Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
15-09-2024 21:00
Static task
static1
Behavioral task
behavioral1
Sample
e359629d139d776b006c2e20b8a9b4fb_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
e359629d139d776b006c2e20b8a9b4fb_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
e359629d139d776b006c2e20b8a9b4fb_JaffaCakes118.exe
-
Size
3.6MB
-
MD5
e359629d139d776b006c2e20b8a9b4fb
-
SHA1
91a7765b0798d4eb4ec397a16244d2312ecc9628
-
SHA256
bb706a56bdca2b113fc4e6e0d29f9176edb81f00c5a77149c10268de8f8ac4d2
-
SHA512
6b073afe893f5b7150eed6be6463d5d9ac9b9f047b92465def95999ee0c80002851f7fc9e22707c69b93c2ab10e4af7808bf4232aeb35947396fefbe28813f02
-
SSDEEP
49152:XnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9d:XDqPoBhz1aRxcSUDk36SAEdhvxWa9d
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (3294) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 1 IoCs
pid Process 2956 tasksche.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat e359629d139d776b006c2e20b8a9b4fb_JaffaCakes118.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\WINDOWS\tasksche.exe e359629d139d776b006c2e20b8a9b4fb_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e359629d139d776b006c2e20b8a9b4fb_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e359629d139d776b006c2e20b8a9b4fb_JaffaCakes118.exe -
Modifies data under HKEY_USERS 24 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings e359629d139d776b006c2e20b8a9b4fb_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E25E846E-219A-49AF-BD2F-5F7B665DA5C0}\WpadDecisionTime = 302da74bb207db01 e359629d139d776b006c2e20b8a9b4fb_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E25E846E-219A-49AF-BD2F-5F7B665DA5C0}\WpadDecision = "0" e359629d139d776b006c2e20b8a9b4fb_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\e6-e0-a4-b7-81-e9\WpadDecisionTime = 302da74bb207db01 e359629d139d776b006c2e20b8a9b4fb_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\e6-e0-a4-b7-81-e9\WpadDecision = "0" e359629d139d776b006c2e20b8a9b4fb_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" e359629d139d776b006c2e20b8a9b4fb_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix e359629d139d776b006c2e20b8a9b4fb_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" e359629d139d776b006c2e20b8a9b4fb_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 e359629d139d776b006c2e20b8a9b4fb_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings e359629d139d776b006c2e20b8a9b4fb_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" e359629d139d776b006c2e20b8a9b4fb_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ e359629d139d776b006c2e20b8a9b4fb_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" e359629d139d776b006c2e20b8a9b4fb_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad e359629d139d776b006c2e20b8a9b4fb_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E25E846E-219A-49AF-BD2F-5F7B665DA5C0}\WpadDecisionReason = "1" e359629d139d776b006c2e20b8a9b4fb_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E25E846E-219A-49AF-BD2F-5F7B665DA5C0}\WpadNetworkName = "Network 3" e359629d139d776b006c2e20b8a9b4fb_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E25E846E-219A-49AF-BD2F-5F7B665DA5C0}\e6-e0-a4-b7-81-e9 e359629d139d776b006c2e20b8a9b4fb_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\e6-e0-a4-b7-81-e9\WpadDecisionReason = "1" e359629d139d776b006c2e20b8a9b4fb_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections e359629d139d776b006c2e20b8a9b4fb_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 e359629d139d776b006c2e20b8a9b4fb_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" e359629d139d776b006c2e20b8a9b4fb_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E25E846E-219A-49AF-BD2F-5F7B665DA5C0} e359629d139d776b006c2e20b8a9b4fb_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\e6-e0-a4-b7-81-e9 e359629d139d776b006c2e20b8a9b4fb_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00a8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 e359629d139d776b006c2e20b8a9b4fb_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e359629d139d776b006c2e20b8a9b4fb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e359629d139d776b006c2e20b8a9b4fb_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1736 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i2⤵
- Executes dropped EXE
PID:2956
-
-
C:\Users\Admin\AppData\Local\Temp\e359629d139d776b006c2e20b8a9b4fb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\e359629d139d776b006c2e20b8a9b4fb_JaffaCakes118.exe -m security1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2808
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.4MB
MD5ee1bc7c54c6a6dfd29613e0d95474027
SHA1451c29f3fce7c0b2883064a0ceb36ec04a027870
SHA256882f6c0786aa463f82f578f989937c06ae1334f31a060eb7ad5dae93ba036610
SHA51200c5074dcad2efe42e384f59010e68c6e41df0221a8bbd9a900cbb47b2787d1cdc3d23127fa52f1c173e93bb73b2d8cdf9a1255b1ff5fedd25bd9bdc11a19b1a