Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
14-06-2024 08:59
Static task
static1
Behavioral task
behavioral1
Sample
a8d8ae8af46f4ca16d70538fe9327158_JaffaCakes118.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a8d8ae8af46f4ca16d70538fe9327158_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
a8d8ae8af46f4ca16d70538fe9327158_JaffaCakes118.dll
-
Size
5.0MB
-
MD5
a8d8ae8af46f4ca16d70538fe9327158
-
SHA1
d936c731010229b3559937c79240729d0d8d871c
-
SHA256
9bb4defe23e0d9780f6109b2f762f59529d0dbee93ba1a82f7174883e7e7638e
-
SHA512
b2d3d9988648e5eb1e25f50abde320d51330ea4130b2469e4816e2893aa0f1eb444deedec98d1586e0a4d421652e6cac8c41c7fe5c41a39f48908ceda1a9a5ed
-
SSDEEP
98304:dDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2H:dDqPe1Cxcxk3ZAEUadzR8yc4H
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (2686) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 3 IoCs
Processes:
mssecsvc.exemssecsvc.exetasksche.exepid process 2712 mssecsvc.exe 2124 mssecsvc.exe 1772 tasksche.exe -
Drops file in Windows directory 2 IoCs
Processes:
rundll32.exemssecsvc.exedescription ioc process File created C:\WINDOWS\mssecsvc.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvc.exe -
Modifies data under HKEY_USERS 5 IoCs
Processes:
mssecsvc.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" mssecsvc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 4440 wrote to memory of 1328 4440 rundll32.exe rundll32.exe PID 4440 wrote to memory of 1328 4440 rundll32.exe rundll32.exe PID 4440 wrote to memory of 1328 4440 rundll32.exe rundll32.exe PID 1328 wrote to memory of 2712 1328 rundll32.exe mssecsvc.exe PID 1328 wrote to memory of 2712 1328 rundll32.exe mssecsvc.exe PID 1328 wrote to memory of 2712 1328 rundll32.exe mssecsvc.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a8d8ae8af46f4ca16d70538fe9327158_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a8d8ae8af46f4ca16d70538fe9327158_JaffaCakes118.dll,#12⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2712 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i4⤵
- Executes dropped EXE
PID:1772
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:2124
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.6MB
MD59326507318ea3ee1151e4fdfa06b2a7f
SHA1f4c5ae7070f77e716e761d7ebd225b9b623f025c
SHA256096c86979dd79f855903eedad8c54b8657d685e3a7d60abb5b11064c5d546156
SHA51207747c6791b7ecf161fa07776f316b27a5aa843684ce32cd4afbc7a490689264236fbcf2dd9791a937aa972ff315a24ab13f46cbbc58932d717b9e8fdebfc0fb
-
Filesize
3.4MB
MD57f7ccaa16fb15eb1c7399d422f8363e8
SHA1bd44d0ab543bf814d93b719c24e90d8dd7111234
SHA2562584e1521065e45ec3c17767c065429038fc6291c091097ea8b22c8a502c41dd
SHA51283e334b80de08903cfa9891a3fa349c1ece7e19f8e62b74a017512fa9a7989a0fd31929bf1fc13847bee04f2da3dacf6bc3f5ee58f0e4b9d495f4b9af12ed2b7