Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
resource tags
arch:x64arch:x86image:win10v2004-20220414-enlocale:en-usos:windows10-2004-x64system -
submitted
20-07-2022 01:38
Static task
static1
Behavioral task
behavioral1
Sample
34d281dc1cf62696c6d3b5897243aabc.dll
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
34d281dc1cf62696c6d3b5897243aabc.dll
Resource
win10v2004-20220414-en
General
-
Target
34d281dc1cf62696c6d3b5897243aabc.dll
-
Size
5.0MB
-
MD5
34d281dc1cf62696c6d3b5897243aabc
-
SHA1
b5e94cc591d9acd1f04e16d2af251553ee561e0c
-
SHA256
b5248a20ec1173991c977fa52a8aebbae35f0123be80fe120e827cb0fb5d82cc
-
SHA512
80a8c192ce8787a4bf767e9b1a0ae60ba4cb77b88522a78e6d876fd5eb10d1eeffa8edfb99e5db82fbbdf586ac4f16af14bbbec5a95387a233f68b81254853de
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (3234) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 2 IoCs
Processes:
mssecsvr.exemssecsvr.exepid process 1432 mssecsvr.exe 4964 mssecsvr.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in Windows directory 2 IoCs
Processes:
rundll32.exemssecsvr.exedescription ioc process File created C:\WINDOWS\mssecsvr.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvr.exe -
Modifies data under HKEY_USERS 5 IoCs
Processes:
mssecsvr.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" mssecsvr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 820 wrote to memory of 4756 820 rundll32.exe rundll32.exe PID 820 wrote to memory of 4756 820 rundll32.exe rundll32.exe PID 820 wrote to memory of 4756 820 rundll32.exe rundll32.exe PID 4756 wrote to memory of 1432 4756 rundll32.exe mssecsvr.exe PID 4756 wrote to memory of 1432 4756 rundll32.exe mssecsvr.exe PID 4756 wrote to memory of 1432 4756 rundll32.exe mssecsvr.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\34d281dc1cf62696c6d3b5897243aabc.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\34d281dc1cf62696c6d3b5897243aabc.dll,#12⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\WINDOWS\mssecsvr.exeC:\WINDOWS\mssecsvr.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1432
-
C:\WINDOWS\mssecsvr.exeC:\WINDOWS\mssecsvr.exe -m security1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4964
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD51c9d034deb52ac7bf38a565728d94886
SHA19459d340dbfff28b74c057a57cde24f9239129da
SHA256c4a371863414f04f0ed7b2028094823301bcbea4f40e7f94104046c98d315fd8
SHA512a673e2c6140bf3ce005edd3ebdb9f92bc3118fb94e5499d6ca5c7a51261fa2059b2b677c084986400ac25d1b7497472fe390530b858d42c99408e4f6d6869d2f
-
Filesize
2.2MB
MD51c9d034deb52ac7bf38a565728d94886
SHA19459d340dbfff28b74c057a57cde24f9239129da
SHA256c4a371863414f04f0ed7b2028094823301bcbea4f40e7f94104046c98d315fd8
SHA512a673e2c6140bf3ce005edd3ebdb9f92bc3118fb94e5499d6ca5c7a51261fa2059b2b677c084986400ac25d1b7497472fe390530b858d42c99408e4f6d6869d2f
-
Filesize
2.2MB
MD51c9d034deb52ac7bf38a565728d94886
SHA19459d340dbfff28b74c057a57cde24f9239129da
SHA256c4a371863414f04f0ed7b2028094823301bcbea4f40e7f94104046c98d315fd8
SHA512a673e2c6140bf3ce005edd3ebdb9f92bc3118fb94e5499d6ca5c7a51261fa2059b2b677c084986400ac25d1b7497472fe390530b858d42c99408e4f6d6869d2f