Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
15-06-2024 18:00
Static task
static1
Behavioral task
behavioral1
Sample
afaf3d6d673507d9c37030e8066debf2_JaffaCakes118.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
afaf3d6d673507d9c37030e8066debf2_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
afaf3d6d673507d9c37030e8066debf2_JaffaCakes118.dll
-
Size
5.0MB
-
MD5
afaf3d6d673507d9c37030e8066debf2
-
SHA1
eea9cb74f65da131c725ae4c1b8f1a6c22550e21
-
SHA256
c793de1761c905483f8aa252272be234167f427761bf5963d62c3079abd07fbb
-
SHA512
4bfa4cfdc34d141a381c32305d57336728ed858356bed4e58cd894eb4d386760611e5786e7856eae8dedc90bb707ea5b10b0e091af3505f6826baa7e87ff8820
-
SSDEEP
49152:znAQqMSPbcBVqxJM0HDOMEc4Wg2sgJdVz:TDqPoB8xWaDfqWgU
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (2663) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 3 IoCs
Processes:
mssecsvc.exemssecsvc.exetasksche.exepid process 1736 mssecsvc.exe 2588 mssecsvc.exe 2708 tasksche.exe -
Drops file in System32 directory 1 IoCs
Processes:
mssecsvc.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvc.exe -
Drops file in Windows directory 2 IoCs
Processes:
rundll32.exemssecsvc.exedescription ioc process File created C:\WINDOWS\mssecsvc.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvc.exe -
Modifies data under HKEY_USERS 24 IoCs
Processes:
mssecsvc.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{94A96D3C-8A18-4E4F-AE37-BE10AB0188D8}\WpadDecisionTime = 20393eed4dbfda01 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9e-de-bd-51-da-23 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{94A96D3C-8A18-4E4F-AE37-BE10AB0188D8} mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{94A96D3C-8A18-4E4F-AE37-BE10AB0188D8}\WpadDecisionReason = "1" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{94A96D3C-8A18-4E4F-AE37-BE10AB0188D8}\WpadNetworkName = "Network 3" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{94A96D3C-8A18-4E4F-AE37-BE10AB0188D8}\9e-de-bd-51-da-23 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9e-de-bd-51-da-23\WpadDecisionReason = "1" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9e-de-bd-51-da-23\WpadDecisionTime = 20393eed4dbfda01 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0035000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{94A96D3C-8A18-4E4F-AE37-BE10AB0188D8}\WpadDecision = "0" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9e-de-bd-51-da-23\WpadDecision = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvc.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1488 wrote to memory of 1252 1488 rundll32.exe rundll32.exe PID 1488 wrote to memory of 1252 1488 rundll32.exe rundll32.exe PID 1488 wrote to memory of 1252 1488 rundll32.exe rundll32.exe PID 1488 wrote to memory of 1252 1488 rundll32.exe rundll32.exe PID 1488 wrote to memory of 1252 1488 rundll32.exe rundll32.exe PID 1488 wrote to memory of 1252 1488 rundll32.exe rundll32.exe PID 1488 wrote to memory of 1252 1488 rundll32.exe rundll32.exe PID 1252 wrote to memory of 1736 1252 rundll32.exe mssecsvc.exe PID 1252 wrote to memory of 1736 1252 rundll32.exe mssecsvc.exe PID 1252 wrote to memory of 1736 1252 rundll32.exe mssecsvc.exe PID 1252 wrote to memory of 1736 1252 rundll32.exe mssecsvc.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\afaf3d6d673507d9c37030e8066debf2_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\afaf3d6d673507d9c37030e8066debf2_JaffaCakes118.dll,#12⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1736 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i4⤵
- Executes dropped EXE
PID:2708
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2588
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.6MB
MD5252590280a7d839e9e4bda3a9b779cea
SHA1cd92560a5cc513c049371298501f3b1798462681
SHA25661066a77f8378be2fd75a003b592a643e1a6cb4779f49153939033b0da4adb5a
SHA512e8bfd3061fb4c61fd9998071482b331a0fc87a1c26b59e03d9b9790e7d5442d2979c65df49cddb558205d2b413dfa933eed342a744dc1158756c64ec2bd74645
-
Filesize
3.4MB
MD5d3f3c469ee3d3311dc1ee49be3372624
SHA18b035c9e37a9325459d449d005f52a78220d6285
SHA2567307345905917a1a2fc81e8c5aa0e47b63e7a1d13ab1840d7ee2fe18a24b253d
SHA512913e5a0f2ad853c43a112c5786428b17ec76421b46e39506336d2095ce474ffdf4090668788c69a118011ac93b39baa1ba106ae72158db785fbaca190fd81ebe