Analysis
-
max time kernel
160s -
max time network
163s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
20-07-2022 00:32
Static task
static1
Behavioral task
behavioral1
Sample
eb3b370b3c7897d6a6b6616437183b4f.dll
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
eb3b370b3c7897d6a6b6616437183b4f.dll
Resource
win10v2004-20220718-en
General
-
Target
eb3b370b3c7897d6a6b6616437183b4f.dll
-
Size
5.0MB
-
MD5
eb3b370b3c7897d6a6b6616437183b4f
-
SHA1
165e0fb3d292e61cf83d0128586a0d36915513a0
-
SHA256
9a23af3c1a00f24b0863a75e22a294d4983ee6fefa832a9f6a6241810565cfba
-
SHA512
90590e2b51e3b9018f35fea87dab6a56b50b8131308f90db18fd9598f4ae26ed7d4299c46ba7af3ab302b65d231bd2cf3d1bd1c04ab53c5cd93614f8aaf7a790
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (1145) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 2 IoCs
Processes:
mssecsvr.exemssecsvr.exepid process 1628 mssecsvr.exe 1440 mssecsvr.exe -
Drops file in System32 directory 1 IoCs
Processes:
mssecsvr.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvr.exe -
Drops file in Windows directory 2 IoCs
Processes:
rundll32.exemssecsvr.exedescription ioc process File created C:\WINDOWS\mssecsvr.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvr.exe -
Modifies data under HKEY_USERS 24 IoCs
Processes:
mssecsvr.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A5A17F7-137A-426E-9AC2-40F809C1E4DD}\WpadDecisionTime = d0e1acf9e09bd801 mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A5A17F7-137A-426E-9AC2-40F809C1E4DD}\a6-6b-26-6b-84-8e mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A5A17F7-137A-426E-9AC2-40F809C1E4DD}\WpadNetworkName = "Network 3" mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a6-6b-26-6b-84-8e\WpadDecisionReason = "1" mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a6-6b-26-6b-84-8e\WpadDecisionTime = d0e1acf9e09bd801 mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a6-6b-26-6b-84-8e\WpadDecision = "0" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A5A17F7-137A-426E-9AC2-40F809C1E4DD} mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a6-6b-26-6b-84-8e mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A5A17F7-137A-426E-9AC2-40F809C1E4DD}\WpadDecisionReason = "1" mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A5A17F7-137A-426E-9AC2-40F809C1E4DD}\WpadDecision = "0" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvr.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1480 wrote to memory of 848 1480 rundll32.exe rundll32.exe PID 1480 wrote to memory of 848 1480 rundll32.exe rundll32.exe PID 1480 wrote to memory of 848 1480 rundll32.exe rundll32.exe PID 1480 wrote to memory of 848 1480 rundll32.exe rundll32.exe PID 1480 wrote to memory of 848 1480 rundll32.exe rundll32.exe PID 1480 wrote to memory of 848 1480 rundll32.exe rundll32.exe PID 1480 wrote to memory of 848 1480 rundll32.exe rundll32.exe PID 848 wrote to memory of 1628 848 rundll32.exe mssecsvr.exe PID 848 wrote to memory of 1628 848 rundll32.exe mssecsvr.exe PID 848 wrote to memory of 1628 848 rundll32.exe mssecsvr.exe PID 848 wrote to memory of 1628 848 rundll32.exe mssecsvr.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\eb3b370b3c7897d6a6b6616437183b4f.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\eb3b370b3c7897d6a6b6616437183b4f.dll,#12⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:848 -
C:\WINDOWS\mssecsvr.exeC:\WINDOWS\mssecsvr.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1628
-
C:\WINDOWS\mssecsvr.exeC:\WINDOWS\mssecsvr.exe -m security1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1440
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\WINDOWS\mssecsvr.exeFilesize
2.2MB
MD5e2e35b2bbd2093d5ae8996e93c5c435c
SHA1ce7c096026bbb2139d4add460c173decd8a23143
SHA2562034cd07ad01f3f741b1e45ca9ca5428ed7aa8d954d96e71c1be20b946b83f31
SHA5121f1eee8be7e8790c5a0ccc27bbbee26f847625a412147abaee680be68605b769f1e43407ddecce552d8e4ea3771bafd60c8203e3df2ab6d37acfcf4724090f7d
-
C:\Windows\mssecsvr.exeFilesize
2.2MB
MD5e2e35b2bbd2093d5ae8996e93c5c435c
SHA1ce7c096026bbb2139d4add460c173decd8a23143
SHA2562034cd07ad01f3f741b1e45ca9ca5428ed7aa8d954d96e71c1be20b946b83f31
SHA5121f1eee8be7e8790c5a0ccc27bbbee26f847625a412147abaee680be68605b769f1e43407ddecce552d8e4ea3771bafd60c8203e3df2ab6d37acfcf4724090f7d
-
C:\Windows\mssecsvr.exeFilesize
2.2MB
MD5e2e35b2bbd2093d5ae8996e93c5c435c
SHA1ce7c096026bbb2139d4add460c173decd8a23143
SHA2562034cd07ad01f3f741b1e45ca9ca5428ed7aa8d954d96e71c1be20b946b83f31
SHA5121f1eee8be7e8790c5a0ccc27bbbee26f847625a412147abaee680be68605b769f1e43407ddecce552d8e4ea3771bafd60c8203e3df2ab6d37acfcf4724090f7d
-
memory/848-54-0x0000000000000000-mapping.dmp
-
memory/848-55-0x00000000754F1000-0x00000000754F3000-memory.dmpFilesize
8KB
-
memory/1628-56-0x0000000000000000-mapping.dmp