Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
20-07-2022 00:30
Static task
static1
Behavioral task
behavioral1
Sample
1d6d94d464f5c412a46cc627d0b6e460.dll
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
1d6d94d464f5c412a46cc627d0b6e460.dll
Resource
win10v2004-20220718-en
General
-
Target
1d6d94d464f5c412a46cc627d0b6e460.dll
-
Size
5.0MB
-
MD5
1d6d94d464f5c412a46cc627d0b6e460
-
SHA1
c6eb8e052cbd38a14b205ef027c06bb4a66680b4
-
SHA256
50ce21338b3fc1588a96cedc45b27f9019cdfef4348f808ac7bda1d555783a5d
-
SHA512
441ef97b91f74c3fb35e36a836e57893390f3768d9089c763b4175fa2f728596fa37353023c47a96bb286e39d88a0014849534b5e1d93c33605ea45c80aa2826
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (1246) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 2 IoCs
Processes:
mssecsvr.exemssecsvr.exepid process 1680 mssecsvr.exe 1320 mssecsvr.exe -
Drops file in System32 directory 1 IoCs
Processes:
mssecsvr.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvr.exe -
Drops file in Windows directory 2 IoCs
Processes:
rundll32.exemssecsvr.exedescription ioc process File created C:\WINDOWS\mssecsvr.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvr.exe -
Modifies data under HKEY_USERS 24 IoCs
Processes:
mssecsvr.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00c1000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{79924454-FFA8-40FA-B2E0-E50B81BFF94E}\WpadDecision = "0" mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{79924454-FFA8-40FA-B2E0-E50B81BFF94E}\WpadNetworkName = "Network 3" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{79924454-FFA8-40FA-B2E0-E50B81BFF94E}\12-63-50-77-49-84 mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{79924454-FFA8-40FA-B2E0-E50B81BFF94E}\WpadDecisionReason = "1" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{79924454-FFA8-40FA-B2E0-E50B81BFF94E}\WpadDecisionTime = e0b597a8e09bd801 mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\12-63-50-77-49-84\WpadDecisionReason = "1" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{79924454-FFA8-40FA-B2E0-E50B81BFF94E} mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\12-63-50-77-49-84 mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\12-63-50-77-49-84\WpadDecisionTime = e0b597a8e09bd801 mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\12-63-50-77-49-84\WpadDecision = "0" mssecsvr.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1976 wrote to memory of 888 1976 rundll32.exe rundll32.exe PID 1976 wrote to memory of 888 1976 rundll32.exe rundll32.exe PID 1976 wrote to memory of 888 1976 rundll32.exe rundll32.exe PID 1976 wrote to memory of 888 1976 rundll32.exe rundll32.exe PID 1976 wrote to memory of 888 1976 rundll32.exe rundll32.exe PID 1976 wrote to memory of 888 1976 rundll32.exe rundll32.exe PID 1976 wrote to memory of 888 1976 rundll32.exe rundll32.exe PID 888 wrote to memory of 1680 888 rundll32.exe mssecsvr.exe PID 888 wrote to memory of 1680 888 rundll32.exe mssecsvr.exe PID 888 wrote to memory of 1680 888 rundll32.exe mssecsvr.exe PID 888 wrote to memory of 1680 888 rundll32.exe mssecsvr.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1d6d94d464f5c412a46cc627d0b6e460.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1d6d94d464f5c412a46cc627d0b6e460.dll,#12⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:888 -
C:\WINDOWS\mssecsvr.exeC:\WINDOWS\mssecsvr.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1680
-
C:\WINDOWS\mssecsvr.exeC:\WINDOWS\mssecsvr.exe -m security1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1320
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\WINDOWS\mssecsvr.exeFilesize
2.2MB
MD54291e4b98cb467e9515b55fcae20f939
SHA199e179a5ded29b5ea6e8874c36c9c66131d347bc
SHA2560929d063bd600a32c876ed136ad58d93bf4fe665f497457bbf7472c62dc8b539
SHA512f9173584f45ddeefa0ab80d2e743eb8ddff1ddd4ccb05937a02b2adb8324f4f39b9185acc93b4b15042efce2ebe3e413b347368f5a1085432b57b05ffb30b90b
-
C:\Windows\mssecsvr.exeFilesize
2.2MB
MD54291e4b98cb467e9515b55fcae20f939
SHA199e179a5ded29b5ea6e8874c36c9c66131d347bc
SHA2560929d063bd600a32c876ed136ad58d93bf4fe665f497457bbf7472c62dc8b539
SHA512f9173584f45ddeefa0ab80d2e743eb8ddff1ddd4ccb05937a02b2adb8324f4f39b9185acc93b4b15042efce2ebe3e413b347368f5a1085432b57b05ffb30b90b
-
C:\Windows\mssecsvr.exeFilesize
2.2MB
MD54291e4b98cb467e9515b55fcae20f939
SHA199e179a5ded29b5ea6e8874c36c9c66131d347bc
SHA2560929d063bd600a32c876ed136ad58d93bf4fe665f497457bbf7472c62dc8b539
SHA512f9173584f45ddeefa0ab80d2e743eb8ddff1ddd4ccb05937a02b2adb8324f4f39b9185acc93b4b15042efce2ebe3e413b347368f5a1085432b57b05ffb30b90b
-
memory/888-54-0x0000000000000000-mapping.dmp
-
memory/888-55-0x0000000075A61000-0x0000000075A63000-memory.dmpFilesize
8KB
-
memory/1680-56-0x0000000000000000-mapping.dmp