Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-09-2024 18:18
Static task
static1
Behavioral task
behavioral1
Sample
f69727c7954b659d040a3e236ce1701c_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f69727c7954b659d040a3e236ce1701c_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
f69727c7954b659d040a3e236ce1701c_JaffaCakes118.dll
-
Size
5.0MB
-
MD5
f69727c7954b659d040a3e236ce1701c
-
SHA1
125d04e7460508f8ed184ab686eeddb97ff97b78
-
SHA256
7a65805ba79f2a25cf82d07f10f04d2a83bd533141c9f5eec737fff3735655dc
-
SHA512
74f9e71e7b52ccfa3da7a68939e24a5df0e51da3863ae3fc068039a9f307775f6e1e922fc017e07f1a220f45ab08c7ba3bed8ece549d571c1474efe810e7152d
-
SSDEEP
49152:SnAQqMSPbcBVAx+TSqTd5AARdhnvxJM0H9x:+DqPoBuxcSUTAEdhvxWa9x
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (3068) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 3 IoCs
pid Process 1416 mssecsvc.exe 2304 mssecsvc.exe 2096 tasksche.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvc.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\WINDOWS\mssecsvc.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvc.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mssecsvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mssecsvc.exe -
Modifies data under HKEY_USERS 24 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{91DCB10D-02F0-4FAA-9DE1-5F5E3625B9F5}\WpadDecisionReason = "1" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{91DCB10D-02F0-4FAA-9DE1-5F5E3625B9F5}\WpadDecisionTime = 00622e57770fdb01 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{91DCB10D-02F0-4FAA-9DE1-5F5E3625B9F5}\WpadDecision = "0" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3a-98-81-79-bb-64\WpadDecisionReason = "1" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3a-98-81-79-bb-64\WpadDecision = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3a-98-81-79-bb-64 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{91DCB10D-02F0-4FAA-9DE1-5F5E3625B9F5}\3a-98-81-79-bb-64 mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3a-98-81-79-bb-64\WpadDecisionTime = 00622e57770fdb01 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00dc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{91DCB10D-02F0-4FAA-9DE1-5F5E3625B9F5} mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{91DCB10D-02F0-4FAA-9DE1-5F5E3625B9F5}\WpadNetworkName = "Network 3" mssecsvc.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2888 wrote to memory of 2000 2888 rundll32.exe 31 PID 2888 wrote to memory of 2000 2888 rundll32.exe 31 PID 2888 wrote to memory of 2000 2888 rundll32.exe 31 PID 2888 wrote to memory of 2000 2888 rundll32.exe 31 PID 2888 wrote to memory of 2000 2888 rundll32.exe 31 PID 2888 wrote to memory of 2000 2888 rundll32.exe 31 PID 2888 wrote to memory of 2000 2888 rundll32.exe 31 PID 2000 wrote to memory of 1416 2000 rundll32.exe 32 PID 2000 wrote to memory of 1416 2000 rundll32.exe 32 PID 2000 wrote to memory of 1416 2000 rundll32.exe 32 PID 2000 wrote to memory of 1416 2000 rundll32.exe 32
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f69727c7954b659d040a3e236ce1701c_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f69727c7954b659d040a3e236ce1701c_JaffaCakes118.dll,#12⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1416 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i4⤵
- Executes dropped EXE
PID:2096
-
-
-
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2304
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.6MB
MD545ab42d1fa8c478ed299064988c9c2e4
SHA18f537ba0ad6bd0b253b8faa930401503aab8c198
SHA256a649198d975e0929713010f545a65dcab838b9060278a47717bef74a88d6a8f8
SHA512a369741111512459570f871284dec7a49aa0910b9f1d6b65223b549df3a4db09f782b9435250fd0083bb235ba2b7e0013fa16587c876d8b56bc32dc3f4c56d60
-
Filesize
3.4MB
MD5d85f2e487982a4380d7f7921c3c39803
SHA183baf824c195e0520747d1f26d38972b1202c484
SHA25645aeec9df020a66cc2a7c441f6cc3ff7635e67fc6f70a7bc631af752ee15403a
SHA512691c8b4800895e9c3a0017dc9b255a98e76a91a02bd71a87230dc66cd7584455df0fe37d79c388b8e4967008c595ec281445e96fc9fa9ed7ea1d31f9f0425016