Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
18-09-2024 19:24
Static task
static1
Behavioral task
behavioral1
Sample
e9d1ba0ee54fcdf37cf458cd3209c9f3_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
e9d1ba0ee54fcdf37cf458cd3209c9f3_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
e9d1ba0ee54fcdf37cf458cd3209c9f3_JaffaCakes118.dll
-
Size
5.0MB
-
MD5
e9d1ba0ee54fcdf37cf458cd3209c9f3
-
SHA1
77970fdacd24e82e89547f0d6087f866126469ca
-
SHA256
7d8644271eb48be35e35f1d4c06649ba6878b4672f3d57bdea1f2ff9074bc434
-
SHA512
5dbc5b9afc7f15b5dc48650b136621aec4486f036f626fd91f786ee4375007f1a2501a954285c08763319f332657b1b883cd991ba0c678f39d4d19cbfbb3cc0c
-
SSDEEP
49152:RnpEKUacBVQej/1INRx+TSqTdX1HkQo6SAARdhnv:1pyfBhz1aRxcSUDk36SAEdhv
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (3250) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 3 IoCs
pid Process 2312 mssecsvr.exe 2092 mssecsvr.exe 2784 tasksche.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in System32 directory 5 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvr.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\1SYBO6DP.txt mssecsvr.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\1SYBO6DP.txt mssecsvr.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\V3JIJKD8.txt mssecsvr.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\V3JIJKD8.txt mssecsvr.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\WINDOWS\mssecsvr.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvr.exe File created C:\Windows\__tmp_rar_sfx_access_check_259442002 tasksche.exe File created C:\Windows\eee.exe tasksche.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mssecsvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mssecsvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasksche.exe -
Modifies data under HKEY_USERS 24 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5E5A508C-0C7B-451F-9B60-D923A3E5C9F4} mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5E5A508C-0C7B-451F-9B60-D923A3E5C9F4}\WpadDecision = "0" mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5E5A508C-0C7B-451F-9B60-D923A3E5C9F4}\WpadNetworkName = "Network 3" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-4d-4b-32-d2-eb mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-4d-4b-32-d2-eb\WpadDecisionTime = e0d4e76c000adb01 mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5E5A508C-0C7B-451F-9B60-D923A3E5C9F4}\06-4d-4b-32-d2-eb mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-4d-4b-32-d2-eb\WpadDecisionReason = "1" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5E5A508C-0C7B-451F-9B60-D923A3E5C9F4}\WpadDecisionTime = e0d4e76c000adb01 mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-4d-4b-32-d2-eb\WpadDecision = "0" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00b5000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5E5A508C-0C7B-451F-9B60-D923A3E5C9F4}\WpadDecisionReason = "1" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mssecsvr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2784 tasksche.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1560 wrote to memory of 2140 1560 rundll32.exe 30 PID 1560 wrote to memory of 2140 1560 rundll32.exe 30 PID 1560 wrote to memory of 2140 1560 rundll32.exe 30 PID 1560 wrote to memory of 2140 1560 rundll32.exe 30 PID 1560 wrote to memory of 2140 1560 rundll32.exe 30 PID 1560 wrote to memory of 2140 1560 rundll32.exe 30 PID 1560 wrote to memory of 2140 1560 rundll32.exe 30 PID 2140 wrote to memory of 2312 2140 rundll32.exe 31 PID 2140 wrote to memory of 2312 2140 rundll32.exe 31 PID 2140 wrote to memory of 2312 2140 rundll32.exe 31 PID 2140 wrote to memory of 2312 2140 rundll32.exe 31 PID 2312 wrote to memory of 2784 2312 mssecsvr.exe 33 PID 2312 wrote to memory of 2784 2312 mssecsvr.exe 33 PID 2312 wrote to memory of 2784 2312 mssecsvr.exe 33 PID 2312 wrote to memory of 2784 2312 mssecsvr.exe 33 PID 2312 wrote to memory of 2784 2312 mssecsvr.exe 33 PID 2312 wrote to memory of 2784 2312 mssecsvr.exe 33 PID 2312 wrote to memory of 2784 2312 mssecsvr.exe 33
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e9d1ba0ee54fcdf37cf458cd3209c9f3_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e9d1ba0ee54fcdf37cf458cd3209c9f3_JaffaCakes118.dll,#12⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\WINDOWS\mssecsvr.exeC:\WINDOWS\mssecsvr.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i4⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:2784
-
-
-
-
C:\WINDOWS\mssecsvr.exeC:\WINDOWS\mssecsvr.exe -m security1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2092
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD5142db3228dd9177f5fdaec26d0f0e19a
SHA1f4f080d897a4fe16aa557a3499a7d495db62148b
SHA256458d19c4e0d41353ade3b5eb94815436ac911ad13c2fa525f753d5ef182f417f
SHA51207a24755cc8e53669065d3dcfaee9ff6670670242b4e7f5ddd82f75501923372a394063f3b6a9fcd27cf67eb84a152e3b7b7c7d0327d22e2591fb47dec9053cf
-
Filesize
2.0MB
MD5beb8a27fc024962e045c32aa58d07d0e
SHA1796d3613673f323135865c42272abef347add163
SHA256ea2ad4d3bb98673b88e18eea1bf06c371c206b64246a9193b2a64ba4fe4f4900
SHA512e84c03f6f4399b28e0d258b743831f36c621325d9b199cbbdd6982ed51280facfc5a953a2393788bbc54efb653f95c9f75ea29c93c147c9227aff3395f788179