Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
20-07-2022 01:19
Static task
static1
Behavioral task
behavioral1
Sample
06a935e7f87cf2480e3fbc605c67bab7.dll
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
06a935e7f87cf2480e3fbc605c67bab7.dll
Resource
win10v2004-20220718-en
General
-
Target
06a935e7f87cf2480e3fbc605c67bab7.dll
-
Size
5.0MB
-
MD5
06a935e7f87cf2480e3fbc605c67bab7
-
SHA1
9a4099b70455c1665c905cf86388df9e058433a5
-
SHA256
9a7fd407910092ac9920fc621865bbdd80f3385238834eb977812c664132618b
-
SHA512
5d2add3b2855d6cae3fe7dfc1a611aa13897965d06aa86e955aa32f972b4c174691627251fd7145416b3d2462088bec5932e3a6687b878b4ed3f3f7966fd8f20
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (1280) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 2 IoCs
Processes:
mssecsvr.exemssecsvr.exepid process 2000 mssecsvr.exe 852 mssecsvr.exe -
Drops file in System32 directory 1 IoCs
Processes:
mssecsvr.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvr.exe -
Drops file in Windows directory 2 IoCs
Processes:
rundll32.exemssecsvr.exedescription ioc process File created C:\WINDOWS\mssecsvr.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvr.exe -
Modifies data under HKEY_USERS 24 IoCs
Processes:
mssecsvr.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7FE2E94F-637B-4C2C-95FD-29127F6AB952} mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7FE2E94F-637B-4C2C-95FD-29127F6AB952}\WpadDecision = "0" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-af-97-1f-78-77 mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-af-97-1f-78-77\WpadDecisionReason = "1" mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-af-97-1f-78-77\WpadDecision = "0" mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7FE2E94F-637B-4C2C-95FD-29127F6AB952}\WpadDecisionReason = "1" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7FE2E94F-637B-4C2C-95FD-29127F6AB952}\0a-af-97-1f-78-77 mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7FE2E94F-637B-4C2C-95FD-29127F6AB952}\WpadNetworkName = "Network 3" mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7FE2E94F-637B-4C2C-95FD-29127F6AB952}\WpadDecisionTime = 106d00bdd69bd801 mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00fd000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-af-97-1f-78-77\WpadDecisionTime = 106d00bdd69bd801 mssecsvr.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1856 wrote to memory of 2012 1856 rundll32.exe rundll32.exe PID 1856 wrote to memory of 2012 1856 rundll32.exe rundll32.exe PID 1856 wrote to memory of 2012 1856 rundll32.exe rundll32.exe PID 1856 wrote to memory of 2012 1856 rundll32.exe rundll32.exe PID 1856 wrote to memory of 2012 1856 rundll32.exe rundll32.exe PID 1856 wrote to memory of 2012 1856 rundll32.exe rundll32.exe PID 1856 wrote to memory of 2012 1856 rundll32.exe rundll32.exe PID 2012 wrote to memory of 2000 2012 rundll32.exe mssecsvr.exe PID 2012 wrote to memory of 2000 2012 rundll32.exe mssecsvr.exe PID 2012 wrote to memory of 2000 2012 rundll32.exe mssecsvr.exe PID 2012 wrote to memory of 2000 2012 rundll32.exe mssecsvr.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\06a935e7f87cf2480e3fbc605c67bab7.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\06a935e7f87cf2480e3fbc605c67bab7.dll,#12⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\WINDOWS\mssecsvr.exeC:\WINDOWS\mssecsvr.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2000
-
C:\WINDOWS\mssecsvr.exeC:\WINDOWS\mssecsvr.exe -m security1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:852
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\WINDOWS\mssecsvr.exeFilesize
2.2MB
MD55bdb4efdc9ed8e2f54c35ca11daee0ee
SHA1cc65e844959b6c2439d5bd2d352b473d56f73097
SHA25650dce00e3bbf1f4500aa0d8518e1ae9b826e69ba3a02d008831e5ee9f93a10ec
SHA512b727171ab3ef6e74d2eb85d2922f428158449ebea6a1ee0cc23239c2adc0875a13bcf62f8be0eebee08b74f6546e0efe2768a8fcad4dc9163bd1f5ae38d87639
-
C:\Windows\mssecsvr.exeFilesize
2.2MB
MD55bdb4efdc9ed8e2f54c35ca11daee0ee
SHA1cc65e844959b6c2439d5bd2d352b473d56f73097
SHA25650dce00e3bbf1f4500aa0d8518e1ae9b826e69ba3a02d008831e5ee9f93a10ec
SHA512b727171ab3ef6e74d2eb85d2922f428158449ebea6a1ee0cc23239c2adc0875a13bcf62f8be0eebee08b74f6546e0efe2768a8fcad4dc9163bd1f5ae38d87639
-
C:\Windows\mssecsvr.exeFilesize
2.2MB
MD55bdb4efdc9ed8e2f54c35ca11daee0ee
SHA1cc65e844959b6c2439d5bd2d352b473d56f73097
SHA25650dce00e3bbf1f4500aa0d8518e1ae9b826e69ba3a02d008831e5ee9f93a10ec
SHA512b727171ab3ef6e74d2eb85d2922f428158449ebea6a1ee0cc23239c2adc0875a13bcf62f8be0eebee08b74f6546e0efe2768a8fcad4dc9163bd1f5ae38d87639
-
memory/2000-56-0x0000000000000000-mapping.dmp
-
memory/2012-54-0x0000000000000000-mapping.dmp
-
memory/2012-55-0x00000000761D1000-0x00000000761D3000-memory.dmpFilesize
8KB