Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-09-2024 00:20
Static task
static1
Behavioral task
behavioral1
Sample
f4c61f6ea4e00cafd9ef3a33f6a17d42_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f4c61f6ea4e00cafd9ef3a33f6a17d42_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
f4c61f6ea4e00cafd9ef3a33f6a17d42_JaffaCakes118.dll
-
Size
5.0MB
-
MD5
f4c61f6ea4e00cafd9ef3a33f6a17d42
-
SHA1
8dbd390e06813d07b45bbfa0522fcb1330621555
-
SHA256
9405991e0f5f39fbcf3689d954f58628d6bcd334517ff5ee53762e09b829d62e
-
SHA512
6af21efa6296b429bd1bb7a475433445f372cc80d03606b85cc180e1454f4fe7659ed1a791e305753b41af67751e65abac847f3eca7e580a34744f746df6273b
-
SSDEEP
24576:SbLgddQhfdmMSirYbcMNgef0QeQjG/D8kIqRYoAdB:SnAQqMSPbcBVQej/1I
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (3170) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 3 IoCs
pid Process 2864 mssecsvc.exe 2904 mssecsvc.exe 3060 tasksche.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvc.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\WINDOWS\mssecsvc.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvc.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mssecsvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mssecsvc.exe -
Modifies data under HKEY_USERS 24 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A22C4B30-6F5D-407C-8272-A65DCF8FAEC1}\WpadDecisionReason = "1" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A22C4B30-6F5D-407C-8272-A65DCF8FAEC1}\WpadNetworkName = "Network 3" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00d7000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A22C4B30-6F5D-407C-8272-A65DCF8FAEC1}\72-b9-79-40-7f-bc mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A22C4B30-6F5D-407C-8272-A65DCF8FAEC1}\WpadDecisionTime = 80d628b4e00edb01 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-b9-79-40-7f-bc mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-b9-79-40-7f-bc\WpadDecisionReason = "1" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-b9-79-40-7f-bc\WpadDecisionTime = 80d628b4e00edb01 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A22C4B30-6F5D-407C-8272-A65DCF8FAEC1} mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-b9-79-40-7f-bc\WpadDecision = "0" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A22C4B30-6F5D-407C-8272-A65DCF8FAEC1}\WpadDecision = "0" mssecsvc.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2716 wrote to memory of 2844 2716 rundll32.exe 30 PID 2716 wrote to memory of 2844 2716 rundll32.exe 30 PID 2716 wrote to memory of 2844 2716 rundll32.exe 30 PID 2716 wrote to memory of 2844 2716 rundll32.exe 30 PID 2716 wrote to memory of 2844 2716 rundll32.exe 30 PID 2716 wrote to memory of 2844 2716 rundll32.exe 30 PID 2716 wrote to memory of 2844 2716 rundll32.exe 30 PID 2844 wrote to memory of 2864 2844 rundll32.exe 31 PID 2844 wrote to memory of 2864 2844 rundll32.exe 31 PID 2844 wrote to memory of 2864 2844 rundll32.exe 31 PID 2844 wrote to memory of 2864 2844 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f4c61f6ea4e00cafd9ef3a33f6a17d42_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f4c61f6ea4e00cafd9ef3a33f6a17d42_JaffaCakes118.dll,#12⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2864 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i4⤵
- Executes dropped EXE
PID:3060
-
-
-
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2904
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.6MB
MD5de8a2931b1bee4eafeb895e3848fce31
SHA19be6fe451b0a5349917545f7d9fe081a75051496
SHA256f9a3bd6690c19f4e157d1a743eeed5069c6fbce97cdec42bef720721e3a245ae
SHA512c08a8c15ea352e0bcf5818f263e3c14b90a40d9b070f56e5d6e5632091a26ac6203cd6b5ee29da479cd8e042901ee26cc05d11465ec52f6f065c45652010780c
-
Filesize
3.4MB
MD598c0078c0f1b72ead86245127f34ae75
SHA190a54380efa874bd3c408c4dd9b9cc48632ee21d
SHA256837d963288c41c6b89ea8c56b55d8ab2a980c653830b112312edab54fe8de7cc
SHA5124a8c1511f5115c4b353c1cf8ac7b66e81d730da79912490756221feb843c89862f5639c397a3e5d70df4f442efa1855adf415e94fe740b549e5a8d3e7d751209