Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
15-09-2024 15:54
Static task
static1
Behavioral task
behavioral1
Sample
e2d99de08e004992f0659227d52e8bba_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e2d99de08e004992f0659227d52e8bba_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
e2d99de08e004992f0659227d52e8bba_JaffaCakes118.dll
-
Size
5.0MB
-
MD5
e2d99de08e004992f0659227d52e8bba
-
SHA1
e6d49025832515d78a701c502ea2585cd78abee9
-
SHA256
c6d7ac6498c44d7e59098f4de0d453c78755b1407fb84ded19fdca4ee0d7fead
-
SHA512
7a807c8bf67f0ebef9cfe76eb7ccde8a8a567065aa954c187c5db915edd94eca5175b797de20ea2e203093973a0da572932e7ff4ddfb707ddbbb18b509089d2d
-
SSDEEP
49152:znAQqMSPbcBVQej/1INyjZD0ZqL3UKEf57cPUxv2xZ0TLPtfOja:TDqPoBhz1aQrFtUxuxZwLFGja
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (3153) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 3 IoCs
pid Process 5052 mssecsvc.exe 4348 mssecsvc.exe 2380 tasksche.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\WINDOWS\mssecsvc.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvc.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mssecsvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mssecsvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" mssecsvc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2296 wrote to memory of 5044 2296 rundll32.exe 82 PID 2296 wrote to memory of 5044 2296 rundll32.exe 82 PID 2296 wrote to memory of 5044 2296 rundll32.exe 82 PID 5044 wrote to memory of 5052 5044 rundll32.exe 83 PID 5044 wrote to memory of 5052 5044 rundll32.exe 83 PID 5044 wrote to memory of 5052 5044 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e2d99de08e004992f0659227d52e8bba_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e2d99de08e004992f0659227d52e8bba_JaffaCakes118.dll,#12⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5052 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i4⤵
- Executes dropped EXE
PID:2380
-
-
-
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:4348
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.6MB
MD59bccbfa2902e42abcb599063944112ed
SHA17f21ade93acf06c8117bb8811e8cf02b42805f15
SHA2562fc4ee434d745cf60f7d76d6ffe0911ddeade4556b0ebf2bb372f9f42728b60e
SHA512e18bf6947176a058d508cc1ce3d376dc98097d0da9d33e13e2f20af91c1287ebdbdeb3584da06ede6a46d1eaa1ef15dab41d5c0cd6b8440906727f2fed197ad1
-
Filesize
3.4MB
MD5b3466af4bedeb93affd2374eae0bb2c5
SHA1c4f785738eff7fbc880005d4c66bdd8941fca5a9
SHA256dc6dc7fd391fd2c234ba5a0a82630852b366552ed3423dba04396fe225443c47
SHA5121c982cebba5fe5f832a0cd1b7a6a0aeff488beaeae3c9cf767d33961697959783d2162268088a4eecb003f7263d06ddfc6b0b2047fcf7918ca9cdf1c9a501a9d