Analysis
- max time kernel
151s - max time network
154s - platform
windows7_x64 - resource
win7-20220715-en - resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system - submitted
20/07/2022, 01:03
Static task
static1
Behavioral task
behavioral1
Sample
9a1ae1d496ead541d17cfc3a0e3c5eef.dll
Resource
win7-20220715-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
9a1ae1d496ead541d17cfc3a0e3c5eef.dll
Resource
win10v2004-20220718-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 9a1ae1d496ead541d17cfc3a0e3c5eef.dll
- Size 5.0MB
- Sample220720-becrmsadhq
- SHA256 136405b165c6eec8be85c59075f98012d8fe5cf802328e47d3228e99f5897170
- MD5 9a1ae1d496ead541d17cfc3a0e3c5eef
- SHA1 502ca1a6a02620673685f7b55161ce7889e828aa
- SHA512 12f73b3ab7fe5a766dee4185f407a13039ca7123bf66a7109b81d9abda96234c91e38ed49743bb3ae2b4bdc94bc716220aad38c40a7ec47b4a46226411d02224
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Wannacry
WannaCry is a ransomware cryptoworm.
- Contacts a large (1256) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Executes dropped EXE 3 IoCs
pid Process 316 mssecsvc.exe 1360 mssecsvc.exe 1340 tasksche.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvc.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\WINDOWS\mssecsvc.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvc.exe - Modifies data under HKEY_USERS 24 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{47005D75-3E5B-451B-A1EC-E55F5036B8F1}\WpadDecisionTime = e054f17fd49bd801 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{47005D75-3E5B-451B-A1EC-E55F5036B8F1}\WpadDecision = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0103000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{47005D75-3E5B-451B-A1EC-E55F5036B8F1}\WpadNetworkName = "Network 3" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\96-4f-74-58-7d-c3 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\96-4f-74-58-7d-c3\WpadDecisionReason = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\96-4f-74-58-7d-c3\WpadDecision = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{47005D75-3E5B-451B-A1EC-E55F5036B8F1}\96-4f-74-58-7d-c3 mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\96-4f-74-58-7d-c3\WpadDecisionTime = e054f17fd49bd801 mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{47005D75-3E5B-451B-A1EC-E55F5036B8F1} mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{47005D75-3E5B-451B-A1EC-E55F5036B8F1}\WpadDecisionReason = "1" mssecsvc.exe - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2008 wrote to memory of 2020 2008 rundll32.exe 27 PID 2008 wrote to memory of 2020 2008 rundll32.exe 27 PID 2008 wrote to memory of 2020 2008 rundll32.exe 27 PID 2008 wrote to memory of 2020 2008 rundll32.exe 27 PID 2008 wrote to memory of 2020 2008 rundll32.exe 27 PID 2008 wrote to memory of 2020 2008 rundll32.exe 27 PID 2008 wrote to memory of 2020 2008 rundll32.exe 27 PID 2020 wrote to memory of 316 2020 rundll32.exe 28 PID 2020 wrote to memory of 316 2020 rundll32.exe 28 PID 2020 wrote to memory of 316 2020 rundll32.exe 28 PID 2020 wrote to memory of 316 2020 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9a1ae1d496ead541d17cfc3a0e3c5eef.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9a1ae1d496ead541d17cfc3a0e3c5eef.dll,#12⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:316 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i4⤵
- Executes dropped EXE
PID:1340
-
-
-
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1360
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\WINDOWS\mssecsvc.exe
- Size 3.6MB
- SHA256 c7db8417f567a78f29a2f51271d9f06f04bdb6e6ae69af3e6ae41559e402683c
- MD5 7a4e4cd532a9916b9fd9d9a716629b54
- SHA1 1f4acecf328d030b4d112bae17e76722672e8566
- SHA512 ffa8e059add74c35e1437c4d0786dbc3a43162663f775b2b106c81488fad137e4c36478f2cd4f5c9b8aad8fcf1ef80346c6654902a71ce18d001c098c5119a1d
- SSDEEP 98304:yDqPoBBz1aRxcSUZk36SAEdhvxWa9P593R8yAVp2HI:yDqP+1Cxc7k3ZAEUadzR8yc4HI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mssecsvc.exe
- Size 3.6MB
- SHA256 c7db8417f567a78f29a2f51271d9f06f04bdb6e6ae69af3e6ae41559e402683c
- MD5 7a4e4cd532a9916b9fd9d9a716629b54
- SHA1 1f4acecf328d030b4d112bae17e76722672e8566
- SHA512 ffa8e059add74c35e1437c4d0786dbc3a43162663f775b2b106c81488fad137e4c36478f2cd4f5c9b8aad8fcf1ef80346c6654902a71ce18d001c098c5119a1d
- SSDEEP 98304:yDqPoBBz1aRxcSUZk36SAEdhvxWa9P593R8yAVp2HI:yDqP+1Cxc7k3ZAEUadzR8yc4HI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mssecsvc.exe
- Size 3.6MB
- SHA256 c7db8417f567a78f29a2f51271d9f06f04bdb6e6ae69af3e6ae41559e402683c
- MD5 7a4e4cd532a9916b9fd9d9a716629b54
- SHA1 1f4acecf328d030b4d112bae17e76722672e8566
- SHA512 ffa8e059add74c35e1437c4d0786dbc3a43162663f775b2b106c81488fad137e4c36478f2cd4f5c9b8aad8fcf1ef80346c6654902a71ce18d001c098c5119a1d
- SSDEEP 98304:yDqPoBBz1aRxcSUZk36SAEdhvxWa9P593R8yAVp2HI:yDqP+1Cxc7k3ZAEUadzR8yc4HI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\tasksche.exe
- Size 3.4MB
- SHA256 6c265b91de4cbd01931120236dd412fed943a774ba11de9f86d55a395838a042
- MD5 98f29c78a11cd9ef33dd088279be1546
- SHA1 6044a0e9c0beea4014cde01967d8dff9bb4fa4ca
- SHA512 2e13cb4f5e2d7848fb644f45d40370ff2269743f7995dbccaed8b9a44cb34f8de34af1b35cafebea9932500ebdafc43a6f18897465bf794923e940d807b131ab
- SSDEEP 98304:QqPoBBz1aRxcSUZk36SAEdhvxWa9P593R8yAVp2Hj:QqP+1Cxc7k3ZAEUadzR8yc4Hj
- MD5 SHA1 SHA512 SSDEEP