Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19-09-2024 12:46
Static task
static1
Behavioral task
behavioral1
Sample
eb5d329f78f7dd2c0c683faae813b83e_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
eb5d329f78f7dd2c0c683faae813b83e_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
eb5d329f78f7dd2c0c683faae813b83e_JaffaCakes118.dll
-
Size
5.0MB
-
MD5
eb5d329f78f7dd2c0c683faae813b83e
-
SHA1
7eed68d84cc304207158d5e7dbd140abb1bd178d
-
SHA256
b63a1b3002455f7d90d2215237113d5d277ae176dcc99e55f42fd82f7d3cfd49
-
SHA512
531918ae23e54ea4a4345d4c26c5f71d6a901bef01435f71ffa7e67eed85eab372bd3062db53318847e46fd8c5879de32bed9727967047edf0910148d765e177
-
SSDEEP
98304:+DqPoBhz1aRxcSUDk36SAEdhvxWa9P593Rl2H:+DqPe1Cxcxk3ZAEUadzRMH
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (3209) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 3 IoCs
pid Process 4520 mssecsvc.exe 4496 mssecsvc.exe 4504 tasksche.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\WINDOWS\mssecsvc.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvc.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mssecsvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mssecsvc.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" mssecsvc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3288 wrote to memory of 1048 3288 rundll32.exe 82 PID 3288 wrote to memory of 1048 3288 rundll32.exe 82 PID 3288 wrote to memory of 1048 3288 rundll32.exe 82 PID 1048 wrote to memory of 4520 1048 rundll32.exe 83 PID 1048 wrote to memory of 4520 1048 rundll32.exe 83 PID 1048 wrote to memory of 4520 1048 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\eb5d329f78f7dd2c0c683faae813b83e_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\eb5d329f78f7dd2c0c683faae813b83e_JaffaCakes118.dll,#12⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4520 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i4⤵
- Executes dropped EXE
PID:4504
-
-
-
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:4496
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.6MB
MD56cdddd289f90818941bc815c8d7c3db6
SHA1a63a1f55b631d8e39fbda2733bd80905b4f67c6a
SHA2566fd60932e2af896a93eead2fa6954bc7c194ec3e5586388ec346b799568b0328
SHA5121933ed065a158caafe5bcb79bf0a5c2dcddeb85dd51711481bec7798b855c02a965c746748d24bc9182546d65510e7221a8a12c361b291d26367e4f190389ba4
-
Filesize
3.4MB
MD5650552fb58e0f17ff2feee3376788f1b
SHA19fd42bf92ac87327eceea62ac59ebb3dd638aa7c
SHA25641061abafadc6a2325563130c41455536961c0bfd7a898a8038cf0ed148deeb9
SHA512050f760cddc28a22d9fdca040066275a36081297110587548c319a8d169af8d3c994e4550d7b119966f7fede590326af825aa98cd866c4a6e021302d1c6b9b82