Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
19-09-2024 17:02
Static task
static1
Behavioral task
behavioral1
Sample
ebcb8eeb3a0ab32633aea9ce7abdd07e_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
ebcb8eeb3a0ab32633aea9ce7abdd07e_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
ebcb8eeb3a0ab32633aea9ce7abdd07e_JaffaCakes118.dll
-
Size
5.0MB
-
MD5
ebcb8eeb3a0ab32633aea9ce7abdd07e
-
SHA1
97a1836b9e66961599a921b1f1596e979c81d5eb
-
SHA256
3fbdc29264fb824e9590ff6090b654143a248c38e65a2eeaca3a8cb3ff69d368
-
SHA512
2c5e99740c9c628752bc8be40335f064ae5ef8bc570fba78c56ee85f3dfdf4c42b2757c9c7bfeb1e620f02ecff5131c5d36f9c2c670f257899eda0de36a3cbae
-
SSDEEP
24576:SbLgddQhfdmMSirYbcMNgef0PSrHV7YoZnA/70CUt:SnAQqMSPbcBVarHV7YoG/QC
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (3263) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 3 IoCs
pid Process 2700 mssecsvc.exe 2564 mssecsvc.exe 2672 tasksche.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvc.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\WINDOWS\mssecsvc.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvc.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mssecsvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mssecsvc.exe -
Modifies data under HKEY_USERS 24 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FCE81109-3D15-4E13-93B9-9AE8331C1454}\WpadDecisionTime = 20d638b1b50adb01 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7e-ae-e4-53-53-b4\WpadDecisionReason = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7e-ae-e4-53-53-b4\WpadDecision = "0" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FCE81109-3D15-4E13-93B9-9AE8331C1454} mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FCE81109-3D15-4E13-93B9-9AE8331C1454}\WpadDecision = "0" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FCE81109-3D15-4E13-93B9-9AE8331C1454}\WpadNetworkName = "Network 3" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7e-ae-e4-53-53-b4 mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f019f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FCE81109-3D15-4E13-93B9-9AE8331C1454}\WpadDecisionReason = "1" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FCE81109-3D15-4E13-93B9-9AE8331C1454}\7e-ae-e4-53-53-b4 mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7e-ae-e4-53-53-b4\WpadDecisionTime = 20d638b1b50adb01 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1904 wrote to memory of 2324 1904 rundll32.exe 31 PID 1904 wrote to memory of 2324 1904 rundll32.exe 31 PID 1904 wrote to memory of 2324 1904 rundll32.exe 31 PID 1904 wrote to memory of 2324 1904 rundll32.exe 31 PID 1904 wrote to memory of 2324 1904 rundll32.exe 31 PID 1904 wrote to memory of 2324 1904 rundll32.exe 31 PID 1904 wrote to memory of 2324 1904 rundll32.exe 31 PID 2324 wrote to memory of 2700 2324 rundll32.exe 32 PID 2324 wrote to memory of 2700 2324 rundll32.exe 32 PID 2324 wrote to memory of 2700 2324 rundll32.exe 32 PID 2324 wrote to memory of 2700 2324 rundll32.exe 32
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ebcb8eeb3a0ab32633aea9ce7abdd07e_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ebcb8eeb3a0ab32633aea9ce7abdd07e_JaffaCakes118.dll,#12⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2700 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i4⤵
- Executes dropped EXE
PID:2672
-
-
-
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2564
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.6MB
MD533b3a012d78815d7441ebc48347a5f60
SHA172dc0a13d45352fb484210a6b38e42390ea90b86
SHA2568aecc111ede60a83a9d205764bada45043b4b8f956a6b939a17fcd78d1622382
SHA51287e6bac3a9d6bb6af5015390ac28f76e760b7ebeb0f21c58c25aa394d76175c3c921616cbbf0eb98b91b07bf1b473573b6dfe8629ae888273aac579fca4261ab
-
Filesize
3.4MB
MD56785fd8fcb6abca75ecd86b49cb4ea37
SHA167915851aaabe1b6a714c0c8ee62093fc069448a
SHA256380b29d1733c6152001241f55db92418f48f907c2026046b28943d314314b1f7
SHA5126a115ef151ca39ffbff72f66de33ef3a0cbd67a1d619d49fe48b456ac7cd8e5d0efddabe03e1766568de9290279352d8eabc1b90ffb8ae918487881ca0b70b52