Analysis
-
max time kernel
188s -
max time network
196s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
12-06-2022 07:18
Static task
static1
Behavioral task
behavioral1
Sample
21d52f970117819dab150b9d71d64d2afb3794ca7c6de574321d27b1849b71b0.dll
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
21d52f970117819dab150b9d71d64d2afb3794ca7c6de574321d27b1849b71b0.dll
Resource
win10v2004-20220414-en
General
-
Target
21d52f970117819dab150b9d71d64d2afb3794ca7c6de574321d27b1849b71b0.dll
-
Size
5.0MB
-
MD5
ffe9ccaad1190c36b7df3b8bdcb45875
-
SHA1
1a7ed5614247c958d2b3f8da2411ddf5a85e16a9
-
SHA256
21d52f970117819dab150b9d71d64d2afb3794ca7c6de574321d27b1849b71b0
-
SHA512
0a16711d9a1a78341b32ae31f768cb2afadcd4d61878fa48d23572efae7d6c99066c17154290d82cdd8916a3fa4e756c7be887f5f6c58be0c63fd112cae965db
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (1014) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 2 IoCs
Processes:
mssecsvc.exemssecsvc.exepid process 900 mssecsvc.exe 1860 mssecsvc.exe -
Drops file in System32 directory 1 IoCs
Processes:
mssecsvc.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvc.exe -
Drops file in Windows directory 2 IoCs
Processes:
rundll32.exemssecsvc.exedescription ioc process File created C:\WINDOWS\mssecsvc.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvc.exe -
Modifies data under HKEY_USERS 24 IoCs
Processes:
mssecsvc.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00a4000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3B68D511-C184-464D-A2F7-463C9ADFF6CA}\WpadDecisionReason = "1" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3B68D511-C184-464D-A2F7-463C9ADFF6CA}\WpadDecisionTime = 2098f488677ed801 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\92-75-20-95-04-0d\WpadDecisionReason = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\92-75-20-95-04-0d\WpadDecision = "0" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3B68D511-C184-464D-A2F7-463C9ADFF6CA}\92-75-20-95-04-0d mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3B68D511-C184-464D-A2F7-463C9ADFF6CA} mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3B68D511-C184-464D-A2F7-463C9ADFF6CA}\WpadNetworkName = "Network 2" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\92-75-20-95-04-0d mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3B68D511-C184-464D-A2F7-463C9ADFF6CA}\WpadDecision = "0" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\92-75-20-95-04-0d\WpadDecisionTime = 2098f488677ed801 mssecsvc.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1484 wrote to memory of 952 1484 rundll32.exe rundll32.exe PID 1484 wrote to memory of 952 1484 rundll32.exe rundll32.exe PID 1484 wrote to memory of 952 1484 rundll32.exe rundll32.exe PID 1484 wrote to memory of 952 1484 rundll32.exe rundll32.exe PID 1484 wrote to memory of 952 1484 rundll32.exe rundll32.exe PID 1484 wrote to memory of 952 1484 rundll32.exe rundll32.exe PID 1484 wrote to memory of 952 1484 rundll32.exe rundll32.exe PID 952 wrote to memory of 900 952 rundll32.exe mssecsvc.exe PID 952 wrote to memory of 900 952 rundll32.exe mssecsvc.exe PID 952 wrote to memory of 900 952 rundll32.exe mssecsvc.exe PID 952 wrote to memory of 900 952 rundll32.exe mssecsvc.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\21d52f970117819dab150b9d71d64d2afb3794ca7c6de574321d27b1849b71b0.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\21d52f970117819dab150b9d71d64d2afb3794ca7c6de574321d27b1849b71b0.dll,#12⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\WINDOWS\mssecsvc.exeFilesize
3.6MB
MD55ad188090c5943dd1aa50ecbaadcb1e9
SHA188bce55d3d47e2b045174d49a960c32e9774f326
SHA2563b4bfdd3adca02cc079e1cd7c2388792777e5d0880cf4aeaecc3f206ccad9693
SHA512d36660fea21d9c2b6a0f42559dc3a94d9468cd28890ac11044e21add55e3a82b0c046cefa7680c1807fc60b629b766536d4015e98c9cea2ac47a2150106b215f
-
C:\Windows\mssecsvc.exeFilesize
3.6MB
MD55ad188090c5943dd1aa50ecbaadcb1e9
SHA188bce55d3d47e2b045174d49a960c32e9774f326
SHA2563b4bfdd3adca02cc079e1cd7c2388792777e5d0880cf4aeaecc3f206ccad9693
SHA512d36660fea21d9c2b6a0f42559dc3a94d9468cd28890ac11044e21add55e3a82b0c046cefa7680c1807fc60b629b766536d4015e98c9cea2ac47a2150106b215f
-
C:\Windows\mssecsvc.exeFilesize
3.6MB
MD55ad188090c5943dd1aa50ecbaadcb1e9
SHA188bce55d3d47e2b045174d49a960c32e9774f326
SHA2563b4bfdd3adca02cc079e1cd7c2388792777e5d0880cf4aeaecc3f206ccad9693
SHA512d36660fea21d9c2b6a0f42559dc3a94d9468cd28890ac11044e21add55e3a82b0c046cefa7680c1807fc60b629b766536d4015e98c9cea2ac47a2150106b215f
-
memory/900-56-0x0000000000000000-mapping.dmp
-
memory/952-54-0x0000000000000000-mapping.dmp
-
memory/952-55-0x0000000076431000-0x0000000076433000-memory.dmpFilesize
8KB