Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
15-05-2021 12:47
Static task
static1
Behavioral task
behavioral1
Sample
d8ba498e048da8aebc87acca0f5a3ff6252f0b378d63cb00c996b59f17fd96bc.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
d8ba498e048da8aebc87acca0f5a3ff6252f0b378d63cb00c996b59f17fd96bc.exe
Resource
win10v20210410
General
-
Target
d8ba498e048da8aebc87acca0f5a3ff6252f0b378d63cb00c996b59f17fd96bc.exe
-
Size
101KB
-
MD5
ad8e8961f4300df833dc805049ad5e17
-
SHA1
0c67135befbc2dc3c7e8af5bdb6e8a4dbb3c4bb3
-
SHA256
d8ba498e048da8aebc87acca0f5a3ff6252f0b378d63cb00c996b59f17fd96bc
-
SHA512
c9a98bcc1391ba1423164fc319dc2d71f82eff56f552175a66919ac2563975f5346c1fe9500b6195d16295309f11cce155ccdf6ea46e324460cc5e9eef035777
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Drops file in System32 directory 3 IoCs
Processes:
mssecsvc.exemssecsvc.exemssecsvc.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvc.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvc.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvc.exe -
Drops file in Windows directory 3 IoCs
Processes:
mssecsvc.exemssecsvc.exedescription ioc process File created C:\WINDOWS\tasksche.exe mssecsvc.exe File opened for modification C:\WINDOWS\TASKSCHE.EXE mssecsvc.exe File created C:\WINDOWS\tasksche.exe mssecsvc.exe -
Modifies data under HKEY_USERS 47 IoCs
Processes:
mssecsvc.exemssecsvc.exemssecsvc.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionTime = 10e2a6eac949d701 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a070022000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionReason = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\32-e2-17-db-d2-77 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000003000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecisionReason = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecision = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a070022000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadNetworkName = "Network" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecision = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32} mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecisionTime = 10e2a6eac949d701 mssecsvc.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
mssecsvc.exemssecsvc.exepid process 2012 mssecsvc.exe 1632 mssecsvc.exe -
Suspicious behavior: MapViewOfSection 43 IoCs
Processes:
mssecsvc.exemssecsvc.exepid process 2012 mssecsvc.exe 2012 mssecsvc.exe 2012 mssecsvc.exe 2012 mssecsvc.exe 2012 mssecsvc.exe 2012 mssecsvc.exe 2012 mssecsvc.exe 2012 mssecsvc.exe 2012 mssecsvc.exe 2012 mssecsvc.exe 2012 mssecsvc.exe 2012 mssecsvc.exe 2012 mssecsvc.exe 2012 mssecsvc.exe 2012 mssecsvc.exe 2012 mssecsvc.exe 2012 mssecsvc.exe 2012 mssecsvc.exe 2012 mssecsvc.exe 2012 mssecsvc.exe 2012 mssecsvc.exe 1632 mssecsvc.exe 1632 mssecsvc.exe 1632 mssecsvc.exe 1632 mssecsvc.exe 1632 mssecsvc.exe 1632 mssecsvc.exe 1632 mssecsvc.exe 1632 mssecsvc.exe 1632 mssecsvc.exe 1632 mssecsvc.exe 1632 mssecsvc.exe 1632 mssecsvc.exe 1632 mssecsvc.exe 1632 mssecsvc.exe 1632 mssecsvc.exe 1632 mssecsvc.exe 1632 mssecsvc.exe 1632 mssecsvc.exe 1632 mssecsvc.exe 1632 mssecsvc.exe 1632 mssecsvc.exe 1632 mssecsvc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
mssecsvc.exemssecsvc.exedescription pid process Token: SeDebugPrivilege 2012 mssecsvc.exe Token: SeDebugPrivilege 1632 mssecsvc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
mssecsvc.exedescription pid process target process PID 2012 wrote to memory of 376 2012 mssecsvc.exe wininit.exe PID 2012 wrote to memory of 376 2012 mssecsvc.exe wininit.exe PID 2012 wrote to memory of 376 2012 mssecsvc.exe wininit.exe PID 2012 wrote to memory of 376 2012 mssecsvc.exe wininit.exe PID 2012 wrote to memory of 376 2012 mssecsvc.exe wininit.exe PID 2012 wrote to memory of 376 2012 mssecsvc.exe wininit.exe PID 2012 wrote to memory of 376 2012 mssecsvc.exe wininit.exe PID 2012 wrote to memory of 384 2012 mssecsvc.exe csrss.exe PID 2012 wrote to memory of 384 2012 mssecsvc.exe csrss.exe PID 2012 wrote to memory of 384 2012 mssecsvc.exe csrss.exe PID 2012 wrote to memory of 384 2012 mssecsvc.exe csrss.exe PID 2012 wrote to memory of 