Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    18-09-2024 18:22

General

  • Target

    e9b79709d134383b794c653aa3ccaa3a_JaffaCakes118.dll

  • Size

    5.0MB

  • MD5

    e9b79709d134383b794c653aa3ccaa3a

  • SHA1

    f16c829e858af625b894c7d35a7977877b45dfbf

  • SHA256

    5f5f968e09e70cdf86b068b838c9c243a785e74e778888d692846787c626ae8b

  • SHA512

    573021c0326c0587d6e74b8a9cbfe119bf000b006e827fbe51040893951b12f0d1d790161b90c4f0899a90e1bb5d074044d1337ef3eaea435958ae990163e624

  • SSDEEP

    24576:SbLgddQhfdmMSirYbcMNgef0QeQjG/D8kIqRYoAdNLKz6626Wo/9pNZtA0p+9XEk:SnAQqMSPbcBVQej/1INRAW+9plAH

Malware Config

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

  • Contacts a large (3117) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Executes dropped EXE 3 IoCs
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 24 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\e9b79709d134383b794c653aa3ccaa3a_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2236
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\e9b79709d134383b794c653aa3ccaa3a_JaffaCakes118.dll,#1
      2⤵
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2168
      • C:\WINDOWS\mssecsvc.exe
        C:\WINDOWS\mssecsvc.exe
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:2556
        • C:\WINDOWS\tasksche.exe
          C:\WINDOWS\tasksche.exe /i
          4⤵
          • Executes dropped EXE
          PID:2776
  • C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe -m security
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    PID:2012

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\mssecsvc.exe

    Filesize

    3.6MB

    MD5

    1462786cdc11ca34e96d6543e7b8ab3a

    SHA1

    a07b623da8896cf5f3cdb4eac8c1870d868248b4

    SHA256

    f4cf66588f08d8b426220a39efcb48c276e4a76c4ae904fa6c93e95fdc94b300

    SHA512

    c1d2e9f256d411001b03b23aa1c340fde8f1f235b95b3b9cd8f7710b280a1ea92719dda8e31a90c1691d0d78c4cadd4d56b9d3acf18f53f2dfa1afdcc35c7e8a

  • C:\Windows\tasksche.exe

    Filesize

    3.4MB

    MD5

    fac3a05536e58281f74ceeb3004dde94

    SHA1

    b12d52db9e4618f5828418976e613f2617cd5bba

    SHA256

    ad3bdd33b90981ffdeaa13072e56c38b7ab65b36a81d13e95399d35dde0ee72c

    SHA512

    df6726c3da817a6ed0d4369f8084654f186882ca8ebdbc65fc6b8be95b121cb7481d796ae2afc8e882b24f2bb76df05721121179b27144f7d4d599a5e2986368