Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
15-06-2024 14:00
Static task
static1
Behavioral task
behavioral1
Sample
aec2d49eb06a8dd0df471b15fbab97e0_JaffaCakes118.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
aec2d49eb06a8dd0df471b15fbab97e0_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
aec2d49eb06a8dd0df471b15fbab97e0_JaffaCakes118.dll
-
Size
5.0MB
-
MD5
aec2d49eb06a8dd0df471b15fbab97e0
-
SHA1
e846344e2455023cca62c449a8f9ab682ad156f2
-
SHA256
fce1a25fa617d0367944a2c8e9b5b9c359c12ae12f0a00694086a48a05476707
-
SHA512
d52e7d2b3f72f26406f8860b03c9cf45e5ad5f36778227f9f63bab11b0510773184c596161cd8f0b8697a618b73991aee88ecd6fadb20ba8da4f64a8b9616043
-
SSDEEP
49152:4nAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAAZ0vZ6GIk:oDqPoBhz1aRxcSUDk36SAc0B6GIk
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (3261) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 2 IoCs
Processes:
mssecsvc.exemssecsvc.exepid process 2208 mssecsvc.exe 2812 mssecsvc.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in System32 directory 1 IoCs
Processes:
mssecsvc.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvc.exe -
Drops file in Windows directory 2 IoCs
Processes:
rundll32.exemssecsvc.exedescription ioc process File created C:\WINDOWS\mssecsvc.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvc.exe -
Modifies data under HKEY_USERS 24 IoCs
Processes:
mssecsvc.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f017c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{127D41F4-8ED5-49D8-87E8-4A16086AD70F}\WpadNetworkName = "Network 3" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b6-98-87-75-04-e4\WpadDecisionReason = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b6-98-87-75-04-e4\WpadDecision = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{127D41F4-8ED5-49D8-87E8-4A16086AD70F}\WpadDecisionReason = "1" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{127D41F4-8ED5-49D8-87E8-4A16086AD70F} mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{127D41F4-8ED5-49D8-87E8-4A16086AD70F}\b6-98-87-75-04-e4 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{127D41F4-8ED5-49D8-87E8-4A16086AD70F}\WpadDecisionTime = 7020f05c2cbfda01 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{127D41F4-8ED5-49D8-87E8-4A16086AD70F}\WpadDecision = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b6-98-87-75-04-e4 mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b6-98-87-75-04-e4\WpadDecisionTime = 7020f05c2cbfda01 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mssecsvc.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
mssecsvc.exemssecsvc.exepid process 2208 mssecsvc.exe 2812 mssecsvc.exe -
Suspicious behavior: MapViewOfSection 43 IoCs
Processes:
mssecsvc.exemssecsvc.exepid process 2208 mssecsvc.exe 2208 mssecsvc.exe 2208 mssecsvc.exe 2208 mssecsvc.exe 2208 mssecsvc.exe 2208 mssecsvc.exe 2208 mssecsvc.exe 2208 mssecsvc.exe 2208 mssecsvc.exe 2208 mssecsvc.exe 2208 mssecsvc.exe 2208 mssecsvc.exe 2208 mssecsvc.exe 2208 mssecsvc.exe 2208 mssecsvc.exe 2208 mssecsvc.exe 2208 mssecsvc.exe 2208 mssecsvc.exe 2208 mssecsvc.exe 2208 mssecsvc.exe 2208 mssecsvc.exe 2812 mssecsvc.exe 2812 mssecsvc.exe 2812 mssecsvc.exe 2812 mssecsvc.exe 2812 mssecsvc.exe 2812 mssecsvc.exe 2812 mssecsvc.exe 2812 mssecsvc.exe 2812 mssecsvc.exe 2812 mssecsvc.exe 2812 mssecsvc.exe 2812 mssecsvc.exe 2812 mssecsvc.exe 2812 mssecsvc.exe 2812 mssecsvc.exe 2812 mssecsvc.exe 2812 mssecsvc.exe 2812 mssecsvc.exe 2812 mssecsvc.exe 2812 mssecsvc.exe 2812 mssecsvc.exe 2812 mssecsvc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
mssecsvc.exemssecsvc.exedescription pid process Token: SeDebugPrivilege 2208 mssecsvc.exe Token: SeDebugPrivilege 2812 mssecsvc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
rundll32.exerundll32.exemssecsvc.exedescription pid process target process PID 2108 wrote to memory of 2396 2108 rundll32.exe rundll32.exe PID 2108 wrote to memory of 2396 2108 rundll32.exe rundll32.exe PID 2108 wrote to memory of 2396 2108 rundll32.exe rundll32.exe PID 2108 wrote to memory of 2396 2108 rundll32.exe rundll32.exe PID 2108 wrote to memory of 2396 2108 rundll32.exe rundll32.exe PID 2108 wrote to memory of 2396 2108 rundll32.exe rundll32.exe PID 2108 wrote to memory of 2396 2108 rundll32.exe rundll32.exe PID 2396 wrote to memory of 2208 2396 rundll32.exe mssecsvc.exe PID 2396 wrote to memory of 2208 2396 rundll32.exe mssecsvc.exe PID 2396 wrote to memory of 2208 2396 rundll32.exe mssecsvc.exe PID 2396 wrote to memory of 2208 2396 rundll32.exe mssecsvc.exe PID 2208 wrote to memory of 384 2208 mssecsvc.exe wininit.exe PID 2208 wrote to memory of 384 2208 mssecsvc.exe wininit.exe PID 2208 wrote to memory of 384 2208 mssecsvc.exe wininit.exe PID 2208 wrote to memory of 384 2208 mssecsvc.exe wininit.exe PID 2208 wrote to memory of 384 2208 mssecsvc.exe wininit.exe PID 2208 wrote to memory of 384 2208 