Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-09-2024 00:20

General

  • Target

    f4c61f6ea4e00cafd9ef3a33f6a17d42_JaffaCakes118.dll

  • Size

    5.0MB

  • MD5

    f4c61f6ea4e00cafd9ef3a33f6a17d42

  • SHA1

    8dbd390e06813d07b45bbfa0522fcb1330621555

  • SHA256

    9405991e0f5f39fbcf3689d954f58628d6bcd334517ff5ee53762e09b829d62e

  • SHA512

    6af21efa6296b429bd1bb7a475433445f372cc80d03606b85cc180e1454f4fe7659ed1a791e305753b41af67751e65abac847f3eca7e580a34744f746df6273b

  • SSDEEP

    24576:SbLgddQhfdmMSirYbcMNgef0QeQjG/D8kIqRYoAdB:SnAQqMSPbcBVQej/1I

Malware Config

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

  • Contacts a large (3265) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Executes dropped EXE 3 IoCs
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 5 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\f4c61f6ea4e00cafd9ef3a33f6a17d42_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5040
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\f4c61f6ea4e00cafd9ef3a33f6a17d42_JaffaCakes118.dll,#1
      2⤵
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2312
      • C:\WINDOWS\mssecsvc.exe
        C:\WINDOWS\mssecsvc.exe
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:808
        • C:\WINDOWS\tasksche.exe
          C:\WINDOWS\tasksche.exe /i
          4⤵
          • Executes dropped EXE
          PID:2676
  • C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe -m security
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    PID:3992

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\mssecsvc.exe

    Filesize

    3.6MB

    MD5

    de8a2931b1bee4eafeb895e3848fce31

    SHA1

    9be6fe451b0a5349917545f7d9fe081a75051496

    SHA256

    f9a3bd6690c19f4e157d1a743eeed5069c6fbce97cdec42bef720721e3a245ae

    SHA512

    c08a8c15ea352e0bcf5818f263e3c14b90a40d9b070f56e5d6e5632091a26ac6203cd6b5ee29da479cd8e042901ee26cc05d11465ec52f6f065c45652010780c

  • C:\Windows\tasksche.exe

    Filesize

    3.4MB

    MD5

    98c0078c0f1b72ead86245127f34ae75

    SHA1

    90a54380efa874bd3c408c4dd9b9cc48632ee21d

    SHA256

    837d963288c41c6b89ea8c56b55d8ab2a980c653830b112312edab54fe8de7cc

    SHA512

    4a8c1511f5115c4b353c1cf8ac7b66e81d730da79912490756221feb843c89862f5639c397a3e5d70df4f442efa1855adf415e94fe740b549e5a8d3e7d751209