Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
20-09-2024 00:17
Static task
static1
Behavioral task
behavioral1
Sample
ec778b5a1be5dfb4ae454bd66d62863a_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ec778b5a1be5dfb4ae454bd66d62863a_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
ec778b5a1be5dfb4ae454bd66d62863a_JaffaCakes118.dll
-
Size
5.0MB
-
MD5
ec778b5a1be5dfb4ae454bd66d62863a
-
SHA1
8022e9050016e76682479701336585312a137a59
-
SHA256
24eb185b918fdc840b44b8c3a8cfcac21660359182edbf6cf9afa4cc7fbb3539
-
SHA512
7af40e7f8d28fddf9826917ac61d0827dbef37dba6ca4544dfb38f28082b7cad30919f33890582b64730fa0cf930f56bf66c434b62d89316e49b1074af67ec2c
-
SSDEEP
49152:SnAQqMSPbcBVQej/nAARdhnvxJM0H9PAMEcaEau3R8yAH1plAH:+DqPoBhznAEdhvxWa9P593R8yAVp2H
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (3286) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 3 IoCs
pid Process 4620 mssecsvc.exe 1784 mssecsvc.exe 1684 tasksche.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\WINDOWS\mssecsvc.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvc.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mssecsvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mssecsvc.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" mssecsvc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 644 wrote to memory of 1360 644 rundll32.exe 82 PID 644 wrote to memory of 1360 644 rundll32.exe 82 PID 644 wrote to memory of 1360 644 rundll32.exe 82 PID 1360 wrote to memory of 4620 1360 rundll32.exe 83 PID 1360 wrote to memory of 4620 1360 rundll32.exe 83 PID 1360 wrote to memory of 4620 1360 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ec778b5a1be5dfb4ae454bd66d62863a_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ec778b5a1be5dfb4ae454bd66d62863a_JaffaCakes118.dll,#12⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4620 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i4⤵
- Executes dropped EXE
PID:1684
-
-
-
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1784
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.6MB
MD5fcbf99f853fe31118e12eddc988f3a4e
SHA181c20bf094c7fc9d9da32056cce68d73c1c62746
SHA256a48cc247fea29c2cce38400203fd179b80c19d146387a66716c43a6bd60073ae
SHA51254be12aaeaea3703efa612162186c9d7e52ffe7152120974960eae86dd5614cac9e4a9d5eee79568b5d96ba7cff79db588905f8aa4aa1db306bc6de81c2f3faa
-
Filesize
3.4MB
MD5dc0ec02114c53390db161f46c24b5659
SHA197bd4879b4417c862da272f7bcc724509876c19f
SHA256452820fbae20865840adaf6627969019dc377a0a45c762f0df21f682c7a95f07
SHA512b01460cd88ad6c9612fb5f5c48e03c4bc840b9a2f021314a4d5609fb488c79c6285a9d3376883b90f39f9e414d1f9113030008bd226e41037940800353967f54