Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
19-09-2024 19:46
Static task
static1
Behavioral task
behavioral1
Sample
ec119b68af6b9f401da6cb3a9fffcf79_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
ec119b68af6b9f401da6cb3a9fffcf79_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
ec119b68af6b9f401da6cb3a9fffcf79_JaffaCakes118.dll
-
Size
5.0MB
-
MD5
ec119b68af6b9f401da6cb3a9fffcf79
-
SHA1
4c95f13bfbe6809d4ddfe85e950f876b30fb607e
-
SHA256
7421d89cbb8d75f8da7a631ae320413a5244cb423bf6d1d14335af70ce131ab5
-
SHA512
c2df4f4ace80125fd88ff19f54bd25c00ca28f83238f9fab82e76c6848e09ca2d3c53671122eaacc356ce5249a40cb912b2060494051d63d1eb212af27b3d84e
-
SSDEEP
98304:+DqPoBi1aRxcSUDk36SAEdhvxWa9P593R8yAVp2:+DqPJ1Cxcxk3ZAEUadzR8yc4
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (3324) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 3 IoCs
pid Process 2108 mssecsvc.exe 2704 mssecsvc.exe 2828 tasksche.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvc.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\WINDOWS\mssecsvc.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvc.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mssecsvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mssecsvc.exe -
Modifies data under HKEY_USERS 24 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\16-71-10-df-40-9c\WpadDecision = "0" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{82CB316F-1ED0-4466-86BE-E6F1056F8500} mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\16-71-10-df-40-9c\WpadDecisionReason = "1" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f01a3000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{82CB316F-1ED0-4466-86BE-E6F1056F8500}\WpadDecisionReason = "1" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\16-71-10-df-40-9c mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{82CB316F-1ED0-4466-86BE-E6F1056F8500}\16-71-10-df-40-9c mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{82CB316F-1ED0-4466-86BE-E6F1056F8500}\WpadDecisionTime = 603b4ba6cc0adb01 mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{82CB316F-1ED0-4466-86BE-E6F1056F8500}\WpadNetworkName = "Network 3" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\16-71-10-df-40-9c\WpadDecisionTime = 603b4ba6cc0adb01 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{82CB316F-1ED0-4466-86BE-E6F1056F8500}\WpadDecision = "0" mssecsvc.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2092 wrote to memory of 1708 2092 rundll32.exe 30 PID 2092 wrote to memory of 1708 2092 rundll32.exe 30 PID 2092 wrote to memory of 1708 2092 rundll32.exe 30 PID 2092 wrote to memory of 1708 2092 rundll32.exe 30 PID 2092 wrote to memory of 1708 2092 rundll32.exe 30 PID 2092 wrote to memory of 1708 2092 rundll32.exe 30 PID 2092 wrote to memory of 1708 2092 rundll32.exe 30 PID 1708 wrote to memory of 2108 1708 rundll32.exe 31 PID 1708 wrote to memory of 2108 1708 rundll32.exe 31 PID 1708 wrote to memory of 2108 1708 rundll32.exe 31 PID 1708 wrote to memory of 2108 1708 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ec119b68af6b9f401da6cb3a9fffcf79_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ec119b68af6b9f401da6cb3a9fffcf79_JaffaCakes118.dll,#12⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2108 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i4⤵
- Executes dropped EXE
PID:2828
-
-
-
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2704
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.6MB
MD538ea24dbf49506bdc052ead9cee9234e
SHA17fbfea41f3ae296125e54938d25a6da60acd1d87
SHA256cdf6e2a4f4d7739247bcf7cb531c7a1e279e2df1611cf6cbd07fddc2b59cffb6
SHA51206a95c97ed0727854328cb4da49beb64d839a40d261422deb3ede6f9cbc3cc25dde0b8f4d2023080d8300fc705d8ebef78b256cc02eb3efc1b5689f7f86da976
-
Filesize
3.4MB
MD5d2d540dd2255353f2b0203b578be8dae
SHA18d7d9a011ea978930c4122831e8d627b9a1ca73a
SHA256943fc1e507f0b6233ed4fd4405be8b9e792758a0c5baa8ddad1ba927f7d17bae
SHA51206b4cad74a63af54ccda7da28aee4c9981c73324b3b0a94b3c1b4dc9a634851d2f9dc5f25821166f699924377ad333a18e0e639bc97209badd5af278148512c5