Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
20-07-2022 00:23
Static task
static1
Behavioral task
behavioral1
Sample
8b54f5b032981768ddc1ba13d27c1018.dll
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
8b54f5b032981768ddc1ba13d27c1018.dll
Resource
win10v2004-20220414-en
General
-
Target
8b54f5b032981768ddc1ba13d27c1018.dll
-
Size
5.0MB
-
MD5
8b54f5b032981768ddc1ba13d27c1018
-
SHA1
2e899f5379c09e40abc47d98539825d2e3e85bdc
-
SHA256
fdca1e0c8951ddfbea1f9a4fbdd44aff52f3608396788add49b99c3f0b482e09
-
SHA512
68ba135eab98110c7328b66d204d9d35cb36c0f7b53cb9e20a6751d8c56cd181d4142f814ec77aeb3a1edeaeb0219a95a1cce2f83c554705d69fb630ef24d18c
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (1281) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 3 IoCs
Processes:
mssecsvc.exemssecsvc.exetasksche.exepid process 1656 mssecsvc.exe 1912 mssecsvc.exe 832 tasksche.exe -
Drops file in System32 directory 1 IoCs
Processes:
mssecsvc.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvc.exe -
Drops file in Windows directory 2 IoCs
Processes:
rundll32.exemssecsvc.exedescription ioc process File created C:\WINDOWS\mssecsvc.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvc.exe -
Modifies data under HKEY_USERS 24 IoCs
Processes:
mssecsvc.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{68A262D9-8B48-4BA6-846B-FB4217E138F5}\WpadDecisionTime = 004525aedf9bd801 mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{68A262D9-8B48-4BA6-846B-FB4217E138F5}\WpadNetworkName = "Network 3" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{68A262D9-8B48-4BA6-846B-FB4217E138F5}\WpadDecision = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\76-77-b3-a3-16-f3 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{68A262D9-8B48-4BA6-846B-FB4217E138F5}\76-77-b3-a3-16-f3 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\76-77-b3-a3-16-f3\WpadDecisionReason = "1" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{68A262D9-8B48-4BA6-846B-FB4217E138F5}\WpadDecisionReason = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\76-77-b3-a3-16-f3\WpadDecision = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00c5000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{68A262D9-8B48-4BA6-846B-FB4217E138F5} mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\76-77-b3-a3-16-f3\WpadDecisionTime = 004525aedf9bd801 mssecsvc.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1768 wrote to memory of 964 1768 rundll32.exe rundll32.exe PID 1768 wrote to memory of 964 1768 rundll32.exe rundll32.exe PID 1768 wrote to memory of 964 1768 rundll32.exe rundll32.exe PID 1768 wrote to memory of 964 1768 rundll32.exe rundll32.exe PID 1768 wrote to memory of 964 1768 rundll32.exe rundll32.exe PID 1768 wrote to memory of 964 1768 rundll32.exe rundll32.exe PID 1768 wrote to memory of 964 1768 rundll32.exe rundll32.exe PID 964 wrote to memory of 1656 964 rundll32.exe mssecsvc.exe PID 964 wrote to memory of 1656 964 rundll32.exe mssecsvc.exe PID 964 wrote to memory of 1656 964 rundll32.exe mssecsvc.exe PID 964 wrote to memory of 1656 964 rundll32.exe mssecsvc.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8b54f5b032981768ddc1ba13d27c1018.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8b54f5b032981768ddc1ba13d27c1018.dll,#12⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:964 -
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1656 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i4⤵
- Executes dropped EXE
PID:832
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1912
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\WINDOWS\mssecsvc.exeFilesize
3.6MB
MD5300755a49d5be3cc7ef7afcbfc1b429a
SHA18b06deaa9fc8bd15875fb0c8603cb623c5af2c28
SHA256b6ed92348b5cad7eb63a8c4670254e7217ea5d8e0357366de9e0b78455c99828
SHA5127b409b31db82e173afa680e08c8d71e6e27629892dffdb1ceedd9a843507006e1958f07435c1aa9736a09f453571fcb95845f264154a08483d7a768ca0241dfe
-
C:\Windows\mssecsvc.exeFilesize
3.6MB
MD5300755a49d5be3cc7ef7afcbfc1b429a
SHA18b06deaa9fc8bd15875fb0c8603cb623c5af2c28
SHA256b6ed92348b5cad7eb63a8c4670254e7217ea5d8e0357366de9e0b78455c99828
SHA5127b409b31db82e173afa680e08c8d71e6e27629892dffdb1ceedd9a843507006e1958f07435c1aa9736a09f453571fcb95845f264154a08483d7a768ca0241dfe
-
C:\Windows\mssecsvc.exeFilesize
3.6MB
MD5300755a49d5be3cc7ef7afcbfc1b429a
SHA18b06deaa9fc8bd15875fb0c8603cb623c5af2c28
SHA256b6ed92348b5cad7eb63a8c4670254e7217ea5d8e0357366de9e0b78455c99828
SHA5127b409b31db82e173afa680e08c8d71e6e27629892dffdb1ceedd9a843507006e1958f07435c1aa9736a09f453571fcb95845f264154a08483d7a768ca0241dfe
-
C:\Windows\tasksche.exeFilesize
3.4MB
MD57009c62d2f4e879d5d04d3defd127648
SHA152305be8afca63f44f660fe3634dd6289579b6da
SHA2568702d2b9be55b118d8ea0dac8611ee3afa34d24ef0b8b895c6997f48c75213b9
SHA512480a69901364addea453429eb97e81024726d7285ea9c838e2cbe62ac00dc777d166ea8fc3d9bc72fa5d96cab7e6e0f0306110cb88d1c891025f4e3ad4881f95
-
memory/964-54-0x0000000000000000-mapping.dmp
-
memory/964-55-0x00000000757E1000-0x00000000757E3000-memory.dmpFilesize
8KB
-
memory/1656-56-0x0000000000000000-mapping.dmp