Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
31/08/2024, 23:51
Static task
static1
Behavioral task
behavioral1
Sample
cdd469842ed83be4a6a926526a9304ee_JaffaCakes118.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
cdd469842ed83be4a6a926526a9304ee_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
cdd469842ed83be4a6a926526a9304ee_JaffaCakes118.dll
-
Size
5.0MB
-
MD5
cdd469842ed83be4a6a926526a9304ee
-
SHA1
319e26d32ffb0143f5acfdcdbf4a407d127b5e12
-
SHA256
0490c8190425ceb2f3588cd8368bce81a0e2fa839642fe6ad06ae0034e37593c
-
SHA512
5ed14c34d1a95f286cacffbda8bbb2fcf316471ecee48c7d0b521d16ae8c81b7ddf2e63f51b023543270890341ca27b47959fa1ed41b1bb2ad7170374a48e9ff
-
SSDEEP
49152:RnnMSPbcBVQej/1INRx+TSqTdX1HkXhnv:1nPoBhz1aRxcSUDkXhv
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (2173) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 2 IoCs
pid Process 1884 mssecsvr.exe 2104 mssecsvr.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\WINDOWS\mssecsvr.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvr.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mssecsvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mssecsvr.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" mssecsvr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4840 wrote to memory of 4328 4840 rundll32.exe 84 PID 4840 wrote to memory of 4328 4840 rundll32.exe 84 PID 4840 wrote to memory of 4328 4840 rundll32.exe 84 PID 4328 wrote to memory of 1884 4328 rundll32.exe 85 PID 4328 wrote to memory of 1884 4328 rundll32.exe 85 PID 4328 wrote to memory of 1884 4328 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cdd469842ed83be4a6a926526a9304ee_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cdd469842ed83be4a6a926526a9304ee_JaffaCakes118.dll,#12⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\WINDOWS\mssecsvr.exeC:\WINDOWS\mssecsvr.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1884
-
-
-
C:\WINDOWS\mssecsvr.exeC:\WINDOWS\mssecsvr.exe -m security1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2104
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD56fecb78f7f357c58713b47871531d9f0
SHA1890e7d5fe8e88ad68a143471063aba05ff5ee143
SHA256c7b3596374cfad85cbaa69604a985aafed6df241c5ac164d7fc13408ff54ab03
SHA512531f2eed08132072814918af3ba12fec6e92904ad6d1a26e9273ad5e3ddfb029ebb4077d814bc2f08601bf5062d5b2ffec27ee3e27c05e72a4a702ef01682fb4