Resubmissions
13-10-2024 13:51
241013-q5sywavamk 1007-10-2024 18:21
241007-wzlv9svdrf 1028-09-2024 13:59
240928-rawa7asbmd 1028-09-2024 08:37
240928-kjcrwayfnd 10Analysis
-
max time kernel
1800s -
max time network
1800s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28-09-2024 13:59
Static task
static1
Behavioral task
behavioral1
Sample
fbe91e0cbe5875ec547e4f8dc7737848_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fbe91e0cbe5875ec547e4f8dc7737848_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
fbe91e0cbe5875ec547e4f8dc7737848_JaffaCakes118.dll
-
Size
5.0MB
-
MD5
fbe91e0cbe5875ec547e4f8dc7737848
-
SHA1
5e2da4e5dc9acd6bb22599a9c1c1f6f7dec4973b
-
SHA256
0b689b231001383b2bb147c21580efe41c85ffd2666c12f4880e3991f6e836cc
-
SHA512
b7c8ffbf7875c768e866d596a322755cf9aec46d8b643b6bbbc2b4413abf591ffe9811442954c5891c3b2bc26f801c4f48cebf8f5702bb7c49d58a2051b0b2e8
-
SSDEEP
49152:enAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAAZ0vZ6GIk:KDqPoBhz1aRxcSUDk36SAc0B6GIk
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (35398) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 2 IoCs
pid Process 2380 mssecsvc.exe 2780 mssecsvc.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvc.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\WINDOWS\mssecsvc.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvc.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mssecsvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mssecsvc.exe -
Modifies data under HKEY_USERS 24 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{584496BF-2BDD-4242-A91B-39026B259F8A} mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{584496BF-2BDD-4242-A91B-39026B259F8A}\WpadDecisionReason = "1" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{584496BF-2BDD-4242-A91B-39026B259F8A}\WpadDecisionTime = 90a40297b111db01 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{584496BF-2BDD-4242-A91B-39026B259F8A}\f2-54-0e-90-a8-73 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{584496BF-2BDD-4242-A91B-39026B259F8A}\WpadNetworkName = "Network 3" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\f2-54-0e-90-a8-73\WpadDecisionReason = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\f2-54-0e-90-a8-73\WpadDecision = "0" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00bb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{584496BF-2BDD-4242-A91B-39026B259F8A}\WpadDecision = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\f2-54-0e-90-a8-73 mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\f2-54-0e-90-a8-73\WpadDecisionTime = 90a40297b111db01 mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mssecsvc.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2380 mssecsvc.exe 2780 mssecsvc.exe -
Suspicious behavior: MapViewOfSection 47 IoCs
pid Process 2380 mssecsvc.exe 2380 mssecsvc.exe 2380 mssecsvc.exe 2380 mssecsvc.exe 2380 mssecsvc.exe 2380 mssecsvc.exe 2380 mssecsvc.exe 2380 mssecsvc.exe 2380 mssecsvc.exe 2380 mssecsvc.exe 2380 mssecsvc.exe 2380 mssecsvc.exe 2380 mssecsvc.exe 2380 mssecsvc.exe 2380 mssecsvc.exe 2380 mssecsvc.exe 2380 mssecsvc.exe 2380 mssecsvc.exe 2380 mssecsvc.exe 2380 mssecsvc.exe 2380 mssecsvc.exe 2380 mssecsvc.exe 2380 mssecsvc.exe 2780 mssecsvc.exe 2780 mssecsvc.exe 2780 mssecsvc.exe 2780 mssecsvc.exe 2780 mssecsvc.exe 2780 mssecsvc.exe 2780 mssecsvc.exe 2780 mssecsvc.exe 2780 mssecsvc.exe 2780 mssecsvc.exe 2780 mssecsvc.exe 2780 mssecsvc.exe 2780 mssecsvc.exe 2780 mssecsvc.exe 2780 mssecsvc.exe 2780 mssecsvc.exe 2780 mssecsvc.exe 2780 mssecsvc.exe 2780 mssecsvc.exe 2780 mssecsvc.exe 2780 mssecsvc.exe 2780 mssecsvc.exe 2780 mssecsvc.exe 2780 mssecsvc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2380 mssecsvc.exe Token: SeDebugPrivilege 2780 mssecsvc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3068 wrote to memory of 1736 3068 rundll32.exe 30 PID 3068 wrote to memory of 1736 3068 rundll32.exe 30 PID 3068 wrote to memory of 1736 3068 rundll32.exe 30 PID 3068 wrote to memory of 1736 3068 rundll32.exe 30 PID 3068 wrote to memory of 1736 3068 rundll32.exe 30 PID 3068 wrote to memory of 1736 3068 rundll32.exe 30 PID 3068 wrote to memory of 1736 3068 rundll32.exe 30 PID 1736 wrote to memory of 2380 1736 rundll32.exe 31 PID 1736 wrote to memory of 2380 1736 rundll32.exe 31 PID 1736 wrote to memory of 2380 1736 rundll32.exe 31 PID 1736 wrote to memory of 2380 1736 rundll32.exe 31 PID 2380 wrote to memory of 384 2380 mssecsvc.exe 3 PID 2380 wrote to memory of 384 2380 mssecsvc.exe 3 PID 2380 wrote to memory of 384 2380 mssecsvc.exe 3 PID 2380 wrote to memory of 384 2380 mssecsvc.exe 3 PID 2380 wrote to memory of 384 2380 mssecsvc.exe 3 PID 2380 wrote to memory