Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system -
submitted
02-08-2024 06:29
Static task
static1
Behavioral task
behavioral1
Sample
835cbba608ad354eeaf5671108d39450_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
835cbba608ad354eeaf5671108d39450_JaffaCakes118.dll
Resource
win10v2004-20240730-en
General
-
Target
835cbba608ad354eeaf5671108d39450_JaffaCakes118.dll
-
Size
5.0MB
-
MD5
835cbba608ad354eeaf5671108d39450
-
SHA1
d3fa0e70ead6f25317d2ba822a04562422c205b7
-
SHA256
278cc6e804a8c54e71c0ea8565fbe21ebbf2dad3a0bbe3bfe13c324292abe076
-
SHA512
30e4e8a17105113e5bec76126b2f47534f94ce8dfc9af652a059809b55401f38af50473b060923c19e3434ad62eef696dabf408652b7254a70c421b68ffbf91c
-
SSDEEP
98304:+DqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVtvH:+DqPe1Cxcxk3ZAEUadzR8yctvH
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (3217) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 3 IoCs
pid Process 4592 mssecsvc.exe 3772 mssecsvc.exe 4204 tasksche.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\WINDOWS\mssecsvc.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvc.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mssecsvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mssecsvc.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" mssecsvc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3472 wrote to memory of 3224 3472 rundll32.exe 83 PID 3472 wrote to memory of 3224 3472 rundll32.exe 83 PID 3472 wrote to memory of 3224 3472 rundll32.exe 83 PID 3224 wrote to memory of 4592 3224 rundll32.exe 84 PID 3224 wrote to memory of 4592 3224 rundll32.exe 84 PID 3224 wrote to memory of 4592 3224 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\835cbba608ad354eeaf5671108d39450_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\835cbba608ad354eeaf5671108d39450_JaffaCakes118.dll,#12⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4592 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i4⤵
- Executes dropped EXE
PID:4204
-
-
-
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:3772
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.6MB
MD527940c947e92ac57b911d998cfe75155
SHA181eed2afec3d4862787f70e69bf098f7c010edb2
SHA256a8b805578eeaf6c2df2622543db60e80535491f3733a2da72df99d07aa390e46
SHA512aea3b56a35f62bd5ed7afa25c01b7809add1c80cd1d2744328c36f147791d4d681d8016784d1ba7472f9eeec031b0bcadccc74db6f27079b79e088400321eec6
-
Filesize
3.4MB
MD53454acf3aa69e037b909ed9edf4cc422
SHA1d447a59d679894ac1fcdd996882840cb84d1a4ca
SHA256fcb6fd1d5b75cabe08536334b3c6ad99aa198d0659264910d6744b6b9171b166
SHA5128ca7e7d74151c711e1bf900d69b80a56ce5bcadc91ace85c550bb27ae854ffb5c4945b29b8c22e5479c651ce8a0d1f8a614763ae00ea2079aa78c4cd61e4f418