Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
13-09-2024 05:48
Static task
static1
Behavioral task
behavioral1
Sample
ddcb0dfe88540e6970300ec0630ddf5b_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ddcb0dfe88540e6970300ec0630ddf5b_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
ddcb0dfe88540e6970300ec0630ddf5b_JaffaCakes118.dll
-
Size
5.0MB
-
MD5
ddcb0dfe88540e6970300ec0630ddf5b
-
SHA1
cfc57a371695de380053066c51c4257336ee8d72
-
SHA256
f4e8357d77381a2d15d71d4309261236bfb78b53ab127162dad943cb897a0e4b
-
SHA512
04d18398871d010e505a025abfb3d5af242c28e77bef0356ab2e6dcb3c3aa6fd1e8037159613c14cd6caecf8bba0f9277706ab507921a9543406a388047d6bf7
-
SSDEEP
49152:tnAQqMSPbcBVthnvxJM0H9PAMEcaEau3R8yAH1plAHa:hDqPoBXhvxWa9P593R8yAVp2Ha
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (3139) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 2 IoCs
pid Process 2236 mssecsvc.exe 2776 mssecsvc.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvc.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\WINDOWS\mssecsvc.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvc.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mssecsvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mssecsvc.exe -
Modifies data under HKEY_USERS 24 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{42C6E237-002A-4A84-A74E-9F2E812C4D68} mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{42C6E237-002A-4A84-A74E-9F2E812C4D68}\WpadDecisionReason = "1" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{42C6E237-002A-4A84-A74E-9F2E812C4D68}\WpadNetworkName = "Network 3" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{42C6E237-002A-4A84-A74E-9F2E812C4D68}\WpadDecisionTime = 50a68498a005db01 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{42C6E237-002A-4A84-A74E-9F2E812C4D68}\WpadDecision = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\62-68-bf-e0-0d-4a\WpadDecisionReason = "1" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\62-68-bf-e0-0d-4a\WpadDecisionTime = 50a68498a005db01 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\62-68-bf-e0-0d-4a mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00d9000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{42C6E237-002A-4A84-A74E-9F2E812C4D68}\62-68-bf-e0-0d-4a mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\62-68-bf-e0-0d-4a\WpadDecision = "0" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvc.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2236 mssecsvc.exe 2776 mssecsvc.exe -
Suspicious behavior: MapViewOfSection 43 IoCs
pid Process 2236 mssecsvc.exe 2236 mssecsvc.exe 2236 mssecsvc.exe 2236 mssecsvc.exe 2236 mssecsvc.exe 2236 mssecsvc.exe 2236 mssecsvc.exe 2236 mssecsvc.exe 2236 mssecsvc.exe 2236 mssecsvc.exe 2236 mssecsvc.exe 2236 mssecsvc.exe 2236 mssecsvc.exe 2236 mssecsvc.exe 2236 mssecsvc.exe 2236 mssecsvc.exe 2236 mssecsvc.exe 2236 mssecsvc.exe 2236 mssecsvc.exe 2236 mssecsvc.exe 2236 mssecsvc.exe 2776 mssecsvc.exe 2776 mssecsvc.exe 2776 mssecsvc.exe 2776 mssecsvc.exe 2776 mssecsvc.exe 2776 mssecsvc.exe 2776 mssecsvc.exe 2776 mssecsvc.exe 2776 mssecsvc.exe 2776 mssecsvc.exe 2776 mssecsvc.exe 2776 mssecsvc.exe 2776 mssecsvc.exe 2776 mssecsvc.exe 2776 mssecsvc.exe 2776 mssecsvc.exe 2776 mssecsvc.exe 2776 mssecsvc.exe 2776 mssecsvc.exe 2776 mssecsvc.exe 2776 mssecsvc.exe 2776 mssecsvc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2236 mssecsvc.exe Token: SeDebugPrivilege 2776 mssecsvc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2232 wrote to memory of 2228 2232 rundll32.exe 28 PID 2232 wrote to memory of 2228 2232 rundll32.exe 28 PID 2232 wrote to memory of 2228 2232 rundll32.exe 28 PID 2232 wrote to memory of 2228 2232 rundll32.exe 28 PID 2232 wrote to memory of 2228 2232 rundll32.exe 28 PID 2232 wrote to memory of 2228 2232 rundll32.exe 28 PID 2232 wrote to memory of 2228 2232 rundll32.exe 28 PID 2228 wrote to memory of 2236 2228 rundll32.exe 29 PID 2228 wrote to memory of 2236 2228 rundll32.exe 29 PID 2228 wrote to memory of 2236 2228 rundll32.exe 29 PID 2228 wrote to memory of 2236 2228 rundll32.exe 29 PID 2236 wrote to memory of 380 2236 mssecsvc.exe 3 PID 2236 wrote to memory of 380 2236 mssecsvc.exe 3 PID 2236 wrote to memory of 380 2236 mssecsvc.exe 3 PID 2236 wrote to memory of 380 2236 mssecsvc.exe 3 PID 2236 wrote to memory of 380 2236 mssecsvc.exe 3 PID 2236 wrote to memory of 380 2236 mssecsvc.exe 3 PID 2236 wrote to memory of 380 2236 mssecsvc.exe 3 PID 2236 wrote