Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14-09-2024 14:39
Static task
static1
Behavioral task
behavioral1
Sample
e064c76a67507dd7a2dbb1556510fd7f_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e064c76a67507dd7a2dbb1556510fd7f_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
e064c76a67507dd7a2dbb1556510fd7f_JaffaCakes118.dll
-
Size
5.0MB
-
MD5
e064c76a67507dd7a2dbb1556510fd7f
-
SHA1
25e1b22505ecaaa477b93929987be91980c54e1e
-
SHA256
3510a6cd1fccfd69f27a038454ba1e0a2f3e6666c9fa927c3151a00aedfc89cc
-
SHA512
f2f032bf9d5a22064d01c98d007e4f765121fc2854227be60ca0f3930912052a9ccff50a0eb8758683a0bae51003be23bbaaae7312b8c0e3100205a74dda908c
-
SSDEEP
49152:SnAQqMSPbcBVQej/1INRx+TSqTdX1HkQDSkRiwt/Zx+:+DqPoBhz1aRxcSUDkgSkkGZx
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (3325) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 3 IoCs
pid Process 336 mssecsvc.exe 2916 mssecsvc.exe 5052 tasksche.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\WINDOWS\tasksche.exe mssecsvc.exe File created C:\WINDOWS\mssecsvc.exe rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mssecsvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mssecsvc.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" mssecsvc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1088 wrote to memory of 1776 1088 rundll32.exe 83 PID 1088 wrote to memory of 1776 1088 rundll32.exe 83 PID 1088 wrote to memory of 1776 1088 rundll32.exe 83 PID 1776 wrote to memory of 336 1776 rundll32.exe 85 PID 1776 wrote to memory of 336 1776 rundll32.exe 85 PID 1776 wrote to memory of 336 1776 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e064c76a67507dd7a2dbb1556510fd7f_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e064c76a67507dd7a2dbb1556510fd7f_JaffaCakes118.dll,#12⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:336 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i4⤵
- Executes dropped EXE
PID:5052
-
-
-
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2916
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.6MB
MD51230ce9f895d8eaa19007473a2bb2458
SHA1b153fff140fc98e80e7bbfe5e42c0eb130ae82de
SHA25691ac5831b3a231ff9f808c4e947a07adcdcf0d8626958e362d2812a9c0ef1cc4
SHA512cd3b206aec30c7ee34756d8a1d017262f5b46859d1b1925195707921132d51752a749910ef1e4b1aec495c9ea0b201fd5f032e7bba748ee0e023918baf2bcc86
-
Filesize
3.4MB
MD5b96bb96cdc803f11dbf69a2df353a1ef
SHA1e3580227ae45bedaa33cc1c7e7f72c11749b78a3
SHA2560b0ee43b092ac2bfa2646022d1c024eb0b7ebe574a6a1e3c395a83cf6d1b9009
SHA5129a464e2aa300e38a2246b3752667e71e703edf9cb8730be189a135f14127a6d42bd4d633d64c292f792e501bcd3725def45bb5a9d510f6c1bc7b395f70ee6765