wannacry | f3556ad1ba65d37716611a9e5878235ce20adcc41d7d99157fbb735098a95449

General

Target

b12ae9ed4b33c4dcff12b16c64a8b8c3.dll
Size

5.0MB
MD5

b12ae9ed4b33c4dcff12b16c64a8b8c3
SHA1

8117bccc6a6361565660f8fbfb459cb35402647e
SHA256

f3556ad1ba65d37716611a9e5878235ce20adcc41d7d99157fbb735098a95449
SHA512

4efb484a564ba530a0702bbb7fc6a24093d6079d71cf5e110cb8f174bde12bc93a57be0ccb40f6e2f1f01cea3d9d548b59ff1500be701e859f9b820854017ff8

Score

10^/10

wannacry discovery evasion ransomware worm

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

mssecsvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	mssecsvc.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\WINDOWS\mssecsvc.exe = "C:\\WINDOWS\\mssecsvc.exe:*:enabled:@shell32.dll,-1"	mssecsvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	mssecsvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	mssecsvc.exe

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3012) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Drops file in Drivers directory 1 IoCs

Processes:

mssecsvc.exe

description ioc process

File opened for modification C:\Windows\system32\DRIVERS\ETC\HOSTS mssecsvc.exe
Executes dropped EXE 2 IoCs

Processes:

mssecsvc.exemssecsvc.exe

pid process

3792 mssecsvc.exe
1832 mssecsvc.exe
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Drops file in Windows directory 2 IoCs

Processes:

rundll32.exemssecsvc.exe

description ioc process

File created C:\WINDOWS\mssecsvc.exe rundll32.exe
File created C:\WINDOWS\tasksche.exe mssecsvc.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2508 3792 WerFault.exe mssecsvc.exe

description	ioc	process
File opened for modification	C:\Windows\system32\DRIVERS\ETC\HOSTS	mssecsvc.exe

description	ioc	process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

pid	pid_target	process	target process
2508	3792	WerFault.exe	mssecsvc.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

mssecsvc.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

mssecsvc.exemssecsvc.exe

pid process

3792 mssecsvc.exe
3792 mssecsvc.exe
1832 mssecsvc.exe
1832 mssecsvc.exe

Suspicious behavior: MapViewOfSection 64 IoCs

Processes:

mssecsvc.exe

pid	process
3792	mssecsvc.exe
3792	mssecsvc.exe
3792	mssecsvc.exe
3792	mssecsvc.exe
3792	mssecsvc.exe
3792	mssecsvc.exe
3792	mssecsvc.exe
3792	mssecsvc.exe
3792	mssecsvc.exe
3792	mssecsvc.exe
3792	mssecsvc.exe
3792	mssecsvc.exe
3792	mssecsvc.exe
3792	mssecsvc.exe
3792	mssecsvc.exe
3792	mssecsvc.exe
3792	mssecsvc.exe
3792	mssecsvc.exe
3792	mssecsvc.exe
3792	mssecsvc.exe
3792	mssecsvc.exe
3792	mssecsvc.exe
3792	mssecsvc.exe
3792	mssecsvc.exe
3792	mssecsvc.exe
3792	mssecsvc.exe
3792	mssecsvc.exe
3792	mssecsvc.exe
3792	mssecsvc.exe
3792	mssecsvc.exe
3792	mssecsvc.exe
3792	mssecsvc.exe
3792	mssecsvc.exe
3792	mssecsvc.exe
3792	mssecsvc.exe
3792	mssecsvc.exe
3792	mssecsvc.exe
3792	mssecsvc.exe
3792	mssecsvc.exe
3792	mssecsvc.exe
3792	mssecsvc.exe
3792	mssecsvc.exe
3792	mssecsvc.exe
3792	mssecsvc.exe
3792	mssecsvc.exe
3792	mssecsvc.exe
3792	mssecsvc.exe
3792	mssecsvc.exe
3792	mssecsvc.exe
3792	mssecsvc.exe
3792	mssecsvc.exe
3792	mssecsvc.exe
3792	mssecsvc.exe
3792	mssecsvc.exe
3792	mssecsvc.exe
3792	mssecsvc.exe
3792	mssecsvc.exe
3792	mssecsvc.exe
3792	mssecsvc.exe
3792	mssecsvc.exe
3792	mssecsvc.exe
3792	mssecsvc.exe
3792	mssecsvc.exe
3792	mssecsvc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

mssecsvc.exemssecsvc.exe

description pid process

Token: SeDebugPrivilege 3792 mssecsvc.exe
Token: SeDebugPrivilege 1832 mssecsvc.exe

description	pid	process
Token: SeDebugPrivilege	3792	mssecsvc.exe
Token: SeDebugPrivilege	1832	mssecsvc.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

