Analysis
- max time kernel
151s - max time network
154s - platform
windows7_x64 - resource
win7-20220718-en - resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system - submitted
20/07/2022, 00:52
Static task
static1
Behavioral task
behavioral1
Sample
c2addaac221f581b58ffc1113df7f8bd.dll
Resource
win7-20220718-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
c2addaac221f581b58ffc1113df7f8bd.dll
Resource
win10v2004-20220414-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target c2addaac221f581b58ffc1113df7f8bd.dll
- Size 5.0MB
- Sample220720-a73yvsaddj
- SHA256 9fe47b1bddf2c8fa897918f3bea8ead0604e4d25a54c72473414f5943405b792
- MD5 c2addaac221f581b58ffc1113df7f8bd
- SHA1 07a041e17e7d3fba4f59d571411aa800f3861a92
- SHA512 b1692f6e0b64831a5f3b4588be3aef3ca9960e901b8c2b65435017f7d4bcc53f74cd8793a9d3133036db2f8b74199d873a67802d5498090b475667b268e681f8
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Wannacry
WannaCry is a ransomware cryptoworm.
- Contacts a large (1245) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Executes dropped EXE 3 IoCs
pid Process 1612 mssecsvc.exe 1052 mssecsvc.exe 1320 tasksche.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvc.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\WINDOWS\tasksche.exe mssecsvc.exe File created C:\WINDOWS\mssecsvc.exe rundll32.exe - Modifies data under HKEY_USERS 24 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A5A17F7-137A-426E-9AC2-40F809C1E4DD}\WpadDecision = "0" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a6-6b-26-6b-84-8e\WpadDecisionTime = d01afcb9e39bd801 mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A5A17F7-137A-426E-9AC2-40F809C1E4DD}\WpadDecisionTime = d01afcb9e39bd801 mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A5A17F7-137A-426E-9AC2-40F809C1E4DD}\WpadNetworkName = "Network 3" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A5A17F7-137A-426E-9AC2-40F809C1E4DD}\WpadDecisionReason = "1" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a6-6b-26-6b-84-8e mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A5A17F7-137A-426E-9AC2-40F809C1E4DD} mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A5A17F7-137A-426E-9AC2-40F809C1E4DD}\a6-6b-26-6b-84-8e mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a6-6b-26-6b-84-8e\WpadDecisionReason = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a6-6b-26-6b-84-8e\WpadDecision = "0" mssecsvc.exe - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1172 wrote to memory of 1196 1172 rundll32.exe 27 PID 1172 wrote to memory of 1196 1172 rundll32.exe 27 PID 1172 wrote to memory of 1196 1172 rundll32.exe 27 PID 1172 wrote to memory of 1196 1172 rundll32.exe 27 PID 1172 wrote to memory of 1196 1172 rundll32.exe 27 PID 1172 wrote to memory of 1196 1172 rundll32.exe 27 PID 1172 wrote to memory of 1196 1172 rundll32.exe 27 PID 1196 wrote to memory of 1612 1196 rundll32.exe 28 PID 1196 wrote to memory of 1612 1196 rundll32.exe 28 PID 1196 wrote to memory of 1612 1196 rundll32.exe 28 PID 1196 wrote to memory of 1612 1196 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c2addaac221f581b58ffc1113df7f8bd.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c2addaac221f581b58ffc1113df7f8bd.dll,#12⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1612 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i4⤵
- Executes dropped EXE
PID:1320
-
-
-
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1052
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\WINDOWS\mssecsvc.exe
- Size 3.6MB
- SHA256 c6ab36a1d7ee95a67e91b2c6f901f8da7b223d8b5cb91eeef50e650e2557193a
- MD5 f8722512b9d6a81cc95e9a2363d4c8a8
- SHA1 182c8072a0bd04526967cb30128a61e8917e0760
- SHA512 f4c36b79e6256dca773fe0fe8cad908d93373fed7a583d2cacbf9d1cd660ce81aff7266cccb24e1c634e22ce3087c026d8eed28c1cdd006d44a3c0f96b9b3d53
- SSDEEP 98304:yDqPoBhz1aRxcSUDk36SATGrDoRm6LtC61/uaUosOfBmVnRhlGSE2va:yDqPe1Cxcxk3ZAIQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mssecsvc.exe
- Size 3.6MB
- SHA256 c6ab36a1d7ee95a67e91b2c6f901f8da7b223d8b5cb91eeef50e650e2557193a
- MD5 f8722512b9d6a81cc95e9a2363d4c8a8
- SHA1 182c8072a0bd04526967cb30128a61e8917e0760
- SHA512 f4c36b79e6256dca773fe0fe8cad908d93373fed7a583d2cacbf9d1cd660ce81aff7266cccb24e1c634e22ce3087c026d8eed28c1cdd006d44a3c0f96b9b3d53
- SSDEEP 98304:yDqPoBhz1aRxcSUDk36SATGrDoRm6LtC61/uaUosOfBmVnRhlGSE2va:yDqPe1Cxcxk3ZAIQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mssecsvc.exe
- Size 3.6MB
- SHA256 c6ab36a1d7ee95a67e91b2c6f901f8da7b223d8b5cb91eeef50e650e2557193a
- MD5 f8722512b9d6a81cc95e9a2363d4c8a8
- SHA1 182c8072a0bd04526967cb30128a61e8917e0760
- SHA512 f4c36b79e6256dca773fe0fe8cad908d93373fed7a583d2cacbf9d1cd660ce81aff7266cccb24e1c634e22ce3087c026d8eed28c1cdd006d44a3c0f96b9b3d53
- SSDEEP 98304:yDqPoBhz1aRxcSUDk36SATGrDoRm6LtC61/uaUosOfBmVnRhlGSE2va:yDqPe1Cxcxk3ZAIQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\tasksche.exe
- Size 3.4MB
- SHA256 8885e8545c48099d4a10707896e5d73b2395bae7c0d79b0d21dbe6f9e8cfac36
- MD5 4fc2ee41646e0e8a5146e855ab0c33b5
- SHA1 a3b76ccfcb23febfd8babf27dffcfa4d6680bebe
- SHA512 892734df7624e1f75facca0ce77c8f3e062623dfacbb0696d3a7f052b2c3e478138d45edd1891334d76b618a75d6cfd3f53b07775c7f1133ceb830f47d1ce58d
- SSDEEP 98304:QqPoBhz1aRxcSUDk36SATGrDoRm6LtC61/uaUosOfBmVnRhlGSE28:QqPe1Cxcxk3ZAI+
- MD5 SHA1 SHA512 SSDEEP