Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
04-10-2021 12:20
Static task
static1
Behavioral task
behavioral1
Sample
0ab2aeda90221832167e5127332dd702.dll
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
0ab2aeda90221832167e5127332dd702.dll
Resource
win10v20210408
General
-
Target
0ab2aeda90221832167e5127332dd702.dll
-
Size
5.0MB
-
MD5
0ab2aeda90221832167e5127332dd702
-
SHA1
f370045d8ac3f4ba78acf8bfe4c4d35758d5ea05
-
SHA256
64bb708b31b4b043018457c1098465ea83da7d6408c7029b2f68c333fc25891c
-
SHA512
8062093734b11fdd2a8650bfcbc22f36aa679103e7a7ebee74db1ecfcdbf9d9bf76d105f395308db713746dbadacc5796db85ab883a4187587f03b2d3cf7b75b
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Executes dropped EXE 3 IoCs
Processes:
mssecsvc.exemssecsvc.exetasksche.exepid process 856 mssecsvc.exe 1072 mssecsvc.exe 1268 tasksche.exe -
Drops file in System32 directory 1 IoCs
Processes:
mssecsvc.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat mssecsvc.exe -
Drops file in Windows directory 2 IoCs
Processes:
rundll32.exemssecsvc.exedescription ioc process File created C:\WINDOWS\mssecsvc.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 632 wrote to memory of 904 632 rundll32.exe rundll32.exe PID 632 wrote to memory of 904 632 rundll32.exe rundll32.exe PID 632 wrote to memory of 904 632 rundll32.exe rundll32.exe PID 904 wrote to memory of 856 904 rundll32.exe mssecsvc.exe PID 904 wrote to memory of 856 904 rundll32.exe mssecsvc.exe PID 904 wrote to memory of 856 904 rundll32.exe mssecsvc.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ab2aeda90221832167e5127332dd702.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ab2aeda90221832167e5127332dd702.dll,#12⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i4⤵
- Executes dropped EXE
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security1⤵
- Executes dropped EXE
- Drops file in System32 directory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\WINDOWS\mssecsvc.exeMD5
d724d8cc6420f06e8a48752f0da11c66
SHA13b669778698972c402f7c149fc844d0ddb3a00e8
SHA25607c44729e2c570b37db695323249474831f5861d45318bf49ccf5d2f5c8ea1cd
SHA512d771d74894e72402bbd016787fb102053678424205644bceec17ee3e7598e3f4aeb59b0f3272b5dbe1d26289f659024520653f57fc1bfe18054ffae4f188aef9
-
C:\Windows\mssecsvc.exeMD5
d724d8cc6420f06e8a48752f0da11c66
SHA13b669778698972c402f7c149fc844d0ddb3a00e8
SHA25607c44729e2c570b37db695323249474831f5861d45318bf49ccf5d2f5c8ea1cd
SHA512d771d74894e72402bbd016787fb102053678424205644bceec17ee3e7598e3f4aeb59b0f3272b5dbe1d26289f659024520653f57fc1bfe18054ffae4f188aef9
-
C:\Windows\mssecsvc.exeMD5
d724d8cc6420f06e8a48752f0da11c66
SHA13b669778698972c402f7c149fc844d0ddb3a00e8
SHA25607c44729e2c570b37db695323249474831f5861d45318bf49ccf5d2f5c8ea1cd
SHA512d771d74894e72402bbd016787fb102053678424205644bceec17ee3e7598e3f4aeb59b0f3272b5dbe1d26289f659024520653f57fc1bfe18054ffae4f188aef9
-
C:\Windows\tasksche.exeMD5
7f7ccaa16fb15eb1c7399d422f8363e8
SHA1bd44d0ab543bf814d93b719c24e90d8dd7111234
SHA2562584e1521065e45ec3c17767c065429038fc6291c091097ea8b22c8a502c41dd
SHA51283e334b80de08903cfa9891a3fa349c1ece7e19f8e62b74a017512fa9a7989a0fd31929bf1fc13847bee04f2da3dacf6bc3f5ee58f0e4b9d495f4b9af12ed2b7
-
memory/856-115-0x0000000000000000-mapping.dmp
-
memory/904-114-0x0000000000000000-mapping.dmp