to memory of 388 2236 mssecsvc.exe 4 PID 2236 wrote to memory of 388 2236 mssecsvc.exe 4 PID 2236 wrote to memory of 388 2236 mssecsvc.exe 4 PID 2236 wrote to memory of 388 2236 mssecsvc.exe 4 PID 2236 wrote to memory of 388 2236 mssecsvc.exe 4 PID 2236 wrote to memory of 388 2236 mssecsvc.exe 4 PID 2236 wrote to memory of 388 2236 mssecsvc.exe 4 PID 2236 wrote to memory of 428 2236 mssecsvc.exe 5 PID 2236 wrote to memory of 428 2236 mssecsvc.exe 5 PID 2236 wrote to memory of 428 2236 mssecsvc.exe 5 PID 2236 wrote to memory of 428 2236 mssecsvc.exe 5 PID 2236 wrote to memory of 428 2236 mssecsvc.exe 5 PID 2236 wrote to memory of 428 2236 mssecsvc.exe 5 PID 2236 wrote to memory of 428 2236 mssecsvc.exe 5 PID 2236 wrote to memory of 476 2236 mssecsvc.exe 6 PID 2236 wrote to memory of 476 2236 mssecsvc.exe 6 PID 2236 wrote to memory of 476 2236 mssecsvc.exe 6 PID 2236 wrote to memory of 476 2236 mssecsvc.exe 6 PID 2236 wrote to memory of 476 2236 mssecsvc.exe 6 PID 2236 wrote to memory of 476 2236 mssecsvc.exe 6 PID 2236 wrote to memory of 476 2236 mssecsvc.exe 6 PID 2236 wrote to memory of 484 2236 mssecsvc.exe 7 PID 2236 wrote to memory of 484 2236 mssecsvc.exe 7 PID 2236 wrote to memory of 484 2236 mssecsvc.exe 7 PID 2236 wrote to memory of 484 2236 mssecsvc.exe 7 PID 2236 wrote to memory of 484 2236 mssecsvc.exe 7 PID 2236 wrote to memory of 484 2236 mssecsvc.exe 7 PID 2236 wrote to memory of 484 2236 mssecsvc.exe 7 PID 2236 wrote to memory of 492 2236 mssecsvc.exe 8 PID 2236 wrote to memory of 492 2236 mssecsvc.exe 8 PID 2236 wrote to memory of 492 2236 mssecsvc.exe 8 PID 2236 wrote to memory of 492 2236 mssecsvc.exe 8 PID 2236 wrote to memory of 492 2236 mssecsvc.exe 8 PID 2236 wrote to memory of 492 2236 mssecsvc.exe 8 PID 2236 wrote to memory of 492 2236 mssecsvc.exe 8 PID 2236 wrote to memory of 596 2236 mssecsvc.exe 9 PID 2236 wrote to memory of 596 2236 mssecsvc.exe 9 PID 2236 wrote to memory of 596 2236 mssecsvc.exe 9 PID 2236 wrote to memory of 596 2236 mssecsvc.exe 9 PID 2236 wrote to memory of 596 2236 mssecsvc.exe 9 PID 2236 wrote to memory of 596 2236 mssecsvc.exe 9 PID 2236 wrote to memory of 596 2236 mssecsvc.exe 9 PID 2236 wrote to memory of 672 2236 mssecsvc.exe 10 PID 2236 wrote to memory of 672 2236 mssecsvc.exe 10 PID 2236 wrote to memory of 672 2236 mssecsvc.exe 10 PID 2236 wrote to memory of 672 2236 mssecsvc.exe 10
Processes
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:380
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵PID:476
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵PID:596
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵PID:1448
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵PID:672
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵PID:748
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵PID:812
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵PID:1164
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵PID:852
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵PID:964
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵PID:280
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵PID:340
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵PID:1072
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵PID:1108
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵PID:1580
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵PID:1756
-
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security3⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2776
-
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵PID:484
-
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:492
-
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:388
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:428
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1212
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ddcb0dfe88540e6970300ec0630ddf5b_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ddcb0dfe88540e6970300ec0630ddf5b_JaffaCakes118.dll,#13⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe4⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2236
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.6MB
MD5a3a942b5aba5c168676f41cd729db6d9
SHA12c75155cd090b855354223a721664ca18500891f
SHA25642bf79ebe6e637af104a5bad217838b9fcaf8bffaae3b6117417d21e33913dce
SHA512adab67103cc873b1ea5f516280c0069f9c2fd0cb144ab2089e4ca8f91fec820293439874827d962ff46ba1980a701370fd205c1d682e007055cf7c0c97adeedf