Analysis
- max time kernel
150s - max time network
154s - platform
windows7_x64 - resource
win7-20220715-en - resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system - submitted
19/07/2022, 23:37
Static task
static1
Behavioral task
behavioral1
Sample
21fb31606845c8fd8d82260bb0ea260f.dll
Resource
win7-20220715-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
21fb31606845c8fd8d82260bb0ea260f.dll
Resource
win10v2004-20220414-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 21fb31606845c8fd8d82260bb0ea260f.dll
- Size 5.0MB
- Sample220719-3l481sheb2
- SHA256 3534ca1c2f0bc7f1e7bddd39d156a2cce00987ed4c22d2817680bfa5fc8ccdf0
- MD5 21fb31606845c8fd8d82260bb0ea260f
- SHA1 c4e230392f7a95e383a358fcf88d9b68b3d979d2
- SHA512 fdd7ea707610c09ec7e88457aa63a239b97ea935a438ad89c87f76a749b25a419703ba9a9b421e52892ee2499bfa73f26c9d01befa6c51057d4812116eee6aca
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Wannacry
WannaCry is a ransomware cryptoworm.
- Contacts a large (1245) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Executes dropped EXE 2 IoCs
pid Process 1656 mssecsvr.exe 2008 mssecsvr.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvr.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\WINDOWS\mssecsvr.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvr.exe - Modifies data under HKEY_USERS 24 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\12-2c-18-70-08-fd\WpadDecisionTime = 50b7747cc89bd801 mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C8CA086F-D50D-45A1-AB36-5AD6EAF5BC43}\WpadDecisionTime = 50b7747cc89bd801 mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C8CA086F-D50D-45A1-AB36-5AD6EAF5BC43}\12-2c-18-70-08-fd mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00e9000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C8CA086F-D50D-45A1-AB36-5AD6EAF5BC43}\WpadDecision = "0" mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C8CA086F-D50D-45A1-AB36-5AD6EAF5BC43}\WpadNetworkName = "Network 3" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C8CA086F-D50D-45A1-AB36-5AD6EAF5BC43} mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\12-2c-18-70-08-fd mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\12-2c-18-70-08-fd\WpadDecision = "0" mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C8CA086F-D50D-45A1-AB36-5AD6EAF5BC43}\WpadDecisionReason = "1" mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\12-2c-18-70-08-fd\WpadDecisionReason = "1" mssecsvr.exe - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 908 wrote to memory of 1096 908 rundll32.exe 27 PID 908 wrote to memory of 1096 908 rundll32.exe 27 PID 908 wrote to memory of 1096 908 rundll32.exe 27 PID 908 wrote to memory of 1096 908 rundll32.exe 27 PID 908 wrote to memory of 1096 908 rundll32.exe 27 PID 908 wrote to memory of 1096 908 rundll32.exe 27 PID 908 wrote to memory of 1096 908 rundll32.exe 27 PID 1096 wrote to memory of 1656 1096 rundll32.exe 28 PID 1096 wrote to memory of 1656 1096 rundll32.exe 28 PID 1096 wrote to memory of 1656 1096 rundll32.exe 28 PID 1096 wrote to memory of 1656 1096 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\21fb31606845c8fd8d82260bb0ea260f.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\21fb31606845c8fd8d82260bb0ea260f.dll,#12⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\WINDOWS\mssecsvr.exeC:\WINDOWS\mssecsvr.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1656
-
-
-
C:\WINDOWS\mssecsvr.exeC:\WINDOWS\mssecsvr.exe -m security1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2008
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\WINDOWS\mssecsvr.exe
- Size 2.2MB
- SHA256 cf11a832eb1cd494bea55294740ec00d7c8a906cca8074d237d017fc349d3765
- MD5 456fb8c6da133490533b067a8f206a30
- SHA1 fd1d8f09283c53d1e652c8a6b2595ce558cdcd0f
- SHA512 3fbe1869ff866dad2aa41e060078dda43a8412a7ec82300583905eaf70cddc1d92d338a740f5bb0e453435b55595713834548e31104c7bd70506065ba71d562b
- SSDEEP 49152:QnHqMSPbcBVQej/1IT+TSqTdX1HkQo6SAARdhnvn:QHqPoBhz1KcSUDk36SAEdhvn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mssecsvr.exe
- Size 2.2MB
- SHA256 cf11a832eb1cd494bea55294740ec00d7c8a906cca8074d237d017fc349d3765
- MD5 456fb8c6da133490533b067a8f206a30
- SHA1 fd1d8f09283c53d1e652c8a6b2595ce558cdcd0f
- SHA512 3fbe1869ff866dad2aa41e060078dda43a8412a7ec82300583905eaf70cddc1d92d338a740f5bb0e453435b55595713834548e31104c7bd70506065ba71d562b
- SSDEEP 49152:QnHqMSPbcBVQej/1IT+TSqTdX1HkQo6SAARdhnvn:QHqPoBhz1KcSUDk36SAEdhvn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mssecsvr.exe
- Size 2.2MB
- SHA256 cf11a832eb1cd494bea55294740ec00d7c8a906cca8074d237d017fc349d3765
- MD5 456fb8c6da133490533b067a8f206a30
- SHA1 fd1d8f09283c53d1e652c8a6b2595ce558cdcd0f
- SHA512 3fbe1869ff866dad2aa41e060078dda43a8412a7ec82300583905eaf70cddc1d92d338a740f5bb0e453435b55595713834548e31104c7bd70506065ba71d562b
- SSDEEP 49152:QnHqMSPbcBVQej/1IT+TSqTdX1HkQo6SAARdhnvn:QHqPoBhz1KcSUDk36SAEdhvn
- MD5 SHA1 SHA512 SSDEEP