Analysis
-
max time kernel
152s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
07-07-2022 21:16
Static task
static1
Behavioral task
behavioral1
Sample
43f4cb1e61aa8d6a587263e2c81107ebf2fb5ef6ca19311dd7447b74b85bb5af.dll
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
43f4cb1e61aa8d6a587263e2c81107ebf2fb5ef6ca19311dd7447b74b85bb5af.dll
Resource
win10v2004-20220414-en
General
-
Target
43f4cb1e61aa8d6a587263e2c81107ebf2fb5ef6ca19311dd7447b74b85bb5af.dll
-
Size
5.0MB
-
MD5
fc7dab164812e35752c29178fde872db
-
SHA1
61d950f2cde956960cf07e115f6428edda32d633
-
SHA256
43f4cb1e61aa8d6a587263e2c81107ebf2fb5ef6ca19311dd7447b74b85bb5af
-
SHA512
986558dc6d4a28aaaad82e53df2acf09db8e3c8a939e04de465aaa18b2c212595ba3e75f60ce9c7b6d879b8d81707f414d385037fb21146d4223cb3645288b1f
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (772) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 3 IoCs
Processes:
mssecsvr.exemssecsvr.exetasksche.exepid process 952 mssecsvr.exe 1448 mssecsvr.exe 576 tasksche.exe -
Drops file in System32 directory 1 IoCs
Processes:
mssecsvr.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvr.exe -
Drops file in Windows directory 4 IoCs
Processes:
tasksche.exerundll32.exemssecsvr.exedescription ioc process File created C:\Windows\__tmp_rar_sfx_access_check_7116297 tasksche.exe File created C:\Windows\eee.exe tasksche.exe File created C:\WINDOWS\mssecsvr.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvr.exe -
Modifies data under HKEY_USERS 24 IoCs
Processes:
mssecsvr.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{ECF95D5E-4407-424C-86E7-F4723D19804D}\WpadDecisionTime = d00448583b93d801 mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\f6-75-01-24-bf-77\WpadDecision = "0" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{ECF95D5E-4407-424C-86E7-F4723D19804D} mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{ECF95D5E-4407-424C-86E7-F4723D19804D}\WpadDecisionReason = "1" mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{ECF95D5E-4407-424C-86E7-F4723D19804D}\WpadNetworkName = "Network 2" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\f6-75-01-24-bf-77 mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\f6-75-01-24-bf-77\WpadDecisionReason = "1" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0098000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{ECF95D5E-4407-424C-86E7-F4723D19804D}\WpadDecision = "0" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{ECF95D5E-4407-424C-86E7-F4723D19804D}\f6-75-01-24-bf-77 mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\f6-75-01-24-bf-77\WpadDecisionTime = d00448583b93d801 mssecsvr.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