384 2012 mssecsvc.exe csrss.exe PID 2012 wrote to memory of 384 2012 mssecsvc.exe csrss.exe PID 2012 wrote to memory of 384 2012 mssecsvc.exe csrss.exe PID 2012 wrote to memory of 424 2012 mssecsvc.exe winlogon.exe PID 2012 wrote to memory of 424 2012 mssecsvc.exe winlogon.exe PID 2012 wrote to memory of 424 2012 mssecsvc.exe winlogon.exe PID 2012 wrote to memory of 424 2012 mssecsvc.exe winlogon.exe PID 2012 wrote to memory of 424 2012 mssecsvc.exe winlogon.exe PID 2012 wrote to memory of 424 2012 mssecsvc.exe winlogon.exe PID 2012 wrote to memory of 424 2012 mssecsvc.exe winlogon.exe PID 2012 wrote to memory of 472 2012 mssecsvc.exe services.exe PID 2012 wrote to memory of 472 2012 mssecsvc.exe services.exe PID 2012 wrote to memory of 472 2012 mssecsvc.exe services.exe PID 2012 wrote to memory of 472 2012 mssecsvc.exe services.exe PID 2012 wrote to memory of 472 2012 mssecsvc.exe services.exe PID 2012 wrote to memory of 472 2012 mssecsvc.exe services.exe PID 2012 wrote to memory of 472 2012 mssecsvc.exe services.exe PID 2012 wrote to memory of 480 2012 mssecsvc.exe lsass.exe PID 2012 wrote to memory of 480 2012 mssecsvc.exe lsass.exe PID 2012 wrote to memory of 480 2012 mssecsvc.exe lsass.exe PID 2012 wrote to memory of 480 2012 mssecsvc.exe lsass.exe PID 2012 wrote to memory of 480 2012 mssecsvc.exe lsass.exe PID 2012 wrote to memory of 480 2012 mssecsvc.exe lsass.exe PID 2012 wrote to memory of 480 2012 mssecsvc.exe lsass.exe PID 2012 wrote to memory of 488 2012 mssecsvc.exe lsm.exe PID 2012 wrote to memory of 488 2012 mssecsvc.exe lsm.exe PID 2012 wrote to memory of 488 2012 mssecsvc.exe lsm.exe PID 2012 wrote to memory of 488 2012 mssecsvc.exe lsm.exe PID 2012 wrote to memory of 488 2012 mssecsvc.exe lsm.exe PID 2012 wrote to memory of 488 2012 mssecsvc.exe lsm.exe PID 2012 wrote to memory of 488 2012 mssecsvc.exe lsm.exe PID 2012 wrote to memory of 588 2012 mssecsvc.exe svchost.exe PID 2012 wrote to memory of 588 2012 mssecsvc.exe svchost.exe PID 2012 wrote to memory of 588 2012 mssecsvc.exe svchost.exe PID 2012 wrote to memory of 588 2012 mssecsvc.exe svchost.exe PID 2012 wrote to memory of 588 2012 mssecsvc.exe svchost.exe PID 2012 wrote to memory of 588 2012 mssecsvc.exe svchost.exe PID 2012 wrote to memory of 588 2012 mssecsvc.exe svchost.exe PID 2012 wrote to memory of 668 2012 mssecsvc.exe svchost.exe PID 2012 wrote to memory of 668 2012 mssecsvc.exe svchost.exe PID 2012 wrote to memory of 668 2012 mssecsvc.exe svchost.exe PID 2012 wrote to memory of 668 2012 mssecsvc.exe svchost.exe PID 2012 wrote to memory of 668 2012 mssecsvc.exe svchost.exe PID 2012 wrote to memory of 668 2012 mssecsvc.exe svchost.exe PID 2012 wrote to memory of 668 2012 mssecsvc.exe svchost.exe PID 2012 wrote to memory of 744 2012 mssecsvc.exe svchost.exe PID 2012 wrote to memory of 744 2012 mssecsvc.exe svchost.exe PID 2012 wrote to memory of 744 2012 mssecsvc.exe svchost.exe PID 2012 wrote to memory of 744 2012 mssecsvc.exe svchost.exe PID 2012 wrote to memory of 744 2012 mssecsvc.exe svchost.exe PID 2012 wrote to memory of 744 2012 mssecsvc.exe svchost.exe PID 2012 wrote to memory of 744 2012 mssecsvc.exe svchost.exe PID 2012 wrote to memory of 808 2012 mssecsvc.exe svchost.exe
Processes
-
C:\Windows\system32\wininit.exewininit.exe1⤵
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding4⤵
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe3⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe3⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\d8ba498e048da8aebc87acca0f5a3ff6252f0b378d63cb00c996b59f17fd96bc.exe"C:\Users\Admin\AppData\Local\Temp\d8ba498e048da8aebc87acca0f5a3ff6252f0b378d63cb00c996b59f17fd96bc.exe"2⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\WINDOWS\TASKSCHE.EXEMD5
8499bd60a2ed89fb036d124fa5062c00
SHA1148a30623f08c4f905e0ea30e9d41e20d0f1a981
SHA25636a952a5ab46bd1304eee6b0e82b2348cda2967dab4080e3e0b44da94d2cef60
SHA512bff0a6d95c603ba5a55f499d66f4db1acf3d7e0ca36f9b9120e0efcc9d077ac5b5d27676a1d37d6f5eebc68d3af98c3125a1489ea9b57187a0ba8914578854e1
-
memory/804-65-0x000000007EF20000-0x000000007EF2C000-memory.dmpFilesize
48KB
-
memory/2032-60-0x0000000076281000-0x0000000076283000-memory.dmpFilesize
8KB