Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    18-09-2024 18:22

General

  • Target

    e9b7c0d4438a38ec814e5c194f777eae_JaffaCakes118.dll

  • Size

    5.0MB

  • MD5

    e9b7c0d4438a38ec814e5c194f777eae

  • SHA1

    33407e8584e25c369d3c9effb356b560be97f9fe

  • SHA256

    fb3144f536e4b1ee02ba4698c360e8fec5fd3ddde25f93c040a88858422c7590

  • SHA512

    7733024f459abfe3eb3081524d385473744fb8a31626969f1f01437efe68fa82bf736e345c31c3b82d50dd4a9d14f061de63c1ebc61a67fbbee969fca2eac69a

  • SSDEEP

    49152:znAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdh:TDqPoBhz1aRxcSUDk36SAEdh

Malware Config

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

  • Contacts a large (3064) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Executes dropped EXE 3 IoCs
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 24 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\e9b7c0d4438a38ec814e5c194f777eae_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2236
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\e9b7c0d4438a38ec814e5c194f777eae_JaffaCakes118.dll,#1
      2⤵
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2088
      • C:\WINDOWS\mssecsvc.exe
        C:\WINDOWS\mssecsvc.exe
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:2148
        • C:\WINDOWS\tasksche.exe
          C:\WINDOWS\tasksche.exe /i
          4⤵
          • Executes dropped EXE
          PID:2820
  • C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe -m security
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    PID:2756

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\mssecsvc.exe

    Filesize

    3.6MB

    MD5

    61e45922d90f054d101fa2580afb76b6

    SHA1

    ff305983f3d2719d6c993a0f25c7f9e6cfa28705

    SHA256

    3390b4265f7ca133343dc761cd7996303a8b1de8bc7e3e19751c100539920d57

    SHA512

    7227b5c48a3384df524011d4ca814ee66e8ac3514a68dd996d3475d700261a931fde2cd1e830686fca16e31e1e9654ef85f29787e029e202742b63f41d10c139

  • C:\Windows\tasksche.exe

    Filesize

    3.4MB

    MD5

    c85689d84c278a2fdd27a93a221a12d2

    SHA1

    93290a748287362ff4242b2b4dcf2fe01056c743

    SHA256

    f46a7bcc473cc83eb96a76fbeed8feb5c8729279f1c3d305d6713286d8917945

    SHA512

    50369826934d5cead77af96f6049b70bd7ad71e97960249a567fae8c6261442b477c724085b8a2c1c78228e0c81f0f784a2c6c4aeb76174a6b0bfb393407b13a