Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
18-09-2024 19:53
Static task
static1
Behavioral task
behavioral1
Sample
e9ddb84b38bd58839918555f7b09c675_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
e9ddb84b38bd58839918555f7b09c675_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
e9ddb84b38bd58839918555f7b09c675_JaffaCakes118.dll
-
Size
5.0MB
-
MD5
e9ddb84b38bd58839918555f7b09c675
-
SHA1
1be36d458a84806e8197aa9e085ec82d9af9dc97
-
SHA256
48d95a1cf195f8372f5c89e58bbc46d68003f03bde42967bb1ca955d1de32f97
-
SHA512
f7404324d38558357ed2808cef5bb6c5d50188abac52c07419934feded0e0c634e9d90c9c87bd7a364ad3bc6617dd298ef21bc06a739d53e83f26c0ef91a2ac1
-
SSDEEP
24576:SbLgddQhfdmMSirYbcMNgef0K1LJMfcH9PO6L:SnAQqMSPbcBVKxJM0H9
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (3255) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 3 IoCs
pid Process 2992 mssecsvc.exe 2072 mssecsvc.exe 2696 tasksche.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvc.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\WINDOWS\mssecsvc.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvc.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mssecsvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mssecsvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Modifies data under HKEY_USERS 24 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4B0B934F-A7FB-4C1E-AE1C-5C660A29FA5A}\WpadDecision = "0" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4B0B934F-A7FB-4C1E-AE1C-5C660A29FA5A}\WpadNetworkName = "Network 3" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4B0B934F-A7FB-4C1E-AE1C-5C660A29FA5A}\46-09-0e-fb-72-83 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\46-09-0e-fb-72-83 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\46-09-0e-fb-72-83\WpadDecisionReason = "1" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4B0B934F-A7FB-4C1E-AE1C-5C660A29FA5A}\WpadDecisionReason = "1" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4B0B934F-A7FB-4C1E-AE1C-5C660A29FA5A}\WpadDecisionTime = 90c4cb6c040adb01 mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\46-09-0e-fb-72-83\WpadDecisionTime = 90c4cb6c040adb01 mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f01a3000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4B0B934F-A7FB-4C1E-AE1C-5C660A29FA5A} mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\46-09-0e-fb-72-83\WpadDecision = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mssecsvc.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1984 wrote to memory of 1440 1984 rundll32.exe 31 PID 1984 wrote to memory of 1440 1984 rundll32.exe 31 PID 1984 wrote to memory of 1440 1984 rundll32.exe 31 PID 1984 wrote to memory of 1440 1984 rundll32.exe 31 PID 1984 wrote to memory of 1440 1984 rundll32.exe 31 PID 1984 wrote to memory of 1440 1984 rundll32.exe 31 PID 1984 wrote to memory of 1440 1984 rundll32.exe 31 PID 1440 wrote to memory of 2992 1440 rundll32.exe 32 PID 1440 wrote to memory of 2992 1440 rundll32.exe 32 PID 1440 wrote to memory of 2992 1440 rundll32.exe 32 PID 1440 wrote to memory of 2992 1440 rundll32.exe 32
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e9ddb84b38bd58839918555f7b09c675_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e9ddb84b38bd58839918555f7b09c675_JaffaCakes118.dll,#12⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2992 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i4⤵
- Executes dropped EXE
PID:2696
-
-
-
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2072
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.6MB
MD5ae40c72a70c305622e28cdd0236391cb
SHA18fec499d01adf76cbb549aa02bbb1d72b5da0c40
SHA2568cbc116adbf6ba45de9787fd02486c1a171a62a30b21aad6b495a5fda554fe62
SHA5122d6c9d27804ffa07a49c008dfe774580fa71636c9fafba86c3b59d7654d5af4ccacd7b68793cd467861e38349128200b5f613446ac0a75d20170cb37c1042990
-
Filesize
3.4MB
MD56d75d59e517dcd4cd04639cd67f99037
SHA1c038b8d1ceaaafbc08e818b3d82302361b5f577f
SHA2560150be36b01cd9a999c9deceeb127e7ee9e3139fea533c18eb9238051496b114
SHA51220d51e38f12e548f5e5f01656f6e94bb0aaad28efdf059f28b470bafcafcdfcae388d72dd1877821ec430ff391bfaaa676504d7824fcab80f0e28a4ee1049361