Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-09-2024 00:17
Static task
static1
Behavioral task
behavioral1
Sample
ec778b5a1be5dfb4ae454bd66d62863a_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ec778b5a1be5dfb4ae454bd66d62863a_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
ec778b5a1be5dfb4ae454bd66d62863a_JaffaCakes118.dll
-
Size
5.0MB
-
MD5
ec778b5a1be5dfb4ae454bd66d62863a
-
SHA1
8022e9050016e76682479701336585312a137a59
-
SHA256
24eb185b918fdc840b44b8c3a8cfcac21660359182edbf6cf9afa4cc7fbb3539
-
SHA512
7af40e7f8d28fddf9826917ac61d0827dbef37dba6ca4544dfb38f28082b7cad30919f33890582b64730fa0cf930f56bf66c434b62d89316e49b1074af67ec2c
-
SSDEEP
49152:SnAQqMSPbcBVQej/nAARdhnvxJM0H9PAMEcaEau3R8yAH1plAH:+DqPoBhznAEdhvxWa9P593R8yAVp2H
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (3230) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 3 IoCs
pid Process 2592 mssecsvc.exe 2812 mssecsvc.exe 2824 tasksche.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvc.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\WINDOWS\mssecsvc.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvc.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mssecsvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mssecsvc.exe -
Modifies data under HKEY_USERS 24 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00e3000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fa-b1-95-16-e0-5f mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1D057474-4909-49C6-86B8-2F74CD0B855B}\fa-b1-95-16-e0-5f mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fa-b1-95-16-e0-5f\WpadDecisionReason = "1" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1D057474-4909-49C6-86B8-2F74CD0B855B}\WpadDecision = "0" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1D057474-4909-49C6-86B8-2F74CD0B855B}\WpadNetworkName = "Network 3" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fa-b1-95-16-e0-5f\WpadDecisionTime = e0162b90f20adb01 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fa-b1-95-16-e0-5f\WpadDecision = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1D057474-4909-49C6-86B8-2F74CD0B855B} mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1D057474-4909-49C6-86B8-2F74CD0B855B}\WpadDecisionReason = "1" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1D057474-4909-49C6-86B8-2F74CD0B855B}\WpadDecisionTime = e0162b90f20adb01 mssecsvc.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1672 wrote to memory of 2840 1672 rundll32.exe 28 PID 1672 wrote to memory of 2840 1672 rundll32.exe 28 PID 1672 wrote to memory of 2840 1672 rundll32.exe 28 PID 1672 wrote to memory of 2840 1672 rundll32.exe 28 PID 1672 wrote to memory of 2840 1672 rundll32.exe 28 PID 1672 wrote to memory of 2840 1672 rundll32.exe 28 PID 1672 wrote to memory of 2840 1672 rundll32.exe 28 PID 2840 wrote to memory of 2592 2840 rundll32.exe 29 PID 2840 wrote to memory of 2592 2840 rundll32.exe 29 PID 2840 wrote to memory of 2592 2840 rundll32.exe 29 PID 2840 wrote to memory of 2592 2840 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ec778b5a1be5dfb4ae454bd66d62863a_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ec778b5a1be5dfb4ae454bd66d62863a_JaffaCakes118.dll,#12⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2592 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i4⤵
- Executes dropped EXE
PID:2824
-
-
-
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2812
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.6MB
MD5fcbf99f853fe31118e12eddc988f3a4e
SHA181c20bf094c7fc9d9da32056cce68d73c1c62746
SHA256a48cc247fea29c2cce38400203fd179b80c19d146387a66716c43a6bd60073ae
SHA51254be12aaeaea3703efa612162186c9d7e52ffe7152120974960eae86dd5614cac9e4a9d5eee79568b5d96ba7cff79db588905f8aa4aa1db306bc6de81c2f3faa
-
Filesize
3.4MB
MD5dc0ec02114c53390db161f46c24b5659
SHA197bd4879b4417c862da272f7bcc724509876c19f
SHA256452820fbae20865840adaf6627969019dc377a0a45c762f0df21f682c7a95f07
SHA512b01460cd88ad6c9612fb5f5c48e03c4bc840b9a2f021314a4d5609fb488c79c6285a9d3376883b90f39f9e414d1f9113030008bd226e41037940800353967f54