Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25-09-2024 18:31
Static task
static1
Behavioral task
behavioral1
Sample
f69ccb45293a1c28f42e26ce999c12d2_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f69ccb45293a1c28f42e26ce999c12d2_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
f69ccb45293a1c28f42e26ce999c12d2_JaffaCakes118.dll
-
Size
5.0MB
-
MD5
f69ccb45293a1c28f42e26ce999c12d2
-
SHA1
6be9cdfed5f478cad4eb5cf8b4c98d05bfb88a07
-
SHA256
fcc262b6c98379426983a33fb85e7a3043dd5ec28d3c1fe5c6f4cd8f1e772db8
-
SHA512
58bae6a086d719f9c30f0e787a27013517d00a0e991d9c970bb264fbd68c7641201a06c2b2249caa4de64c64b25d4e8fb74d500bfc383b04e4a6ecdfbce3af85
-
SSDEEP
98304:+DqPoBhz1aRxOk36SAEdhvxWa9P593R8y:+DqPe1CxOk3ZAEUadzR8
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (3255) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 3 IoCs
pid Process 5040 mssecsvc.exe 3448 mssecsvc.exe 1228 tasksche.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\WINDOWS\mssecsvc.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvc.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mssecsvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mssecsvc.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2524 wrote to memory of 3052 2524 rundll32.exe 82 PID 2524 wrote to memory of 3052 2524 rundll32.exe 82 PID 2524 wrote to memory of 3052 2524 rundll32.exe 82 PID 3052 wrote to memory of 5040 3052 rundll32.exe 83 PID 3052 wrote to memory of 5040 3052 rundll32.exe 83 PID 3052 wrote to memory of 5040 3052 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f69ccb45293a1c28f42e26ce999c12d2_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f69ccb45293a1c28f42e26ce999c12d2_JaffaCakes118.dll,#12⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5040 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i4⤵
- Executes dropped EXE
PID:1228
-
-
-
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:3448
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.6MB
MD5e8362f45294c12421a27db03ca54c8ec
SHA187af38da1cdfe335f8c846f34f5ba6c107fc96b4
SHA25682f6d8201d663d8f80138260ae9f91b3109de13c9192da0aabdc89abec9f2359
SHA512aa6aad31c7d4581b67241d1758d22f6224ecdcfeaf28d73d120e682bf3c90b5191dd78cab61fe9d9afdaae956211722478a11be337c9336475ce3d77a1e842f5
-
Filesize
3.4MB
MD5ba9ee884d723912626cbe205ca0429e7
SHA10d1d682f36b7d9e5ee7479b8c98658360f29be1b
SHA256ac6c36bbab92f60e6191238501679a66f21e74c836bc9f74fa776ba334bc2815
SHA5124f00708288d1de348864f4ae1abf3a6d1f991595dff405c02a636c581476dd7c3483f66fad36ee0d6d4576850a9c49eb240f4d165ecc822f30e072dae8d0c2eb