of 384 2380 mssecsvc.exe 3 PID 2380 wrote to memory of 384 2380 mssecsvc.exe 3 PID 2380 wrote to memory of 396 2380 mssecsvc.exe 4 PID 2380 wrote to memory of 396 2380 mssecsvc.exe 4 PID 2380 wrote to memory of 396 2380 mssecsvc.exe 4 PID 2380 wrote to memory of 396 2380 mssecsvc.exe 4 PID 2380 wrote to memory of 396 2380 mssecsvc.exe 4 PID 2380 wrote to memory of 396 2380 mssecsvc.exe 4 PID 2380 wrote to memory of 396 2380 mssecsvc.exe 4 PID 2380 wrote to memory of 432 2380 mssecsvc.exe 5 PID 2380 wrote to memory of 432 2380 mssecsvc.exe 5 PID 2380 wrote to memory of 432 2380 mssecsvc.exe 5 PID 2380 wrote to memory of 432 2380 mssecsvc.exe 5 PID 2380 wrote to memory of 432 2380 mssecsvc.exe 5 PID 2380 wrote to memory of 432 2380 mssecsvc.exe 5 PID 2380 wrote to memory of 432 2380 mssecsvc.exe 5 PID 2380 wrote to memory of 480 2380 mssecsvc.exe 6 PID 2380 wrote to memory of 480 2380 mssecsvc.exe 6 PID 2380 wrote to memory of 480 2380 mssecsvc.exe 6 PID 2380 wrote to memory of 480 2380 mssecsvc.exe 6 PID 2380 wrote to memory of 480 2380 mssecsvc.exe 6 PID 2380 wrote to memory of 480 2380 mssecsvc.exe 6 PID 2380 wrote to memory of 480 2380 mssecsvc.exe 6 PID 2380 wrote to memory of 488 2380 mssecsvc.exe 7 PID 2380 wrote to memory of 488 2380 mssecsvc.exe 7 PID 2380 wrote to memory of 488 2380 mssecsvc.exe 7 PID 2380 wrote to memory of 488 2380 mssecsvc.exe 7 PID 2380 wrote to memory of 488 2380 mssecsvc.exe 7 PID 2380 wrote to memory of 488 2380 mssecsvc.exe 7 PID 2380 wrote to memory of 488 2380 mssecsvc.exe 7 PID 2380 wrote to memory of 496 2380 mssecsvc.exe 8 PID 2380 wrote to memory of 496 2380 mssecsvc.exe 8 PID 2380 wrote to memory of 496 2380 mssecsvc.exe 8 PID 2380 wrote to memory of 496 2380 mssecsvc.exe 8 PID 2380 wrote to memory of 496 2380 mssecsvc.exe 8 PID 2380 wrote to memory of 496 2380 mssecsvc.exe 8 PID 2380 wrote to memory of 496 2380 mssecsvc.exe 8 PID 2380 wrote to memory of 592 2380 mssecsvc.exe 9 PID 2380 wrote to memory of 592 2380 mssecsvc.exe 9 PID 2380 wrote to memory of 592 2380 mssecsvc.exe 9 PID 2380 wrote to memory of 592 2380 mssecsvc.exe 9 PID 2380 wrote to memory of 592 2380 mssecsvc.exe 9 PID 2380 wrote to memory of 592 2380 mssecsvc.exe 9 PID 2380 wrote to memory of 592 2380 mssecsvc.exe 9 PID 2380 wrote to memory of 672 2380 mssecsvc.exe 10 PID 2380 wrote to memory of 672 2380 mssecsvc.exe 10 PID 2380 wrote to memory of 672 2380 mssecsvc.exe 10 PID 2380 wrote to memory of 672 2380 mssecsvc.exe 10
Processes
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:384
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵PID:480
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵PID:592
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe4⤵PID:1220
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵PID:1348
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵PID:672
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵PID:744
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵PID:796
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵PID:1164
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵PID:844
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵PID:952
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵PID:1016
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵PID:1004
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵PID:1060
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵PID:1100
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"3⤵PID:2008
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵PID:2264
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵PID:2460
-
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security3⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2780
-
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵PID:488
-
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:496
-
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:396
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:432
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1188
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fbe91e0cbe5875ec547e4f8dc7737848_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fbe91e0cbe5875ec547e4f8dc7737848_JaffaCakes118.dll,#13⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe4⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2380
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.6MB
MD5b2f2fc850ea25b02bfe431ed8c6bd410
SHA1638510f86036e6dc0131e4a708a3f2e35411e2ca
SHA25677f6052acc6348b35e3db64f5dd48e026cdcafdb6e55acb13d5bb040c731b80f
SHA512683ffce735dfff080f4a75b8892546361e93d66b98dfba8f1a1203419bdb6f112bc59d02bb39961032c6eb9388f6d8a4dc14406219f944893d383c44a5683eb3