Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    26-09-2024 05:43

General

  • Target

    f7b1bd2aa9ce09a273243560db7bad8a_JaffaCakes118.dll

  • Size

    5.0MB

  • MD5

    f7b1bd2aa9ce09a273243560db7bad8a

  • SHA1

    2d682b3a9bf4d09d8d2fa3986cae4a194764a273

  • SHA256

    67e6c96d995da1cf7052d9c27ac740c5b42fc5982b79f53ceb201b0a8f894663

  • SHA512

    ab4127003fddd41abb8b50f1737b3a1552f7932724bab6d9d1c30ac1aec500b801a72873f4160c421abe7da60e60d4275dffdcf68aa583ec73abb57df082bee1

  • SSDEEP

    49152:RnpEKUvxcBVQej/1INRx+TSqTdX1HkQo6SAARdhnv:1pyvOBhz1aRxcSUDk36SAEdhv

Malware Config

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

  • Contacts a large (3272) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Executes dropped EXE 3 IoCs
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Drops file in System32 directory 5 IoCs
  • Drops file in Windows directory 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 24 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\f7b1bd2aa9ce09a273243560db7bad8a_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1272
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\f7b1bd2aa9ce09a273243560db7bad8a_JaffaCakes118.dll,#1
      2⤵
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2188
      • C:\WINDOWS\mssecsvr.exe
        C:\WINDOWS\mssecsvr.exe
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2360
        • C:\WINDOWS\tasksche.exe
          C:\WINDOWS\tasksche.exe /i
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: GetForegroundWindowSpam
          PID:2712
  • C:\WINDOWS\mssecsvr.exe
    C:\WINDOWS\mssecsvr.exe -m security
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    PID:2184

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\WINDOWS\tasksche.exe

    Filesize

    2.0MB

    MD5

    c4640e5a8a68c8aa313e8127a1d797ed

    SHA1

    3fa7396d3bf4a070f426a5ac2d3928cff2dc3eaf

    SHA256

    3d5891d7cd3c675aa40d8671866375750385ad58bf75bfc386954c3aab4ea241

    SHA512

    0a1b1057ff7dcdfee7f86142617b2ef230f53c964c9423c48e347dcf21c8a4186ed10d1dfe1a90cbde321adf4da51865205e47800d9e59d0c1dc8db76bd3ef1c

  • C:\Windows\mssecsvr.exe

    Filesize

    2.2MB

    MD5

    d61fdd87eaac262a8a77080ee54edb46

    SHA1

    121b1edae817d516515080d8c06225f34b1fce04

    SHA256

    2777e4e00f60f7fc101c3181c782a83ec306425ce7d9e72c6e42fde2a4247168

    SHA512

    6c520701fb7eb28e9417507f9426f2dabbd624009df8dcfab8b624b13b8041a5b88ed62fb99321ebeb2fe8c35746e541d1b88f10597d384e58f4f1811dbb05ba