Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-09-2024 15:09

General

  • Target

    f243a973f9541a3e3ac562b623e378b2_JaffaCakes118.exe

  • Size

    3.6MB

  • MD5

    f243a973f9541a3e3ac562b623e378b2

  • SHA1

    8ac13a8f203100168d3c8069d79a0a8697e08886

  • SHA256

    a4975dd0b874dfe6cd94e148942d44bdca500d8aa68cc707c24d48722924ee50

  • SHA512

    8a6111a0cd88758cd85e340de529af51e05f51824e0f7fda881880c9dfebe8c16d9ae76a7469adc65f038fa0467135b2ddc13a1daa76c003716cd6c0dddab6b2

  • SSDEEP

    98304:yDqPoBgxcSUj6SAEdhvxWa9P593o8yAVp2HI:yDqPPxcpZAEUadzo8yc4HI

Malware Config

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

  • Contacts a large (3271) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Executes dropped EXE 1 IoCs
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f243a973f9541a3e3ac562b623e378b2_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f243a973f9541a3e3ac562b623e378b2_JaffaCakes118.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    PID:4748
    • C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      2⤵
      • Executes dropped EXE
      PID:2540
  • C:\Users\Admin\AppData\Local\Temp\f243a973f9541a3e3ac562b623e378b2_JaffaCakes118.exe
    C:\Users\Admin\AppData\Local\Temp\f243a973f9541a3e3ac562b623e378b2_JaffaCakes118.exe -m security
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    PID:4112

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\tasksche.exe

    Filesize

    3.4MB

    MD5

    e11f32869e10c3881f7e3c1be4c07c30

    SHA1

    324aa6f58651e7ed0219d57aa0422413bc63dd1a

    SHA256

    cc16cc52d6ce6de739129f43c2efcbda97cc37a997929061d4bc9b969e54e632

    SHA512

    0b85ac254bbca4830ea2d28fe153c1c730d3d94c277ace2fb75cf413a913b26d9c26301303a36fee80ce16e354327ba9407a1171151cd1f2addfc263ef8bd1e4