mssecsvc.exe wininit.exe PID 2208 wrote to memory of 384 2208 mssecsvc.exe wininit.exe PID 2208 wrote to memory of 396 2208 mssecsvc.exe csrss.exe PID 2208 wrote to memory of 396 2208 mssecsvc.exe csrss.exe PID 2208 wrote to memory of 396 2208 mssecsvc.exe csrss.exe PID 2208 wrote to memory of 396 2208 mssecsvc.exe csrss.exe PID 2208 wrote to memory of 396 2208 mssecsvc.exe csrss.exe PID 2208 wrote to memory of 396 2208 mssecsvc.exe csrss.exe PID 2208 wrote to memory of 396 2208 mssecsvc.exe csrss.exe PID 2208 wrote to memory of 432 2208 mssecsvc.exe winlogon.exe PID 2208 wrote to memory of 432 2208 mssecsvc.exe winlogon.exe PID 2208 wrote to memory of 432 2208 mssecsvc.exe winlogon.exe PID 2208 wrote to memory of 432 2208 mssecsvc.exe winlogon.exe PID 2208 wrote to memory of 432 2208 mssecsvc.exe winlogon.exe PID 2208 wrote to memory of 432 2208 mssecsvc.exe winlogon.exe PID 2208 wrote to memory of 432 2208 mssecsvc.exe winlogon.exe PID 2208 wrote to memory of 476 2208 mssecsvc.exe services.exe PID 2208 wrote to memory of 476 2208 mssecsvc.exe services.exe PID 2208 wrote to memory of 476 2208 mssecsvc.exe services.exe PID 2208 wrote to memory of 476 2208 mssecsvc.exe services.exe PID 2208 wrote to memory of 476 2208 mssecsvc.exe services.exe PID 2208 wrote to memory of 476 2208 mssecsvc.exe services.exe PID 2208 wrote to memory of 476 2208 mssecsvc.exe services.exe PID 2208 wrote to memory of 492 2208 mssecsvc.exe lsass.exe PID 2208 wrote to memory of 492 2208 mssecsvc.exe lsass.exe PID 2208 wrote to memory of 492 2208 mssecsvc.exe lsass.exe PID 2208 wrote to memory of 492 2208 mssecsvc.exe lsass.exe PID 2208 wrote to memory of 492 2208 mssecsvc.exe lsass.exe PID 2208 wrote to memory of 492 2208 mssecsvc.exe lsass.exe PID 2208 wrote to memory of 492 2208 mssecsvc.exe lsass.exe PID 2208 wrote to memory of 500 2208 mssecsvc.exe lsm.exe PID 2208 wrote to memory of 500 2208 mssecsvc.exe lsm.exe PID 2208 wrote to memory of 500 2208 mssecsvc.exe lsm.exe PID 2208 wrote to memory of 500 2208 mssecsvc.exe lsm.exe PID 2208 wrote to memory of 500 2208 mssecsvc.exe lsm.exe PID 2208 wrote to memory of 500 2208 mssecsvc.exe lsm.exe PID 2208 wrote to memory of 500 2208 mssecsvc.exe lsm.exe PID 2208 wrote to memory of 592 2208 mssecsvc.exe svchost.exe PID 2208 wrote to memory of 592 2208 mssecsvc.exe svchost.exe PID 2208 wrote to memory of 592 2208 mssecsvc.exe svchost.exe PID 2208 wrote to memory of 592 2208 mssecsvc.exe svchost.exe PID 2208 wrote to memory of 592 2208 mssecsvc.exe svchost.exe PID 2208 wrote to memory of 592 2208 mssecsvc.exe svchost.exe PID 2208 wrote to memory of 592 2208 mssecsvc.exe svchost.exe PID 2208 wrote to memory of 672 2208 mssecsvc.exe svchost.exe PID 2208 wrote to memory of 672 2208 mssecsvc.exe svchost.exe PID 2208 wrote to memory of 672 2208 mssecsvc.exe svchost.exe PID 2208 wrote to memory of 672 2208 mssecsvc.exe svchost.exe
Processes
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:384
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵PID:476
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵PID:592
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵PID:1080
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵PID:672
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵PID:736
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵PID:808
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵PID:1164
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵PID:848
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵PID:980
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵PID:268
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵PID:324
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵PID:1008
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵PID:1116
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵PID:2436
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵PID:2964
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2812 -
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵PID:492
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:500
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:396
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:432
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1224
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\aec2d49eb06a8dd0df471b15fbab97e0_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\aec2d49eb06a8dd0df471b15fbab97e0_JaffaCakes118.dll,#13⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe4⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2208
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.6MB
MD56d3372dd43153473617ab7c373c44920
SHA1fc35e58c8cd08611a2c71723af32e0ec55eaddad
SHA256b9df76897340af196874f7ec7e43592909c82046068bc84bf76bd3cad2c2f602
SHA512ae3687c50f3ce1d581f40ac3bc8ac8597284dd2630bc030d83183561d5a224417d07247b6995699c8584372e254ab99ecb6652205b4216518fa90ca2201c74ff