Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
15-06-2024 00:02
Static task
static1
Behavioral task
behavioral1
Sample
ac23310d6d7ec72dc84de280e09f3a22_JaffaCakes118.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
ac23310d6d7ec72dc84de280e09f3a22_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
ac23310d6d7ec72dc84de280e09f3a22_JaffaCakes118.dll
-
Size
5.0MB
-
MD5
ac23310d6d7ec72dc84de280e09f3a22
-
SHA1
22cce1bbd3d23979de07d2d4b894eecb666536cf
-
SHA256
ef81a0b0ec5572f1094c8a64e02d552d3a1cd1cf68ed41743d4f6d16aedb539c
-
SHA512
f2aa64320ea083b4bfb260f282dd19c9d5e050381043a8e3e94544b70b0266b5787777ed7b6ed5e503b5719c057f792744ddcc1b5d2b18d3e5df60c1f2b6ae16
-
SSDEEP
24576:zbLgddQhfdmMSirYbcMNgef0QeQ56LLuYAMEcpcL7nEaut/8uN:znAQqMSPbcBVQe1AMEcaEau3
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (3213) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 3 IoCs
Processes:
mssecsvc.exemssecsvc.exetasksche.exepid process 2652 mssecsvc.exe 2724 mssecsvc.exe 2580 tasksche.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in System32 directory 1 IoCs
Processes:
mssecsvc.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvc.exe -
Drops file in Windows directory 2 IoCs
Processes:
mssecsvc.exerundll32.exedescription ioc process File created C:\WINDOWS\tasksche.exe mssecsvc.exe File created C:\WINDOWS\mssecsvc.exe rundll32.exe -
Modifies data under HKEY_USERS 24 IoCs
Processes:
mssecsvc.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{57E56792-F0D7-4860-A3A9-3E90F5E6A37F}\WpadDecisionTime = 60163962b7beda01 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{57E56792-F0D7-4860-A3A9-3E90F5E6A37F}\WpadDecision = "0" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{57E56792-F0D7-4860-A3A9-3E90F5E6A37F}\WpadNetworkName = "Network 3" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-e8-30-6b-d2-37\WpadDecision = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{57E56792-F0D7-4860-A3A9-3E90F5E6A37F} mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{57E56792-F0D7-4860-A3A9-3E90F5E6A37F}\WpadDecisionReason = "1" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-e8-30-6b-d2-37 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-e8-30-6b-d2-37\WpadDecisionReason = "1" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f005d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{57E56792-F0D7-4860-A3A9-3E90F5E6A37F}\fe-e8-30-6b-d2-37 mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-e8-30-6b-d2-37\WpadDecisionTime = 60163962b7beda01 mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mssecsvc.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 2924 wrote to memory of 2004 2924 rundll32.exe rundll32.exe PID 2924 wrote to memory of 2004 2924 rundll32.exe rundll32.exe PID 2924 wrote to memory of 2004 2924 rundll32.exe rundll32.exe PID 2924 wrote to memory of 2004 2924 rundll32.exe rundll32.exe PID 2924 wrote to memory of 2004 2924 rundll32.exe rundll32.exe PID 2924 wrote to memory of 2004 2924 rundll32.exe rundll32.exe PID 2924 wrote to memory of 2004 2924 rundll32.exe rundll32.exe PID 2004 wrote to memory of 2652 2004 rundll32.exe mssecsvc.exe PID 2004 wrote to memory of 2652 2004 rundll32.exe mssecsvc.exe PID 2004 wrote to memory of 2652 2004 rundll32.exe mssecsvc.exe PID 2004 wrote to memory of 2652 2004 rundll32.exe mssecsvc.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac23310d6d7ec72dc84de280e09f3a22_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac23310d6d7ec72dc84de280e09f3a22_JaffaCakes118.dll,#12⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2652 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i4⤵
- Executes dropped EXE
PID:2580
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2724
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.6MB
MD52bb2b6e91bb173eb2b2b9c5853d7a555
SHA119a092b2606d18052fca01357ef887bec8c5cfa9
SHA256639da161f3af3013153a5ed74788c23126b6ee4e13ccf64f0c046f2f5817856c
SHA51255335cbbdef874b56fe5791c5d8638264239a0ce2bb6d19dec2998bcaa76e0f145424d81d5171581c704f0026a68244d15d2d9d352f32e9613dc416ebc0e5fae
-
Filesize
3.4MB
MD5cfa00c14186099176e1aeae3c4d8492d
SHA15cbdf2a6057d0508705a1d0a1ffd356516f5ae1b
SHA256c2dd07e89d92b8c57c37fdce051391823063650a7b30e8d398035b227d3ef951
SHA51215fd60705b6673570d063bd84995f23cee9f4183b94d59cd7a2043294177f0d0dfd4fff10666a1bb735120d32d806e8d301c937386b36ed21bc3a0e1bf398848