rundll32.exerundll32.exemssecsvr.exedescription pid process target process PID 904 wrote to memory of 1688 904 rundll32.exe rundll32.exe PID 904 wrote to memory of 1688 904 rundll32.exe rundll32.exe PID 904 wrote to memory of 1688 904 rundll32.exe rundll32.exe PID 904 wrote to memory of 1688 904 rundll32.exe rundll32.exe PID 904 wrote to memory of 1688 904 rundll32.exe rundll32.exe PID 904 wrote to memory of 1688 904 rundll32.exe rundll32.exe PID 904 wrote to memory of 1688 904 rundll32.exe rundll32.exe PID 1688 wrote to memory of 952 1688 rundll32.exe mssecsvr.exe PID 1688 wrote to memory of 952 1688 rundll32.exe mssecsvr.exe PID 1688 wrote to memory of 952 1688 rundll32.exe mssecsvr.exe PID 1688 wrote to memory of 952 1688 rundll32.exe mssecsvr.exe PID 952 wrote to memory of 576 952 mssecsvr.exe tasksche.exe PID 952 wrote to memory of 576 952 mssecsvr.exe tasksche.exe PID 952 wrote to memory of 576 952 mssecsvr.exe tasksche.exe PID 952 wrote to memory of 576 952 mssecsvr.exe tasksche.exe PID 952 wrote to memory of 576 952 mssecsvr.exe tasksche.exe PID 952 wrote to memory of 576 952 mssecsvr.exe tasksche.exe PID 952 wrote to memory of 576 952 mssecsvr.exe tasksche.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\43f4cb1e61aa8d6a587263e2c81107ebf2fb5ef6ca19311dd7447b74b85bb5af.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\43f4cb1e61aa8d6a587263e2c81107ebf2fb5ef6ca19311dd7447b74b85bb5af.dll,#12⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\WINDOWS\mssecsvr.exeC:\WINDOWS\mssecsvr.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i4⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\WINDOWS\mssecsvr.exeC:\WINDOWS\mssecsvr.exe -m security1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\WINDOWS\mssecsvr.exeFilesize
2.2MB
MD509fa846303dc895c0688ecc456d9e667
SHA12c7527d8f8573dc394b004085d5255b5437847b7
SHA256ec6757162500e2dcd4dbd9adc59aee10c25da5eaa3d4e65309bc78f8ebd38ca9
SHA5127707eec8ac96c864365b2df7656549ee83685006fcefd2038564ad7d859fe552041aa7c61af1c9098b2257b2b158f8d511c6fe9c8814636df86d3e3268404ce5
-
C:\WINDOWS\tasksche.exeFilesize
2.0MB
MD5d2a7aaa23e34fd8eb852212a212516df
SHA1ee6e2e6cb957ac9938e270b5866516bfe2254790
SHA2568d8849679e249720dc13b93f05d7500d653eddef7bb45df803cfabb80b67da50
SHA51259d815a2db3d14bcd416f18969b6461e960bd5c41b7c15a5c1542ce98234a229e344343b4c732c2d0da6d1358cc109d23aa7b4225367132b327360ea2b125558
-
C:\Windows\mssecsvr.exeFilesize
2.2MB
MD509fa846303dc895c0688ecc456d9e667
SHA12c7527d8f8573dc394b004085d5255b5437847b7
SHA256ec6757162500e2dcd4dbd9adc59aee10c25da5eaa3d4e65309bc78f8ebd38ca9
SHA5127707eec8ac96c864365b2df7656549ee83685006fcefd2038564ad7d859fe552041aa7c61af1c9098b2257b2b158f8d511c6fe9c8814636df86d3e3268404ce5
-
C:\Windows\mssecsvr.exeFilesize
2.2MB
MD509fa846303dc895c0688ecc456d9e667
SHA12c7527d8f8573dc394b004085d5255b5437847b7
SHA256ec6757162500e2dcd4dbd9adc59aee10c25da5eaa3d4e65309bc78f8ebd38ca9
SHA5127707eec8ac96c864365b2df7656549ee83685006fcefd2038564ad7d859fe552041aa7c61af1c9098b2257b2b158f8d511c6fe9c8814636df86d3e3268404ce5
-
C:\Windows\tasksche.exeFilesize
2.0MB
MD5d2a7aaa23e34fd8eb852212a212516df
SHA1ee6e2e6cb957ac9938e270b5866516bfe2254790
SHA2568d8849679e249720dc13b93f05d7500d653eddef7bb45df803cfabb80b67da50
SHA51259d815a2db3d14bcd416f18969b6461e960bd5c41b7c15a5c1542ce98234a229e344343b4c732c2d0da6d1358cc109d23aa7b4225367132b327360ea2b125558
-
memory/576-62-0x0000000000000000-mapping.dmp
-
memory/952-56-0x0000000000000000-mapping.dmp
-
memory/1688-54-0x0000000000000000-mapping.dmp
-
memory/1688-55-0x00000000751C1000-0x00000000751C3000-memory.dmpFilesize
8KB