Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
19-07-2022 23:37
Static task
static1
Behavioral task
behavioral1
Sample
21fb31606845c8fd8d82260bb0ea260f.dll
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
21fb31606845c8fd8d82260bb0ea260f.dll
Resource
win10v2004-20220414-en
General
-
Target
21fb31606845c8fd8d82260bb0ea260f.dll
-
Size
5.0MB
-
MD5
21fb31606845c8fd8d82260bb0ea260f
-
SHA1
c4e230392f7a95e383a358fcf88d9b68b3d979d2
-
SHA256
3534ca1c2f0bc7f1e7bddd39d156a2cce00987ed4c22d2817680bfa5fc8ccdf0
-
SHA512
fdd7ea707610c09ec7e88457aa63a239b97ea935a438ad89c87f76a749b25a419703ba9a9b421e52892ee2499bfa73f26c9d01befa6c51057d4812116eee6aca
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (1245) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 2 IoCs
Processes:
mssecsvr.exemssecsvr.exepid process 1656 mssecsvr.exe 2008 mssecsvr.exe -
Drops file in System32 directory 1 IoCs
Processes:
mssecsvr.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvr.exe -
Drops file in Windows directory 2 IoCs
Processes:
rundll32.exemssecsvr.exedescription ioc process File created C:\WINDOWS\mssecsvr.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvr.exe -
Modifies data under HKEY_USERS 24 IoCs
Processes:
mssecsvr.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\12-2c-18-70-08-fd\WpadDecisionTime = 50b7747cc89bd801 mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C8CA086F-D50D-45A1-AB36-5AD6EAF5BC43}\WpadDecisionTime = 50b7747cc89bd801 mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C8CA086F-D50D-45A1-AB36-5AD6EAF5BC43}\12-2c-18-70-08-fd mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00e9000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C8CA086F-D50D-45A1-AB36-5AD6EAF5BC43}\WpadDecision = "0" mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C8CA086F-D50D-45A1-AB36-5AD6EAF5BC43}\WpadNetworkName = "Network 3" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C8CA086F-D50D-45A1-AB36-5AD6EAF5BC43} mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\12-2c-18-70-08-fd mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\12-2c-18-70-08-fd\WpadDecision = "0" mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C8CA086F-D50D-45A1-AB36-5AD6EAF5BC43}\WpadDecisionReason = "1" mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\12-2c-18-70-08-fd\WpadDecisionReason = "1" mssecsvr.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 908 wrote to memory of 1096 908 rundll32.exe rundll32.exe PID 908 wrote to memory of 1096 908 rundll32.exe rundll32.exe PID 908 wrote to memory of 1096 908 rundll32.exe rundll32.exe PID 908 wrote to memory of 1096 908 rundll32.exe rundll32.exe PID 908 wrote to memory of 1096 908 rundll32.exe rundll32.exe PID 908 wrote to memory of 1096 908 rundll32.exe rundll32.exe PID 908 wrote to memory of 1096 908 rundll32.exe rundll32.exe PID 1096 wrote to memory of 1656 1096 rundll32.exe mssecsvr.exe PID 1096 wrote to memory of 1656 1096 rundll32.exe mssecsvr.exe PID 1096 wrote to memory of 1656 1096 rundll32.exe mssecsvr.exe PID 1096 wrote to memory of 1656 1096 rundll32.exe mssecsvr.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\21fb31606845c8fd8d82260bb0ea260f.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\21fb31606845c8fd8d82260bb0ea260f.dll,#12⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\WINDOWS\mssecsvr.exeC:\WINDOWS\mssecsvr.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\WINDOWS\mssecsvr.exeC:\WINDOWS\mssecsvr.exe -m security1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\WINDOWS\mssecsvr.exeFilesize
2.2MB
MD5456fb8c6da133490533b067a8f206a30
SHA1fd1d8f09283c53d1e652c8a6b2595ce558cdcd0f
SHA256cf11a832eb1cd494bea55294740ec00d7c8a906cca8074d237d017fc349d3765
SHA5123fbe1869ff866dad2aa41e060078dda43a8412a7ec82300583905eaf70cddc1d92d338a740f5bb0e453435b55595713834548e31104c7bd70506065ba71d562b
-
C:\Windows\mssecsvr.exeFilesize
2.2MB
MD5456fb8c6da133490533b067a8f206a30
SHA1fd1d8f09283c53d1e652c8a6b2595ce558cdcd0f
SHA256cf11a832eb1cd494bea55294740ec00d7c8a906cca8074d237d017fc349d3765
SHA5123fbe1869ff866dad2aa41e060078dda43a8412a7ec82300583905eaf70cddc1d92d338a740f5bb0e453435b55595713834548e31104c7bd70506065ba71d562b
-
C:\Windows\mssecsvr.exeFilesize
2.2MB
MD5456fb8c6da133490533b067a8f206a30
SHA1fd1d8f09283c53d1e652c8a6b2595ce558cdcd0f
SHA256cf11a832eb1cd494bea55294740ec00d7c8a906cca8074d237d017fc349d3765
SHA5123fbe1869ff866dad2aa41e060078dda43a8412a7ec82300583905eaf70cddc1d92d338a740f5bb0e453435b55595713834548e31104c7bd70506065ba71d562b
-
memory/1096-54-0x0000000000000000-mapping.dmp
-
memory/1096-55-0x0000000075D21000-0x0000000075D23000-memory.dmpFilesize
8KB
-
memory/1656-56-0x0000000000000000-mapping.dmp