Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07-09-2024 23:42
Static task
static1
Behavioral task
behavioral1
Sample
d3121d321acbf7b44d80580e7ae02930_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d3121d321acbf7b44d80580e7ae02930_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
d3121d321acbf7b44d80580e7ae02930_JaffaCakes118.dll
-
Size
5.0MB
-
MD5
d3121d321acbf7b44d80580e7ae02930
-
SHA1
36551efd55f4964d01d3a56d859e2ac0e022c9ea
-
SHA256
e58007e757967bfeecd78e6c80e38a167c699636cf03c9e1f58ae3fbd06e038d
-
SHA512
05f097b2c128748c1f5fd956eba1916d145a8b6987182c5c176026ad614e4477803cb29251565e9fcf4934a58d232564879b6aca97cc28ce9fa2cb2adb972a63
-
SSDEEP
12288:T1bLgmluCtgQbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+DHeQYSUjEXFp:RbLgurgDdmMSirYbcMNgef0QeQjG
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (2060) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 2 IoCs
pid Process 1076 mssecsvr.exe 1512 mssecsvr.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\WINDOWS\mssecsvr.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvr.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mssecsvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mssecsvr.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" mssecsvr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3600 wrote to memory of 4968 3600 rundll32.exe 83 PID 3600 wrote to memory of 4968 3600 rundll32.exe 83 PID 3600 wrote to memory of 4968 3600 rundll32.exe 83 PID 4968 wrote to memory of 1076 4968 rundll32.exe 84 PID 4968 wrote to memory of 1076 4968 rundll32.exe 84 PID 4968 wrote to memory of 1076 4968 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d3121d321acbf7b44d80580e7ae02930_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d3121d321acbf7b44d80580e7ae02930_JaffaCakes118.dll,#12⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\WINDOWS\mssecsvr.exeC:\WINDOWS\mssecsvr.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1076
-
-
-
C:\WINDOWS\mssecsvr.exeC:\WINDOWS\mssecsvr.exe -m security1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1512
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD5f85c6a33211750023b97bcc0321f25da
SHA1f272dd9a0b16a3e49b54986c45e25c73ae9de2c6
SHA256751fa045e68c1f42fca2d3b6dda2460135f692f0dbff6c74eb66096318504838
SHA512b537c13e0424e3570010107d05bedded016117fae67cf7a9a9d775581fcff551e665cc19f45309cabb0532a927712ecd0bc9d073e49588e0d1a2f5206c123924