Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
16-05-2021 05:42
Static task
static1
Behavioral task
behavioral1
Sample
3efcdb3cd177306f741832cfe8c0d2190d7182b566322c4a5fae83e71fbb3666.dll
Resource
win7v20210410
Behavioral task
behavioral2
Sample
3efcdb3cd177306f741832cfe8c0d2190d7182b566322c4a5fae83e71fbb3666.dll
Resource
win10v20210410
General
-
Target
3efcdb3cd177306f741832cfe8c0d2190d7182b566322c4a5fae83e71fbb3666.dll
-
Size
5.0MB
-
MD5
f86d9b9e04f2926f2e0e322376a83a50
-
SHA1
abc20652bdbd9a45eb4c0be6a4f6d4973d085c5f
-
SHA256
3efcdb3cd177306f741832cfe8c0d2190d7182b566322c4a5fae83e71fbb3666
-
SHA512
ce3d1b926c692f9f18394ac73b1919c300f197fc72824abd482de69aa6f88c5b25b40655964fd1279540aafe976b41ef43ca62ae16dbf27d446b0a94712b4e37
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Executes dropped EXE 2 IoCs
Processes:
mssecsvr.exemssecsvr.exepid process 1420 mssecsvr.exe 3128 mssecsvr.exe -
Drops file in System32 directory 7 IoCs
Processes:
mssecsvr.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies mssecsvr.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 mssecsvr.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\6Z95NAKX.cookie mssecsvr.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\6Z95NAKX.cookie mssecsvr.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat mssecsvr.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 mssecsvr.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE mssecsvr.exe -
Drops file in Windows directory 2 IoCs
Processes:
rundll32.exemssecsvr.exedescription ioc process File created C:\WINDOWS\mssecsvr.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvr.exe -
Modifies data under HKEY_USERS 8 IoCs
Processes:
mssecsvr.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 2104 wrote to memory of 592 2104 rundll32.exe rundll32.exe PID 2104 wrote to memory of 592 2104 rundll32.exe rundll32.exe PID 2104 wrote to memory of 592 2104 rundll32.exe rundll32.exe PID 592 wrote to memory of 1420 592 rundll32.exe mssecsvr.exe PID 592 wrote to memory of 1420 592 rundll32.exe mssecsvr.exe PID 592 wrote to memory of 1420 592 rundll32.exe mssecsvr.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3efcdb3cd177306f741832cfe8c0d2190d7182b566322c4a5fae83e71fbb3666.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3efcdb3cd177306f741832cfe8c0d2190d7182b566322c4a5fae83e71fbb3666.dll,#12⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\WINDOWS\mssecsvr.exeC:\WINDOWS\mssecsvr.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\WINDOWS\mssecsvr.exeC:\WINDOWS\mssecsvr.exe -m security1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\WINDOWS\mssecsvr.exeMD5
ad94a65306935ebc8bbde28d485a75fc
SHA17c814f1ce21de080411de2af4c2869c3d11cdc70
SHA256d12e5d757f82a003f60103efd543d3f04c08674ce15697fe40d939a4c3224a2f
SHA512d2b50482a92d81f37ecb2628c4450c43246cb3d1513dfdaeadc461ff3a94442a3ca5b4ffdc0a73fbee477c59e5c88305b8360420579745d7273ac68cd8ec215c
-
C:\Windows\mssecsvr.exeMD5
ad94a65306935ebc8bbde28d485a75fc
SHA17c814f1ce21de080411de2af4c2869c3d11cdc70
SHA256d12e5d757f82a003f60103efd543d3f04c08674ce15697fe40d939a4c3224a2f
SHA512d2b50482a92d81f37ecb2628c4450c43246cb3d1513dfdaeadc461ff3a94442a3ca5b4ffdc0a73fbee477c59e5c88305b8360420579745d7273ac68cd8ec215c
-
C:\Windows\mssecsvr.exeMD5
ad94a65306935ebc8bbde28d485a75fc
SHA17c814f1ce21de080411de2af4c2869c3d11cdc70
SHA256d12e5d757f82a003f60103efd543d3f04c08674ce15697fe40d939a4c3224a2f
SHA512d2b50482a92d81f37ecb2628c4450c43246cb3d1513dfdaeadc461ff3a94442a3ca5b4ffdc0a73fbee477c59e5c88305b8360420579745d7273ac68cd8ec215c
-
memory/592-114-0x0000000000000000-mapping.dmp
-
memory/1420-115-0x0000000000000000-mapping.dmp