Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
20-07-2022 00:39
Static task
static1
Behavioral task
behavioral1
Sample
41b7ce4931c04d964a28f41e80920cde.dll
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
41b7ce4931c04d964a28f41e80920cde.dll
Resource
win10v2004-20220414-en
General
-
Target
41b7ce4931c04d964a28f41e80920cde.dll
-
Size
5.0MB
-
MD5
41b7ce4931c04d964a28f41e80920cde
-
SHA1
2f00e3270fbcddfcb875a3ac571b00edc60ebe9d
-
SHA256
cff37b00a90722f2fdedc72e23026cd26f4eb9b020976195db481e9d7fe0e11c
-
SHA512
fc3586e89f227148a0eafebb76b44ffc61dc24aa0a4ce5cfe863c4b16340a7f900eaac7286ffeff242ba26584a8f219f01f3d9a48dcfd3eaa0e42d4c87b4a037
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (1213) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 2 IoCs
Processes:
mssecsvc.exemssecsvc.exepid process 1928 mssecsvc.exe 1328 mssecsvc.exe -
Drops file in System32 directory 1 IoCs
Processes:
mssecsvc.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvc.exe -
Drops file in Windows directory 2 IoCs
Processes:
rundll32.exemssecsvc.exedescription ioc process File created C:\WINDOWS\mssecsvc.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvc.exe -
Modifies data under HKEY_USERS 24 IoCs
Processes:
mssecsvc.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DDD376C1-A934-4862-A477-420673A0EB55}\WpadDecisionReason = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DDD376C1-A934-4862-A477-420673A0EB55}\WpadDecision = "0" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DDD376C1-A934-4862-A477-420673A0EB55}\WpadNetworkName = "Network 3" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DDD376C1-A934-4862-A477-420673A0EB55} mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\4a-be-6e-b9-73-90\WpadDecisionTime = 90c9cceae19bd801 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00b9000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DDD376C1-A934-4862-A477-420673A0EB55}\4a-be-6e-b9-73-90 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\4a-be-6e-b9-73-90\WpadDecision = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DDD376C1-A934-4862-A477-420673A0EB55}\WpadDecisionTime = 90c9cceae19bd801 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\4a-be-6e-b9-73-90\WpadDecisionReason = "1" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\4a-be-6e-b9-73-90 mssecsvc.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1820 wrote to memory of 880 1820 rundll32.exe rundll32.exe PID 1820 wrote to memory of 880 1820 rundll32.exe rundll32.exe PID 1820 wrote to memory of 880 1820 rundll32.exe rundll32.exe PID 1820 wrote to memory of 880 1820 rundll32.exe rundll32.exe PID 1820 wrote to memory of 880 1820 rundll32.exe rundll32.exe PID 1820 wrote to memory of 880 1820 rundll32.exe rundll32.exe PID 1820 wrote to memory of 880 1820 rundll32.exe rundll32.exe PID 880 wrote to memory of 1928 880 rundll32.exe mssecsvc.exe PID 880 wrote to memory of 1928 880 rundll32.exe mssecsvc.exe PID 880 wrote to memory of 1928 880 rundll32.exe mssecsvc.exe PID 880 wrote to memory of 1928 880 rundll32.exe mssecsvc.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\41b7ce4931c04d964a28f41e80920cde.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\41b7ce4931c04d964a28f41e80920cde.dll,#12⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:880 -
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1928
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1328
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\WINDOWS\mssecsvc.exeFilesize
3.6MB
MD5a87c7f2e97a4a589e0e2c7add3abd601
SHA1c364d17fc78edd5ee9d2f1904439c1db80b1142e
SHA256d7a01de6bf8fcf5645cf880ef3581310ded93b91b6d4928931429e03327a784c
SHA51219561f1f006dd7c8cba20276b95163515595f012a02b7f8b4cfa5a3c79ec27fad100a14253af450939a545d8708b7ce03b80fbb083b709f81c9001a2aef5ea0f
-
C:\Windows\mssecsvc.exeFilesize
3.6MB
MD5a87c7f2e97a4a589e0e2c7add3abd601
SHA1c364d17fc78edd5ee9d2f1904439c1db80b1142e
SHA256d7a01de6bf8fcf5645cf880ef3581310ded93b91b6d4928931429e03327a784c
SHA51219561f1f006dd7c8cba20276b95163515595f012a02b7f8b4cfa5a3c79ec27fad100a14253af450939a545d8708b7ce03b80fbb083b709f81c9001a2aef5ea0f
-
C:\Windows\mssecsvc.exeFilesize
3.6MB
MD5a87c7f2e97a4a589e0e2c7add3abd601
SHA1c364d17fc78edd5ee9d2f1904439c1db80b1142e
SHA256d7a01de6bf8fcf5645cf880ef3581310ded93b91b6d4928931429e03327a784c
SHA51219561f1f006dd7c8cba20276b95163515595f012a02b7f8b4cfa5a3c79ec27fad100a14253af450939a545d8708b7ce03b80fbb083b709f81c9001a2aef5ea0f
-
memory/880-54-0x0000000000000000-mapping.dmp
-
memory/880-55-0x0000000075831000-0x0000000075833000-memory.dmpFilesize
8KB
-
memory/1328-62-0x0000000000400000-0x0000000000A6B000-memory.dmpFilesize
6.4MB
-
memory/1328-65-0x0000000000400000-0x0000000000A6B000-memory.dmpFilesize
6.4MB
-
memory/1928-56-0x0000000000000000-mapping.dmp
-
memory/1928-59-0x0000000000400000-0x0000000000A6B000-memory.dmpFilesize
6.4MB
-
memory/1928-64-0x0000000000400000-0x0000000000A6B000-memory.dmpFilesize
6.4MB