Analysis
- max time kernel
151s - max time network
154s - platform
windows7_x64 - resource
win7-20220718-en - resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system - submitted
20/07/2022, 01:41
Static task
static1
Behavioral task
behavioral1
Sample
eca094ab2d325e60b301e8deba35fa8b.dll
Resource
win7-20220718-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
eca094ab2d325e60b301e8deba35fa8b.dll
Resource
win10v2004-20220414-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target eca094ab2d325e60b301e8deba35fa8b.dll
- Size 5.0MB
- Sample220720-b34v2aabf4
- SHA256 f88896ee7a238e282b6d70971f2113ee11da11ba8797d84d0f629ce0b6fbf3c5
- MD5 eca094ab2d325e60b301e8deba35fa8b
- SHA1 9c4c8e778019818b146d0659c1219e423d06ccca
- SHA512 c1703b8b131c8d1e7d62635c1862ab8a397e2722a797b83722add8200436e7a17e1da1fff64842d9e18752d02bf84f8e2c5e5ae417c8d377f1e1ab8a2a2c223d
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Wannacry
WannaCry is a ransomware cryptoworm.
- Contacts a large (1234) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Executes dropped EXE 3 IoCs
pid Process 1916 mssecsvc.exe 952 mssecsvc.exe 472 tasksche.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvc.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\WINDOWS\mssecsvc.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvc.exe - Modifies data under HKEY_USERS 24 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-41-ad-68-bd-b6\WpadDecision = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E66EE570-464A-40AE-8DEB-CEB1E506A2E9} mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E66EE570-464A-40AE-8DEB-CEB1E506A2E9}\WpadDecisionTime = 2007f992ea9bd801 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-41-ad-68-bd-b6 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00cf000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E66EE570-464A-40AE-8DEB-CEB1E506A2E9}\WpadDecision = "0" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E66EE570-464A-40AE-8DEB-CEB1E506A2E9}\WpadNetworkName = "Network 3" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-41-ad-68-bd-b6\WpadDecisionTime = 2007f992ea9bd801 mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E66EE570-464A-40AE-8DEB-CEB1E506A2E9}\WpadDecisionReason = "1" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E66EE570-464A-40AE-8DEB-CEB1E506A2E9}\0a-41-ad-68-bd-b6 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-41-ad-68-bd-b6\WpadDecisionReason = "1" mssecsvc.exe - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1616 wrote to memory of 1484 1616 rundll32.exe 27 PID 1616 wrote to memory of 1484 1616 rundll32.exe 27 PID 1616 wrote to memory of 1484 1616 rundll32.exe 27 PID 1616 wrote to memory of 1484 1616 rundll32.exe 27 PID 1616 wrote to memory of 1484 1616 rundll32.exe 27 PID 1616 wrote to memory of 1484 1616 rundll32.exe 27 PID 1616 wrote to memory of 1484 1616 rundll32.exe 27 PID 1484 wrote to memory of 1916 1484 rundll32.exe 28 PID 1484 wrote to memory of 1916 1484 rundll32.exe 28 PID 1484 wrote to memory of 1916 1484 rundll32.exe 28 PID 1484 wrote to memory of 1916 1484 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\eca094ab2d325e60b301e8deba35fa8b.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\eca094ab2d325e60b301e8deba35fa8b.dll,#12⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1916 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i4⤵
- Executes dropped EXE
PID:472
-
-
-
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:952
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\WINDOWS\mssecsvc.exe
- Size 3.6MB
- SHA256 dd554455be6d2adf8dcdf68b42c557b7d0e8e743ee2f3e0cdb0594641b45e39d
- MD5 d33cda3e33c46c8fc18d648dffd56bad
- SHA1 2805e04d687b06cf2a03c64ce1aab51549146e44
- SHA512 00b93996cf1493d593e632bfe5b9b7a95f8b549403e03f37ddf14278c8a7e248e98b80214bd166f8f653c5ecbec22ed3f1933ec87fc09222159a2557030e78b6
- SSDEEP 49152:XnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9PAMEc:XDqPoBhz1aRxcSUDk36SAEdhvxWa9P5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mssecsvc.exe
- Size 3.6MB
- SHA256 dd554455be6d2adf8dcdf68b42c557b7d0e8e743ee2f3e0cdb0594641b45e39d
- MD5 d33cda3e33c46c8fc18d648dffd56bad
- SHA1 2805e04d687b06cf2a03c64ce1aab51549146e44
- SHA512 00b93996cf1493d593e632bfe5b9b7a95f8b549403e03f37ddf14278c8a7e248e98b80214bd166f8f653c5ecbec22ed3f1933ec87fc09222159a2557030e78b6
- SSDEEP 49152:XnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9PAMEc:XDqPoBhz1aRxcSUDk36SAEdhvxWa9P5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mssecsvc.exe
- Size 3.6MB
- SHA256 dd554455be6d2adf8dcdf68b42c557b7d0e8e743ee2f3e0cdb0594641b45e39d
- MD5 d33cda3e33c46c8fc18d648dffd56bad
- SHA1 2805e04d687b06cf2a03c64ce1aab51549146e44
- SHA512 00b93996cf1493d593e632bfe5b9b7a95f8b549403e03f37ddf14278c8a7e248e98b80214bd166f8f653c5ecbec22ed3f1933ec87fc09222159a2557030e78b6
- SSDEEP 49152:XnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9PAMEc:XDqPoBhz1aRxcSUDk36SAEdhvxWa9P5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\tasksche.exe
- Size 3.4MB
- SHA256 1b88ec91307d556ca5c95dad8ab28d65e4e11b02050889fd8b850b54445feee5
- MD5 6bd49aec118f6df4e2a7076dfbabfadd
- SHA1 05304b7b4c61cf08f00f49e19cc85af9508b6ac4
- SHA512 f7c0472977984b3a5377bd095719684f2e42f28b802035144820811a7684b4e845537b334c41dc89eb765e8903d4aaf5eec76a065deac8018f5e32904696cc73
- SSDEEP 49152:nQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9PAMEc:QqPoBhz1aRxcSUDk36SAEdhvxWa9P5
- MD5 SHA1 SHA512 SSDEEP