Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
19-01-2021 10:20
Static task
static1
Behavioral task
behavioral1
Sample
00bc02b91a3850390e977e4b75f1f84f.dll
Resource
win7v20201028
Behavioral task
behavioral2
Sample
00bc02b91a3850390e977e4b75f1f84f.dll
Resource
win10v20201028
General
-
Target
00bc02b91a3850390e977e4b75f1f84f.dll
-
Size
5.0MB
-
MD5
00bc02b91a3850390e977e4b75f1f84f
-
SHA1
73240c616134f1830a0ab8dd565284d92e238333
-
SHA256
88489f32a5e8521eb18fc390aac403c729fccb579e5b23307ca487ec7c724ce1
-
SHA512
7baaf5578589f6881334868c1c7a4739a7e2294cef4967f10db20d9280dff2379b0977c6bec9d7c57b50df0e064a71d9df7be39ce48605a5c32b868e927667a5
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Executes dropped EXE 3 IoCs
Processes:
mssecsvc.exemssecsvc.exetasksche.exepid process 1952 mssecsvc.exe 1056 mssecsvc.exe 1744 tasksche.exe -
Drops file in System32 directory 3 IoCs
Processes:
mssecsvc.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvc.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\KTZWVBIC.txt mssecsvc.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\KTZWVBIC.txt mssecsvc.exe -
Drops file in Windows directory 2 IoCs
Processes:
rundll32.exemssecsvc.exedescription ioc process File created C:\WINDOWS\mssecsvc.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvc.exe -
Modifies data under HKEY_USERS 24 IoCs
Processes:
mssecsvc.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6CD91550-F1B8-44A7-B169-07A502AE3F35}\WpadDecisionReason = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecision = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a070019000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6CD91550-F1B8-44A7-B169-07A502AE3F35} mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6CD91550-F1B8-44A7-B169-07A502AE3F35}\32-e2-17-db-d2-77 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionReason = "1" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6CD91550-F1B8-44A7-B169-07A502AE3F35}\WpadDecisionTime = b0bf3fa955eed601 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6CD91550-F1B8-44A7-B169-07A502AE3F35}\WpadDecision = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6CD91550-F1B8-44A7-B169-07A502AE3F35}\WpadNetworkName = "Network" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77 mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionTime = b0bf3fa955eed601 mssecsvc.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1812 wrote to memory of 1300 1812 rundll32.exe rundll32.exe PID 1812 wrote to memory of 1300 1812 rundll32.exe rundll32.exe PID 1812 wrote to memory of 1300 1812 rundll32.exe rundll32.exe PID 1812 wrote to memory of 1300 1812 rundll32.exe rundll32.exe PID 1812 wrote to memory of 1300 1812 rundll32.exe rundll32.exe PID 1812 wrote to memory of 1300 1812 rundll32.exe rundll32.exe PID 1812 wrote to memory of 1300 1812 rundll32.exe rundll32.exe PID 1300 wrote to memory of 1952 1300 rundll32.exe mssecsvc.exe PID 1300 wrote to memory of 1952 1300 rundll32.exe mssecsvc.exe PID 1300 wrote to memory of 1952 1300 rundll32.exe mssecsvc.exe PID 1300 wrote to memory of 1952 1300 rundll32.exe mssecsvc.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\00bc02b91a3850390e977e4b75f1f84f.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\00bc02b91a3850390e977e4b75f1f84f.dll,#12⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i4⤵
- Executes dropped EXE
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\WINDOWS\mssecsvc.exeMD5
8d9a4207429d7e829dc91955a1694d7e
SHA107f3c64ff5c68b3eafa417dab76c989fc9fff171
SHA25617e5e0d52f4de23d3195ec2d93d366fefc7e59b6b20f71df12e7218313163da2
SHA51298c5d9fd1a665446e8a443ed8d60cb250924386ce2d24d7501ec3b2d292240122a8916af1860d5d689177f582890226286ed8f0ed4e8cec5db2d024d8a88d70b
-
C:\Windows\mssecsvc.exeMD5
8d9a4207429d7e829dc91955a1694d7e
SHA107f3c64ff5c68b3eafa417dab76c989fc9fff171
SHA25617e5e0d52f4de23d3195ec2d93d366fefc7e59b6b20f71df12e7218313163da2
SHA51298c5d9fd1a665446e8a443ed8d60cb250924386ce2d24d7501ec3b2d292240122a8916af1860d5d689177f582890226286ed8f0ed4e8cec5db2d024d8a88d70b
-
C:\Windows\mssecsvc.exeMD5
8d9a4207429d7e829dc91955a1694d7e
SHA107f3c64ff5c68b3eafa417dab76c989fc9fff171
SHA25617e5e0d52f4de23d3195ec2d93d366fefc7e59b6b20f71df12e7218313163da2
SHA51298c5d9fd1a665446e8a443ed8d60cb250924386ce2d24d7501ec3b2d292240122a8916af1860d5d689177f582890226286ed8f0ed4e8cec5db2d024d8a88d70b
-
C:\Windows\tasksche.exeMD5
741b6e8f838fd37cdf0431551432b0e7
SHA11a480f81cb2308c28b3eaee24e04ef133ff2e41e
SHA2563a4a89b71005c5233e592cc20d6fd06b21aeca3415554390e4365bb76eade469
SHA5120e12d88c40ee38d717a8501bf67f63885afef54328105f4337d59c516f5a3f562e4fa4f7ec54e9afffa04a402918699c33b8d2ccc76b8e5c60c76de4d0fd9cac
-
memory/1300-2-0x0000000000000000-mapping.dmp
-
memory/1300-3-0x0000000076241000-0x0000000076243000-memory.dmpFilesize
8KB
-
memory/1320-7-0x000007FEF79D0000-0x000007FEF7C4A000-memory.dmpFilesize
2.5MB
-
memory/1952-4-0x0000000000000000-mapping.dmp