 wrote to memory of 2984 2868 rundll32.exe rundll32.exe PID 2868 wrote to memory of 2984 2868 rundll32.exe rundll32.exe PID 2984 wrote to memory of 2284 2984 rundll32.exe mssecsvc.exe PID 2984 wrote to memory of 2284 2984 rundll32.exe mssecsvc.exe PID 2984 wrote to memory of 2284 2984 rundll32.exe mssecsvc.exe PID 2984 wrote to memory of 2284 2984 rundll32.exe mssecsvc.exe PID 2284 wrote to memory of 384 2284 mssecsvc.exe wininit.exe PID 2284 wrote to memory of 384 2284 mssecsvc.exe wininit.exe PID 2284 wrote to memory of 384 2284 mssecsvc.exe wininit.exe PID 2284 wrote to memory of 384 2284 mssecsvc.exe wininit.exe PID 2284 wrote to memory of 384 2284 mssecsvc.exe wininit.exe PID 2284 wrote to memory of 384 2284 mssecsvc.exe wininit.exe PID 2284 wrote to memory of 384 2284 mssecsvc.exe wininit.exe PID 2284 wrote to memory of 396 2284 mssecsvc.exe csrss.exe PID 2284 wrote to memory of 396 2284 mssecsvc.exe csrss.exe PID 2284 wrote to memory of 396 2284 mssecsvc.exe csrss.exe PID 2284 wrote to memory of 396 2284 mssecsvc.exe csrss.exe PID 2284 wrote to memory of 396 2284 mssecsvc.exe csrss.exe PID 2284 wrote to memory of 396 2284 mssecsvc.exe csrss.exe PID 2284 wrote to memory of 396 2284 mssecsvc.exe csrss.exe PID 2284 wrote to memory of 436 2284 mssecsvc.exe winlogon.exe PID 2284 wrote to memory of 436 2284 mssecsvc.exe winlogon.exe PID 2284 wrote to memory of 436 2284 mssecsvc.exe winlogon.exe PID 2284 wrote to memory of 436 2284 mssecsvc.exe winlogon.exe PID 2284 wrote to memory of 436 2284 mssecsvc.exe winlogon.exe PID 2284 wrote to memory of 436 2284 mssecsvc.exe winlogon.exe PID 2284 wrote to memory of 436 2284 mssecsvc.exe winlogon.exe PID 2284 wrote to memory of 480 2284 mssecsvc.exe services.exe PID 2284 wrote to memory of 480 2284 mssecsvc.exe services.exe PID 2284 wrote to memory of 480 2284 mssecsvc.exe services.exe PID 2284 wrote to memory of 480 2284 mssecsvc.exe services.exe PID 2284 wrote to memory of 480 2284 mssecsvc.exe services.exe PID 2284 wrote to memory of 480 2284 mssecsvc.exe services.exe PID 2284 wrote to memory of 480 2284 mssecsvc.exe services.exe PID 2284 wrote to memory of 496 2284 mssecsvc.exe lsass.exe PID 2284 wrote to memory of 496 2284 mssecsvc.exe lsass.exe PID 2284 wrote to memory of 496 2284 mssecsvc.exe lsass.exe PID 2284 wrote to memory of 496 2284 mssecsvc.exe lsass.exe PID 2284 wrote to memory of 496 2284 mssecsvc.exe lsass.exe PID 2284 wrote to memory of 496 2284 mssecsvc.exe lsass.exe PID 2284 wrote to memory of 496 2284 mssecsvc.exe lsass.exe PID 2284 wrote to memory of 504 2284 mssecsvc.exe lsm.exe PID 2284 wrote to memory of 504 2284 mssecsvc.exe lsm.exe PID 2284 wrote to memory of 504 2284 mssecsvc.exe lsm.exe PID 2284 wrote to memory of 504 2284 mssecsvc.exe lsm.exe PID 2284 wrote to memory of 504 2284 mssecsvc.exe lsm.exe PID 2284 wrote to memory of 504 2284 mssecsvc.exe lsm.exe PID 2284 wrote to memory of 504 2284 mssecsvc.exe lsm.exe PID 2284 wrote to memory of 596 2284 mssecsvc.exe svchost.exe PID 2284 wrote to memory of 596 2284 mssecsvc.exe svchost.exe PID 2284 wrote to memory of 596 2284 mssecsvc.exe svchost.exe PID 2284 wrote to memory of 596 2284 mssecsvc.exe svchost.exe PID 2284 wrote to memory of 596 2284 mssecsvc.exe svchost.exe PID 2284 wrote to memory of 596 2284 mssecsvc.exe svchost.exe PID 2284 wrote to memory of 596 2284 mssecsvc.exe svchost.exe PID 2284 wrote to memory of 676 2284 mssecsvc.exe svchost.exe PID 2284 wrote to memory of 676 2284 mssecsvc.exe svchost.exe PID 2284 wrote to memory of 676 2284 mssecsvc.exe svchost.exe PID 2284 wrote to memory of 676 2284 mssecsvc.exe svchost.exe
Processes
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:384
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵PID:480
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵PID:596
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵PID:340
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵PID:676
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵PID:764
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵PID:812
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵PID:1120
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵PID:860
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵PID:964
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵PID:284
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵PID:352
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵PID:1068
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵PID:1140
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵PID:3036
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵PID:2096
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2592 -
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵PID:496
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:504
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:396
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:436
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1180
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a119f909f723d75e958d1a8b4b7c7772_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a119f909f723d75e958d1a8b4b7c7772_JaffaCakes118.dll,#13⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe4⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2284
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.6MB
MD543f0ce1ccbaa0e7afeea08ab49b2e930
SHA121e0b779cc7f6f2836d7347e7ec48d63be15ecba
SHA256bc9518b04513010de1c13e8956b737cb0aa3e4ce5c6d6da637c18ea0257336d7
SHA51227bde3b24d4898ad7910db8120fdfb4018dfef5587f876f876a5c91e844f25458680741d2a5f8b749bbe95ef0a59b3141fc91c0ad499b0d33e673c1ff257267d