rundll32.exerundll32.exemssecsvc.exe

description	pid	process	target process
PID 2136 wrote to memory of 4656	2136	rundll32.exe	rundll32.exe
PID 2136 wrote to memory of 4656	2136	rundll32.exe	rundll32.exe
PID 2136 wrote to memory of 4656	2136	rundll32.exe	rundll32.exe
PID 4656 wrote to memory of 3792	4656	rundll32.exe	mssecsvc.exe
PID 4656 wrote to memory of 3792	4656	rundll32.exe	mssecsvc.exe
PID 4656 wrote to memory of 3792	4656	rundll32.exe	mssecsvc.exe
PID 3792 wrote to memory of 628	3792	mssecsvc.exe	winlogon.exe
PID 3792 wrote to memory of 628	3792	mssecsvc.exe	winlogon.exe
PID 3792 wrote to memory of 628	3792	mssecsvc.exe	winlogon.exe
PID 3792 wrote to memory of 628	3792	mssecsvc.exe	winlogon.exe
PID 3792 wrote to memory of 628	3792	mssecsvc.exe	winlogon.exe
PID 3792 wrote to memory of 628	3792	mssecsvc.exe	winlogon.exe
PID 3792 wrote to memory of 684	3792	mssecsvc.exe	lsass.exe
PID 3792 wrote to memory of 684	3792	mssecsvc.exe	lsass.exe
PID 3792 wrote to memory of 684	3792	mssecsvc.exe	lsass.exe
PID 3792 wrote to memory of 684	3792	mssecsvc.exe	lsass.exe
PID 3792 wrote to memory of 684	3792	mssecsvc.exe	lsass.exe
PID 3792 wrote to memory of 684	3792	mssecsvc.exe	lsass.exe
PID 3792 wrote to memory of 788	3792	mssecsvc.exe	svchost.exe
PID 3792 wrote to memory of 788	3792	mssecsvc.exe	svchost.exe
PID 3792 wrote to memory of 788	3792	mssecsvc.exe	svchost.exe
PID 3792 wrote to memory of 788	3792	mssecsvc.exe	svchost.exe
PID 3792 wrote to memory of 788	3792	mssecsvc.exe	svchost.exe
PID 3792 wrote to memory of 788	3792	mssecsvc.exe	svchost.exe
PID 3792 wrote to memory of 796	3792	mssecsvc.exe	fontdrvhost.exe
PID 3792 wrote to memory of 796	3792	mssecsvc.exe	fontdrvhost.exe
PID 3792 wrote to memory of 796	3792	mssecsvc.exe	fontdrvhost.exe
PID 3792 wrote to memory of 796	3792	mssecsvc.exe	fontdrvhost.exe
PID 3792 wrote to memory of 796	3792	mssecsvc.exe	fontdrvhost.exe
PID 3792 wrote to memory of 796	3792	mssecsvc.exe	fontdrvhost.exe
PID 3792 wrote to memory of 804	3792	mssecsvc.exe	fontdrvhost.exe
PID 3792 wrote to memory of 804	3792	mssecsvc.exe	fontdrvhost.exe
PID 3792 wrote to memory of 804	3792	mssecsvc.exe	fontdrvhost.exe
PID 3792 wrote to memory of 804	3792	mssecsvc.exe	fontdrvhost.exe
PID 3792 wrote to memory of 804	3792	mssecsvc.exe	fontdrvhost.exe
PID 3792 wrote to memory of 804	3792	mssecsvc.exe	fontdrvhost.exe
PID 3792 wrote to memory of 912	3792	mssecsvc.exe	svchost.exe
PID 3792 wrote to memory of 912	3792	mssecsvc.exe	svchost.exe
PID 3792 wrote to memory of 912	3792	mssecsvc.exe	svchost.exe
PID 3792 wrote to memory of 912	3792	mssecsvc.exe	svchost.exe
PID 3792 wrote to memory of 912	3792	mssecsvc.exe	svchost.exe
PID 3792 wrote to memory of 912	3792	mssecsvc.exe	svchost.exe
PID 3792 wrote to memory of 964	3792	mssecsvc.exe	svchost.exe
PID 3792 wrote to memory of 964	3792	mssecsvc.exe	svchost.exe
PID 3792 wrote to memory of 964	3792	mssecsvc.exe	svchost.exe
PID 3792 wrote to memory of 964	3792	mssecsvc.exe	svchost.exe
PID 3792 wrote to memory of 964	3792	mssecsvc.exe	svchost.exe
PID 3792 wrote to memory of 964	3792	mssecsvc.exe	svchost.exe
PID 3792 wrote to memory of 316	3792	mssecsvc.exe	dwm.exe
PID 3792 wrote to memory of 316	3792	mssecsvc.exe	dwm.exe
PID 3792 wrote to memory of 316	3792	mssecsvc.exe	dwm.exe
PID 3792 wrote to memory of 316	3792	mssecsvc.exe	dwm.exe
PID 3792 wrote to memory of 316	3792	mssecsvc.exe	dwm.exe
PID 3792 wrote to memory of 316	3792	mssecsvc.exe	dwm.exe
PID 3792 wrote to memory of 532	3792	mssecsvc.exe	svchost.exe
PID 3792 wrote to memory of 532	3792	mssecsvc.exe	svchost.exe
PID 3792 wrote to memory of 532	3792	mssecsvc.exe	svchost.exe
PID 3792 wrote to memory of 532	3792	mssecsvc.exe	svchost.exe
PID 3792 wrote to memory of 532	3792	mssecsvc.exe	svchost.exe
PID 3792 wrote to memory of 532	3792	mssecsvc.exe	svchost.exe
PID 3792 wrote to memory of 824	3792	mssecsvc.exe	svchost.exe
PID 3792 wrote to memory of 824	3792	mssecsvc.exe	svchost.exe
PID 3792 wrote to memory of 824	3792	mssecsvc.exe	svchost.exe
PID 3792 wrote to memory of 824	3792	mssecsvc.exe	svchost.exe

