Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
20-07-2022 01:16
Static task
static1
Behavioral task
behavioral1
Sample
226bc9bf49ebc95bfcf27565897de584.dll
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
226bc9bf49ebc95bfcf27565897de584.dll
Resource
win10v2004-20220718-en
General
-
Target
226bc9bf49ebc95bfcf27565897de584.dll
-
Size
5.0MB
-
MD5
226bc9bf49ebc95bfcf27565897de584
-
SHA1
083d6f6cf152a6c23d5184a632a10336f584586c
-
SHA256
50601aefc90eeec3293a8ff01cdc838eb467b39baa4d821b488bde72a0cff2d0
-
SHA512
cf963c0f3fdaf2e438fe52d479a33e3daecda14b4013d9fc9f3168d2102b9597ea1ccfdcb12d789bc5c61537eecd0ec3113a71d036d7494533a2e1f86fef61a1
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (1274) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 2 IoCs
Processes:
mssecsvr.exemssecsvr.exepid process 1452 mssecsvr.exe 1408 mssecsvr.exe -
Drops file in System32 directory 1 IoCs
Processes:
mssecsvr.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvr.exe -
Drops file in Windows directory 2 IoCs
Processes:
rundll32.exemssecsvr.exedescription ioc process File created C:\WINDOWS\mssecsvr.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvr.exe -
Modifies data under HKEY_USERS 24 IoCs
Processes:
mssecsvr.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\22-26-7f-50-2d-c5\WpadDecision = "0" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3C30BD6C-E442-4C4B-8171-8241858DD52E}\22-26-7f-50-2d-c5 mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3C30BD6C-E442-4C4B-8171-8241858DD52E} mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3C30BD6C-E442-4C4B-8171-8241858DD52E}\WpadDecisionReason = "1" mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\22-26-7f-50-2d-c5\WpadDecisionTime = a05aac14e79bd801 mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3C30BD6C-E442-4C4B-8171-8241858DD52E}\WpadDecision = "0" mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3C30BD6C-E442-4C4B-8171-8241858DD52E}\WpadNetworkName = "Network 3" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\22-26-7f-50-2d-c5 mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00d2000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3C30BD6C-E442-4C4B-8171-8241858DD52E}\WpadDecisionTime = a05aac14e79bd801 mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\22-26-7f-50-2d-c5\WpadDecisionReason = "1" mssecsvr.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1920 wrote to memory of 896 1920 rundll32.exe rundll32.exe PID 1920 wrote to memory of 896 1920 rundll32.exe rundll32.exe PID 1920 wrote to memory of 896 1920 rundll32.exe rundll32.exe PID 1920 wrote to memory of 896 1920 rundll32.exe rundll32.exe PID 1920 wrote to memory of 896 1920 rundll32.exe rundll32.exe PID 1920 wrote to memory of 896 1920 rundll32.exe rundll32.exe PID 1920 wrote to memory of 896 1920 rundll32.exe rundll32.exe PID 896 wrote to memory of 1452 896 rundll32.exe mssecsvr.exe PID 896 wrote to memory of 1452 896 rundll32.exe mssecsvr.exe PID 896 wrote to memory of 1452 896 rundll32.exe mssecsvr.exe PID 896 wrote to memory of 1452 896 rundll32.exe mssecsvr.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\226bc9bf49ebc95bfcf27565897de584.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\226bc9bf49ebc95bfcf27565897de584.dll,#12⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\WINDOWS\mssecsvr.exeC:\WINDOWS\mssecsvr.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\WINDOWS\mssecsvr.exeC:\WINDOWS\mssecsvr.exe -m security1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\WINDOWS\mssecsvr.exeFilesize
2.2MB
MD5fc24c0d4be45c404a3f1df284dd4587c
SHA1287ffd59c71e9bca5d40d0c23498564e8bd13465
SHA256274e1b4dff5c9312061a6c6ccfd7bc7d21f26b4202baac5f5c78be2670b7f767
SHA512e04ae529de12b4808fd86b43774cdaa70ef57f6c124a50e2d9ad5ab77cd8c76927574b08accb9c72156b26941363b30e8dcbeb9d3626f1a41b0f2083862f2c72
-
C:\Windows\mssecsvr.exeFilesize
2.2MB
MD5fc24c0d4be45c404a3f1df284dd4587c
SHA1287ffd59c71e9bca5d40d0c23498564e8bd13465
SHA256274e1b4dff5c9312061a6c6ccfd7bc7d21f26b4202baac5f5c78be2670b7f767
SHA512e04ae529de12b4808fd86b43774cdaa70ef57f6c124a50e2d9ad5ab77cd8c76927574b08accb9c72156b26941363b30e8dcbeb9d3626f1a41b0f2083862f2c72
-
C:\Windows\mssecsvr.exeFilesize
2.2MB
MD5fc24c0d4be45c404a3f1df284dd4587c
SHA1287ffd59c71e9bca5d40d0c23498564e8bd13465
SHA256274e1b4dff5c9312061a6c6ccfd7bc7d21f26b4202baac5f5c78be2670b7f767
SHA512e04ae529de12b4808fd86b43774cdaa70ef57f6c124a50e2d9ad5ab77cd8c76927574b08accb9c72156b26941363b30e8dcbeb9d3626f1a41b0f2083862f2c72
-
memory/896-54-0x0000000000000000-mapping.dmp
-
memory/896-55-0x0000000075BB1000-0x0000000075BB3000-memory.dmpFilesize
8KB
-
memory/1452-56-0x0000000000000000-mapping.dmp