Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-09-2024 09:10
Static task
static1
Behavioral task
behavioral1
Sample
f5ac93d521cfd625d87b50b492a1ff77_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f5ac93d521cfd625d87b50b492a1ff77_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
f5ac93d521cfd625d87b50b492a1ff77_JaffaCakes118.dll
-
Size
5.0MB
-
MD5
f5ac93d521cfd625d87b50b492a1ff77
-
SHA1
25ff4dfa446ad77f0803515171346db172aec684
-
SHA256
e8b0cf1c2cbaa415e564afc05ce5db0e01ef1fcfb308a3e303a70482a6cced18
-
SHA512
eee683ce8fc0bb0aebc983534f29039b463424fbadce5936502d4e8609df4062343399bed2e3de96015d0f04cb99d02ae3d6a10d446b7241c9c46cfc6ea2cd1c
-
SSDEEP
49152:SnAQqMSPbcBVONRx+TSqTdX1HkQo6SAAR:+DqPoBeRxcSUDk36SAE
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (3244) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 3 IoCs
pid Process 2504 mssecsvc.exe 2096 mssecsvc.exe 2724 tasksche.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvc.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\WINDOWS\mssecsvc.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvc.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mssecsvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mssecsvc.exe -
Modifies data under HKEY_USERS 24 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0106000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-64-f9-ee-bc-af\WpadDecisionReason = "1" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-64-f9-ee-bc-af\WpadDecisionTime = 10eb87d42a0fdb01 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-64-f9-ee-bc-af\WpadDecision = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{44FA6569-2D62-418E-A107-1109C34CFD87}\WpadNetworkName = "Network 3" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{44FA6569-2D62-418E-A107-1109C34CFD87}\06-64-f9-ee-bc-af mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-64-f9-ee-bc-af mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{44FA6569-2D62-418E-A107-1109C34CFD87} mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{44FA6569-2D62-418E-A107-1109C34CFD87}\WpadDecisionReason = "1" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{44FA6569-2D62-418E-A107-1109C34CFD87}\WpadDecisionTime = 10eb87d42a0fdb01 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{44FA6569-2D62-418E-A107-1109C34CFD87}\WpadDecision = "0" mssecsvc.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3036 wrote to memory of 2500 3036 rundll32.exe 30 PID 3036 wrote to memory of 2500 3036 rundll32.exe 30 PID 3036 wrote to memory of 2500 3036 rundll32.exe 30 PID 3036 wrote to memory of 2500 3036 rundll32.exe 30 PID 3036 wrote to memory of 2500 3036 rundll32.exe 30 PID 3036 wrote to memory of 2500 3036 rundll32.exe 30 PID 3036 wrote to memory of 2500 3036 rundll32.exe 30 PID 2500 wrote to memory of 2504 2500 rundll32.exe 31 PID 2500 wrote to memory of 2504 2500 rundll32.exe 31 PID 2500 wrote to memory of 2504 2500 rundll32.exe 31 PID 2500 wrote to memory of 2504 2500 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f5ac93d521cfd625d87b50b492a1ff77_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f5ac93d521cfd625d87b50b492a1ff77_JaffaCakes118.dll,#12⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2504 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i4⤵
- Executes dropped EXE
PID:2724
-
-
-
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2096
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.6MB
MD5c55a841fb8f3cc45b1aee019f7171f13
SHA13fc6e608a3cfb2d9ae6b26ce5a3f73ebec49005a
SHA256fd8032cd34e8dd7b5e883caffd9d93f718e2f9967d09c98aafeb0827534ec9c8
SHA512b04923139898024f2fbdd20699f3ac70b6aed2451fcf1edea4691429bb583826f3183ac10030773069645f6930d13feca14a5ef7b397d65a857fe2845532b680
-
Filesize
3.4MB
MD5d959a0de68213cf8b146af398b839685
SHA1d4a43ce02a078e5b53a43b875c0d458de1b3fd4b
SHA256799876d844bb49622f63d5fbc7b40cfc521f07aed6e534d38a864c7b3ca7475e
SHA512eebf8d0aa625fae297aa6a223e30c8bcf2f39d5c7d28d4d6ff6f73b080d212d8f8be2dceba646d563b6e201b4e45cdba53e984ead472286c37dc24c5ce12fa98