Analysis
-
max time kernel
92s -
max time network
97s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-09-2024 15:38
Static task
static1
Behavioral task
behavioral1
Sample
f628c136739115e54ac5d385627b9869_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f628c136739115e54ac5d385627b9869_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
f628c136739115e54ac5d385627b9869_JaffaCakes118.dll
-
Size
5.0MB
-
MD5
f628c136739115e54ac5d385627b9869
-
SHA1
51e5a1122bf3e6585b8a90feca752bb83b4ad198
-
SHA256
0b10cf5deb1a32890775e64ed3e744741f2f61e183710c2424dea87c2d76ee4d
-
SHA512
16b2e97288aacdabadaa7e4fa599037c69f8c44ce19ad40aa6f230d733bee1f5afd0d62c5d607e780b0faa96be23ffeb2fe0cb5af82d623bc666fbd1269733d1
-
SSDEEP
12288:yvbLgPlu+QhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+DHeQYSUjEXFG:SbLgddQhfdmMSirYbcMNgef0QeQjG
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (1636) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 3 IoCs
pid Process 2096 mssecsvc.exe 2668 mssecsvc.exe 2312 tasksche.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvc.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\WINDOWS\mssecsvc.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvc.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mssecsvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mssecsvc.exe -
Modifies data under HKEY_USERS 24 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a6-32-ac-56-50-0d\WpadDecisionReason = "1" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{34FBA8D4-BCE8-4A6A-8562-7FB965AC192F} mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{34FBA8D4-BCE8-4A6A-8562-7FB965AC192F}\WpadDecisionReason = "1" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{34FBA8D4-BCE8-4A6A-8562-7FB965AC192F}\WpadNetworkName = "Network 3" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a6-32-ac-56-50-0d\WpadDecision = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00cd000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{34FBA8D4-BCE8-4A6A-8562-7FB965AC192F}\WpadDecisionTime = 10ce2315610fdb01 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{34FBA8D4-BCE8-4A6A-8562-7FB965AC192F}\WpadDecision = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a6-32-ac-56-50-0d mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a6-32-ac-56-50-0d\WpadDecisionTime = 10ce2315610fdb01 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{34FBA8D4-BCE8-4A6A-8562-7FB965AC192F}\a6-32-ac-56-50-0d mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: 33 2612 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2612 AUDIODG.EXE Token: 33 2612 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2612 AUDIODG.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2124 wrote to memory of 3064 2124 rundll32.exe 30 PID 2124 wrote to memory of 3064 2124 rundll32.exe 30 PID 2124 wrote to memory of 3064 2124 rundll32.exe 30 PID 2124 wrote to memory of 3064 2124 rundll32.exe 30 PID 2124 wrote to memory of 3064 2124 rundll32.exe 30 PID 2124 wrote to memory of 3064 2124 rundll32.exe 30 PID 2124 wrote to memory of 3064 2124 rundll32.exe 30 PID 3064 wrote to memory of 2096 3064 rundll32.exe 31 PID 3064 wrote to memory of 2096 3064 rundll32.exe 31 PID 3064 wrote to memory of 2096 3064 rundll32.exe 31 PID 3064 wrote to memory of 2096 3064 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f628c136739115e54ac5d385627b9869_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f628c136739115e54ac5d385627b9869_JaffaCakes118.dll,#12⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2096 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i4⤵
- Executes dropped EXE
PID:2312
-
-
-
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2668
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:1528
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0xc41⤵
- Suspicious use of AdjustPrivilegeToken
PID:2612
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.6MB
MD58ba2d290793bf4790e153f526af622c8
SHA1e14c5e00a8a6e9f2cc50ac7593e5474de72d9c39
SHA2569da1e7b1ec53d8144fa5bfe420bac4cc958f0312096f6ef63ed6559b7802caf5
SHA51231eb440b050b0f2720762501e322f0e85612ef41ffbc8dee16fc368b6d21c74d3d408f42d1d5962b1790307439ce1e2c4d83ce96877f377e1b7a503df85ade9c
-
Filesize
3.4MB
MD5ca4b69cf8a955f50eb24e4808d40136b
SHA1c528d92fef539c0420676c9fdf0551c365bdf1b1
SHA256b88f43e788bb21eea3ddf59efecf95c9c1b8b519b54ff8492117b7166dc988ed
SHA5120538223d170c4fb3dab490d75d88c91c589fe1d8151dfee6f938e867966ec96d3e7bb89734c54bb36d1da5fc8ed4872253ff8da720456ecd6e5d72e1a36628e4