Analysis
-
max time kernel
153s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220718-en -
resource tags
arch:x64arch:x86image:win10v2004-20220718-enlocale:en-usos:windows10-2004-x64system -
submitted
20-07-2022 01:18
Static task
static1
Behavioral task
behavioral1
Sample
7cf21cdad3e9afe55c93277c8a6bdf05.dll
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
7cf21cdad3e9afe55c93277c8a6bdf05.dll
Resource
win10v2004-20220718-en
General
-
Target
7cf21cdad3e9afe55c93277c8a6bdf05.dll
-
Size
5.0MB
-
MD5
7cf21cdad3e9afe55c93277c8a6bdf05
-
SHA1
62b524d643680feb04e3b779236852f05204b0b5
-
SHA256
dc91b3c7e34025c093ace464aea3c2ce961c90032a61d8b861f35423b2784fcb
-
SHA512
159cb8929ca242dd03bd40c6041c0f2554ddf18c6e4442c70e7b2c906dda5590482867b3673c1550c57530581c30091431d44864a02f4b9dc4c9aa371480d3d9
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (3115) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 3 IoCs
Processes:
mssecsvc.exemssecsvc.exetasksche.exepid process 2356 mssecsvc.exe 2980 mssecsvc.exe 2248 tasksche.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in Windows directory 2 IoCs
Processes:
rundll32.exemssecsvc.exedescription ioc process File created C:\WINDOWS\mssecsvc.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvc.exe -
Modifies data under HKEY_USERS 5 IoCs
Processes:
mssecsvc.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" mssecsvc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 3612 wrote to memory of 2188 3612 rundll32.exe rundll32.exe PID 3612 wrote to memory of 2188 3612 rundll32.exe rundll32.exe PID 3612 wrote to memory of 2188 3612 rundll32.exe rundll32.exe PID 2188 wrote to memory of 2356 2188 rundll32.exe mssecsvc.exe PID 2188 wrote to memory of 2356 2188 rundll32.exe mssecsvc.exe PID 2188 wrote to memory of 2356 2188 rundll32.exe mssecsvc.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7cf21cdad3e9afe55c93277c8a6bdf05.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7cf21cdad3e9afe55c93277c8a6bdf05.dll,#12⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i4⤵
- Executes dropped EXE
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\WINDOWS\mssecsvc.exeFilesize
3.6MB
MD5487517773cf300fa7aec3e686fb5f239
SHA115bde3458a80106ce367774ad51f210d7a83ed16
SHA256c16ea664482d60d4709e7adf66c20a1bd0e7770c2b16f1c7b4eccb9802ebe8c3
SHA512da5a8cd79586a0acb3906be6e28655f95c1484aa49810ef9faaee6d39d2c67630c3861b4aaad43c483fa9035fb8f8a20a94751ac065928cb578eca3cdbf59a68
-
C:\Windows\mssecsvc.exeFilesize
3.6MB
MD5487517773cf300fa7aec3e686fb5f239
SHA115bde3458a80106ce367774ad51f210d7a83ed16
SHA256c16ea664482d60d4709e7adf66c20a1bd0e7770c2b16f1c7b4eccb9802ebe8c3
SHA512da5a8cd79586a0acb3906be6e28655f95c1484aa49810ef9faaee6d39d2c67630c3861b4aaad43c483fa9035fb8f8a20a94751ac065928cb578eca3cdbf59a68
-
C:\Windows\mssecsvc.exeFilesize
3.6MB
MD5487517773cf300fa7aec3e686fb5f239
SHA115bde3458a80106ce367774ad51f210d7a83ed16
SHA256c16ea664482d60d4709e7adf66c20a1bd0e7770c2b16f1c7b4eccb9802ebe8c3
SHA512da5a8cd79586a0acb3906be6e28655f95c1484aa49810ef9faaee6d39d2c67630c3861b4aaad43c483fa9035fb8f8a20a94751ac065928cb578eca3cdbf59a68
-
C:\Windows\tasksche.exeFilesize
3.4MB
MD58728773b11617f5823f8bd3824bdd40d
SHA194e25218bbc2c748797d22d610ecc08f3b03d94d
SHA256e39123f4e7c1b2cbc62e1a79d0b396c48f894c6f82f978a519cf23d77c0c77c1
SHA5129f93aebce8d2502ac0591f0b0f2fe49924cd0a2fe04faace50931b46f5901c570f313e9b4a8136ec169a1cd494f05a0bd1db280a8b7e4763ea8bb269be1a658a
-
memory/2188-130-0x0000000000000000-mapping.dmp
-
memory/2356-131-0x0000000000000000-mapping.dmp