Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
20-07-2022 01:03
Static task
static1
Behavioral task
behavioral1
Sample
9a1ae1d496ead541d17cfc3a0e3c5eef.dll
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
9a1ae1d496ead541d17cfc3a0e3c5eef.dll
Resource
win10v2004-20220718-en
General
-
Target
9a1ae1d496ead541d17cfc3a0e3c5eef.dll
-
Size
5.0MB
-
MD5
9a1ae1d496ead541d17cfc3a0e3c5eef
-
SHA1
502ca1a6a02620673685f7b55161ce7889e828aa
-
SHA256
136405b165c6eec8be85c59075f98012d8fe5cf802328e47d3228e99f5897170
-
SHA512
12f73b3ab7fe5a766dee4185f407a13039ca7123bf66a7109b81d9abda96234c91e38ed49743bb3ae2b4bdc94bc716220aad38c40a7ec47b4a46226411d02224
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (1256) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 3 IoCs
Processes:
mssecsvc.exemssecsvc.exetasksche.exepid process 316 mssecsvc.exe 1360 mssecsvc.exe 1340 tasksche.exe -
Drops file in System32 directory 1 IoCs
Processes:
mssecsvc.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvc.exe -
Drops file in Windows directory 2 IoCs
Processes:
rundll32.exemssecsvc.exedescription ioc process File created C:\WINDOWS\mssecsvc.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvc.exe -
Modifies data under HKEY_USERS 24 IoCs
Processes:
mssecsvc.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{47005D75-3E5B-451B-A1EC-E55F5036B8F1}\WpadDecisionTime = e054f17fd49bd801 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{47005D75-3E5B-451B-A1EC-E55F5036B8F1}\WpadDecision = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0103000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{47005D75-3E5B-451B-A1EC-E55F5036B8F1}\WpadNetworkName = "Network 3" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\96-4f-74-58-7d-c3 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\96-4f-74-58-7d-c3\WpadDecisionReason = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\96-4f-74-58-7d-c3\WpadDecision = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{47005D75-3E5B-451B-A1EC-E55F5036B8F1}\96-4f-74-58-7d-c3 mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\96-4f-74-58-7d-c3\WpadDecisionTime = e054f17fd49bd801 mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{47005D75-3E5B-451B-A1EC-E55F5036B8F1} mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{47005D75-3E5B-451B-A1EC-E55F5036B8F1}\WpadDecisionReason = "1" mssecsvc.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 2008 wrote to memory of 2020 2008 rundll32.exe rundll32.exe PID 2008 wrote to memory of 2020 2008 rundll32.exe rundll32.exe PID 2008 wrote to memory of 2020 2008 rundll32.exe rundll32.exe PID 2008 wrote to memory of 2020 2008 rundll32.exe rundll32.exe PID 2008 wrote to memory of 2020 2008 rundll32.exe rundll32.exe PID 2008 wrote to memory of 2020 2008 rundll32.exe rundll32.exe PID 2008 wrote to memory of 2020 2008 rundll32.exe rundll32.exe PID 2020 wrote to memory of 316 2020 rundll32.exe mssecsvc.exe PID 2020 wrote to memory of 316 2020 rundll32.exe mssecsvc.exe PID 2020 wrote to memory of 316 2020 rundll32.exe mssecsvc.exe PID 2020 wrote to memory of 316 2020 rundll32.exe mssecsvc.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9a1ae1d496ead541d17cfc3a0e3c5eef.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9a1ae1d496ead541d17cfc3a0e3c5eef.dll,#12⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:316 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i4⤵
- Executes dropped EXE
PID:1340
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1360
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\WINDOWS\mssecsvc.exeFilesize
3.6MB
MD57a4e4cd532a9916b9fd9d9a716629b54
SHA11f4acecf328d030b4d112bae17e76722672e8566
SHA256c7db8417f567a78f29a2f51271d9f06f04bdb6e6ae69af3e6ae41559e402683c
SHA512ffa8e059add74c35e1437c4d0786dbc3a43162663f775b2b106c81488fad137e4c36478f2cd4f5c9b8aad8fcf1ef80346c6654902a71ce18d001c098c5119a1d
-
C:\Windows\mssecsvc.exeFilesize
3.6MB
MD57a4e4cd532a9916b9fd9d9a716629b54
SHA11f4acecf328d030b4d112bae17e76722672e8566
SHA256c7db8417f567a78f29a2f51271d9f06f04bdb6e6ae69af3e6ae41559e402683c
SHA512ffa8e059add74c35e1437c4d0786dbc3a43162663f775b2b106c81488fad137e4c36478f2cd4f5c9b8aad8fcf1ef80346c6654902a71ce18d001c098c5119a1d
-
C:\Windows\mssecsvc.exeFilesize
3.6MB
MD57a4e4cd532a9916b9fd9d9a716629b54
SHA11f4acecf328d030b4d112bae17e76722672e8566
SHA256c7db8417f567a78f29a2f51271d9f06f04bdb6e6ae69af3e6ae41559e402683c
SHA512ffa8e059add74c35e1437c4d0786dbc3a43162663f775b2b106c81488fad137e4c36478f2cd4f5c9b8aad8fcf1ef80346c6654902a71ce18d001c098c5119a1d
-
C:\Windows\tasksche.exeFilesize
3.4MB
MD598f29c78a11cd9ef33dd088279be1546
SHA16044a0e9c0beea4014cde01967d8dff9bb4fa4ca
SHA2566c265b91de4cbd01931120236dd412fed943a774ba11de9f86d55a395838a042
SHA5122e13cb4f5e2d7848fb644f45d40370ff2269743f7995dbccaed8b9a44cb34f8de34af1b35cafebea9932500ebdafc43a6f18897465bf794923e940d807b131ab
-
memory/316-56-0x0000000000000000-mapping.dmp
-
memory/2020-54-0x0000000000000000-mapping.dmp
-
memory/2020-55-0x0000000075791000-0x0000000075793000-memory.dmpFilesize
8KB