Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
20-07-2022 01:51
Static task
static1
Behavioral task
behavioral1
Sample
5b854915957fef1940e0b69b6790ddf4.dll
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
5b854915957fef1940e0b69b6790ddf4.dll
Resource
win10v2004-20220718-en
General
-
Target
5b854915957fef1940e0b69b6790ddf4.dll
-
Size
5.0MB
-
MD5
5b854915957fef1940e0b69b6790ddf4
-
SHA1
708d87a0cb3d0c4d74cbfb0c2f8e4f52988e09af
-
SHA256
2105a603cde9895fbd0f4161a037dc0202f401e3a37ecc248e9adeea4157cfc7
-
SHA512
f7e0d1e2c48781d17830a3ca6c13d1ffbc0fac53d0c638815fd0065ad8117cd22f19672a709dfdc540557e11a87e6f63968c521d7560bdceab100f4097ac63bf
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (1257) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 2 IoCs
Processes:
mssecsvc.exemssecsvc.exepid process 1552 mssecsvc.exe 1704 mssecsvc.exe -
Drops file in System32 directory 1 IoCs
Processes:
mssecsvc.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvc.exe -
Drops file in Windows directory 2 IoCs
Processes:
rundll32.exemssecsvc.exedescription ioc process File created C:\WINDOWS\mssecsvc.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvc.exe -
Modifies data under HKEY_USERS 24 IoCs
Processes:
mssecsvc.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FEE85162-85AC-4B46-A77A-01ECC46E6CB9}\WpadDecisionReason = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FEE85162-85AC-4B46-A77A-01ECC46E6CB9}\WpadDecision = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FEE85162-85AC-4B46-A77A-01ECC46E6CB9}\32-87-5f-bb-4b-d7 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FEE85162-85AC-4B46-A77A-01ECC46E6CB9}\WpadNetworkName = "Network 2" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00e7000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-87-5f-bb-4b-d7 mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-87-5f-bb-4b-d7\WpadDecisionTime = 00dc6936db9bd801 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-87-5f-bb-4b-d7\WpadDecision = "0" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FEE85162-85AC-4B46-A77A-01ECC46E6CB9} mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FEE85162-85AC-4B46-A77A-01ECC46E6CB9}\WpadDecisionTime = 00dc6936db9bd801 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-87-5f-bb-4b-d7\WpadDecisionReason = "1" mssecsvc.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1348 wrote to memory of 904 1348 rundll32.exe rundll32.exe PID 1348 wrote to memory of 904 1348 rundll32.exe rundll32.exe PID 1348 wrote to memory of 904 1348 rundll32.exe rundll32.exe PID 1348 wrote to memory of 904 1348 rundll32.exe rundll32.exe PID 1348 wrote to memory of 904 1348 rundll32.exe rundll32.exe PID 1348 wrote to memory of 904 1348 rundll32.exe rundll32.exe PID 1348 wrote to memory of 904 1348 rundll32.exe rundll32.exe PID 904 wrote to memory of 1552 904 rundll32.exe mssecsvc.exe PID 904 wrote to memory of 1552 904 rundll32.exe mssecsvc.exe PID 904 wrote to memory of 1552 904 rundll32.exe mssecsvc.exe PID 904 wrote to memory of 1552 904 rundll32.exe mssecsvc.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5b854915957fef1940e0b69b6790ddf4.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5b854915957fef1940e0b69b6790ddf4.dll,#12⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\WINDOWS\mssecsvc.exeFilesize
3.6MB
MD527d9ced76606122077c847a395640155
SHA16a19763fa969edf9a35c2252b744c01722df960b
SHA2562b102944ee2eb37ee5eee121552b1401b948798ac37adc1fbafb60a00f509cf1
SHA512934154695063278a8fdf8485cbfbffef192c5ec8db7a059ebed585c92973400926b4a5cfddca210cb135f7147374deb148938a8b6501ecd0d38b7cdd8867e447
-
C:\Windows\mssecsvc.exeFilesize
3.6MB
MD527d9ced76606122077c847a395640155
SHA16a19763fa969edf9a35c2252b744c01722df960b
SHA2562b102944ee2eb37ee5eee121552b1401b948798ac37adc1fbafb60a00f509cf1
SHA512934154695063278a8fdf8485cbfbffef192c5ec8db7a059ebed585c92973400926b4a5cfddca210cb135f7147374deb148938a8b6501ecd0d38b7cdd8867e447
-
C:\Windows\mssecsvc.exeFilesize
3.6MB
MD527d9ced76606122077c847a395640155
SHA16a19763fa969edf9a35c2252b744c01722df960b
SHA2562b102944ee2eb37ee5eee121552b1401b948798ac37adc1fbafb60a00f509cf1
SHA512934154695063278a8fdf8485cbfbffef192c5ec8db7a059ebed585c92973400926b4a5cfddca210cb135f7147374deb148938a8b6501ecd0d38b7cdd8867e447
-
memory/904-54-0x0000000000000000-mapping.dmp
-
memory/904-55-0x00000000766A1000-0x00000000766A3000-memory.dmpFilesize
8KB
-
memory/1552-56-0x0000000000000000-mapping.dmp