Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
22/08/2024, 19:53
Static task
static1
Behavioral task
behavioral1
Sample
b8ed70b804a34ef41e632b1e52b9d71d_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
b8ed70b804a34ef41e632b1e52b9d71d_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
b8ed70b804a34ef41e632b1e52b9d71d_JaffaCakes118.dll
-
Size
5.0MB
-
MD5
b8ed70b804a34ef41e632b1e52b9d71d
-
SHA1
4ddd2bec1f5e9f0cf99b2448a5a7b52d15373a76
-
SHA256
7b7ddabfbae37a28fa501c3a029ba5f5d5daa9647a90bfdabf629f109a64096e
-
SHA512
586e5fb6f22495151e144d15b7ca09568a6ccf027d678466f7fc24374d285fd734015a2d61ec8ec7255e83a54ea1cb46060b4b6116e6d2cf9ce850ae1f9c6190
-
SSDEEP
24576:SbLgddQhfdmMSirYbcMNgef0QeQ14kFNNZtA0p+9XEk:SnAQqMSPbcBVQe2dNlAH
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (3333) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 3 IoCs
pid Process 2104 mssecsvc.exe 1280 mssecsvc.exe 756 tasksche.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvc.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\WINDOWS\mssecsvc.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvc.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mssecsvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mssecsvc.exe -
Modifies data under HKEY_USERS 24 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0FF0E55F-CB82-461E-BBBD-B35CD53A7E64}\WpadNetworkName = "Network 2" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0FF0E55F-CB82-461E-BBBD-B35CD53A7E64}\36-af-7a-01-40-49 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0FF0E55F-CB82-461E-BBBD-B35CD53A7E64} mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\36-af-7a-01-40-49\WpadDecisionTime = 80d8df05cdf4da01 mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00e9000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0FF0E55F-CB82-461E-BBBD-B35CD53A7E64}\WpadDecisionReason = "1" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\36-af-7a-01-40-49 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0FF0E55F-CB82-461E-BBBD-B35CD53A7E64}\WpadDecisionTime = 80d8df05cdf4da01 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0FF0E55F-CB82-461E-BBBD-B35CD53A7E64}\WpadDecision = "0" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\36-af-7a-01-40-49\WpadDecisionReason = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\36-af-7a-01-40-49\WpadDecision = "0" mssecsvc.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1856 wrote to memory of 2092 1856 rundll32.exe 30 PID 1856 wrote to memory of 2092 1856 rundll32.exe 30 PID 1856 wrote to memory of 2092 1856 rundll32.exe 30 PID 1856 wrote to memory of 2092 1856 rundll32.exe 30 PID 1856 wrote to memory of 2092 1856 rundll32.exe 30 PID 1856 wrote to memory of 2092 1856 rundll32.exe 30 PID 1856 wrote to memory of 2092 1856 rundll32.exe 30 PID 2092 wrote to memory of 2104 2092 rundll32.exe 31 PID 2092 wrote to memory of 2104 2092 rundll32.exe 31 PID 2092 wrote to memory of 2104 2092 rundll32.exe 31 PID 2092 wrote to memory of 2104 2092 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b8ed70b804a34ef41e632b1e52b9d71d_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b8ed70b804a34ef41e632b1e52b9d71d_JaffaCakes118.dll,#12⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2104 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i4⤵
- Executes dropped EXE
PID:756
-
-
-
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1280
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.6MB
MD56ddab34641ddd572aaee54e3ee51c64a
SHA13db4f536187aba054a2794630181d58810055104
SHA256ea04235ff9db8bf72b4a9dee3c3d8d4368016bdd6b55666b05fce6b773ddab3d
SHA51225aca621a9468ae2024bbd2cf6b2cbae8334458198e47e6112b62b00e742468abe7ea5ac4218e720bde9a21571773fba6f3fa88c23d805db82ecbdf7ed9f72ba
-
Filesize
3.4MB
MD5c44957088e24d950bba86b5dc7af4d93
SHA1c040bba277cae42aaa47a40e72b0f74e87dffb8c
SHA256e2085d37f3705969fb42500d6d968ff295df851b7419b4aef2f0cbba175e5dbc
SHA51252750e47e9e1f394215d3ec542ae04f6e92b1667d288c7b7dca2410358dcb8906e4db79ab1223647f9bb3464a46ce3baa727200cd3a6cd438d6e4395cb0025d1