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:684

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:628

C:\Windows\system32\dwm.exe
"dwm.exe"
2⤵
PID:316

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
2⤵
PID:804

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:788

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
2⤵
PID:3412

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
2⤵
PID:3348

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca
2⤵
PID:4652

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
2⤵
PID:2668

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
2⤵
PID:2076

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
2⤵
PID:4648

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
2⤵
PID:1372

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
2⤵
PID:3132

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
2⤵
PID:3860

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
2⤵
PID:3708

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
2⤵
PID:3492

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
2⤵
PID:3260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:532

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:824

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:928

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1052

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4140

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:4852

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:3208

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:1676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:536

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:8

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1880

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b12ae9ed4b33c4dcff12b16c64a8b8c3.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2136

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b12ae9ed4b33c4dcff12b16c64a8b8c3.dll,#1
3⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4656

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe
4⤵
- Modifies firewall policy service
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3792 -s 1416
5⤵
- Program crash
PID:2508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2684

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2636

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2572

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2368

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2152

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2064

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1860

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2000

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1928

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1916

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1852

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1788

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1656

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1584

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1444

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1288

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1276

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1248

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1188

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1148

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:912

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:796

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3792 -ip 3792
1⤵
PID:5084

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Network Service Scanning

2

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\mssecsvc.exe
Filesize
3.6MB

MD5
0e15647159daedbe07822b6f72676d01

SHA1
21fb5ae3f42fde4e681adc70b49a53b3a8b40bb5

SHA256
d161364ae27218f3349a0e751b4aa40e3ab08fc09b1109bcce437c0e0478364b

SHA512
dc9b54d4245f2d46c5e7fb0fb5f373bc303f8bbfda82368b407a46caf03223c3e4cb3d8a1e32ce22e8dd72adce05dbf2abbe87f042f5e00352137411f4907fd3

Download Submit
C:\Windows\mssecsvc.exe
Filesize
3.6MB

MD5
0e15647159daedbe07822b6f72676d01

SHA1
21fb5ae3f42fde4e681adc70b49a53b3a8b40bb5

SHA256
d161364ae27218f3349a0e751b4aa40e3ab08fc09b1109bcce437c0e0478364b

SHA512
dc9b54d4245f2d46c5e7fb0fb5f373bc303f8bbfda82368b407a46caf03223c3e4cb3d8a1e32ce22e8dd72adce05dbf2abbe87f042f5e00352137411f4907fd3

Download Submit
C:\Windows\mssecsvc.exe
Filesize
3.6MB

MD5
0e15647159daedbe07822b6f72676d01

SHA1
21fb5ae3f42fde4e681adc70b49a53b3a8b40bb5

SHA256
d161364ae27218f3349a0e751b4aa40e3ab08fc09b1109bcce437c0e0478364b

SHA512
dc9b54d4245f2d46c5e7fb0fb5f373bc303f8bbfda82368b407a46caf03223c3e4cb3d8a1e32ce22e8dd72adce05dbf2abbe87f042f5e00352137411f4907fd3

Download Submit
memory/1832-136-0x0000000000400000-0x0000000000A70000-memory.dmp

Filesize
6.4MB

Download
memory/1832-140-0x0000000000400000-0x0000000000A70000-memory.dmp

Filesize
6.4MB

Download
memory/3792-131-0x0000000000000000-mapping.dmp

Download
memory/3792-134-0x0000000000400000-0x0000000000A70000-memory.dmp

Filesize
6.4MB

Download
memory/3792-137-0x000000007FE30000-0x000000007FE3A000-memory.dmp

Filesize
40KB

Download
memory/3792-138-0x0000000000400000-0x0000000000A70000-memory.dmp

Filesize
6.4MB

Download
memory/3792-139-0x000000007FE30000-0x000000007FE3A000-memory.dmp

Filesize
40KB

Download
memory/4656-130-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads