Analysis
- max time kernel
151s - max time network
154s - platform
windows7_x64 - resource
win7-20220718-en - resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system - submitted
20/07/2022, 01:58
Static task
static1
Behavioral task
behavioral1
Sample
6927111c4d2937c06c1cc3978d2e9214.dll
Resource
win7-20220718-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
6927111c4d2937c06c1cc3978d2e9214.dll
Resource
win10v2004-20220718-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 6927111c4d2937c06c1cc3978d2e9214.dll
- Size 5.0MB
- Sample220720-cdvfqsahal
- SHA256 b610f6bae1dbd0253c508d9995d18ebdad3d985b84060ec9eaf39472d8903e2b
- MD5 6927111c4d2937c06c1cc3978d2e9214
- SHA1 66a1ee19b5b71f0011a887f971ff1243daf7c63e
- SHA512 4244c666e87d4a4e0b409fffbb58c2734b954a62d9546fb7fb5558ac9da0f949648f4c7237876a8fc7f226f7fa479b791c626d375900cd2f354417f986adde6e
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Wannacry
WannaCry is a ransomware cryptoworm.
- Contacts a large (1227) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Executes dropped EXE 2 IoCs
pid Process 1364 mssecsvr.exe 2028 mssecsvr.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvr.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\WINDOWS\mssecsvr.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvr.exe - Modifies data under HKEY_USERS 24 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-75-a7-dd-b9-dc\WpadDecisionReason = "1" mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-75-a7-dd-b9-dc\WpadDecisionTime = b0623df2ec9bd801 mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00cd000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2E9134DB-3C23-4031-8933-B00BB05E13E0}\WpadDecision = "0" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2E9134DB-3C23-4031-8933-B00BB05E13E0}\06-75-a7-dd-b9-dc mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2E9134DB-3C23-4031-8933-B00BB05E13E0} mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2E9134DB-3C23-4031-8933-B00BB05E13E0}\WpadDecisionReason = "1" mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-75-a7-dd-b9-dc\WpadDecision = "0" mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2E9134DB-3C23-4031-8933-B00BB05E13E0}\WpadDecisionTime = b0623df2ec9bd801 mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2E9134DB-3C23-4031-8933-B00BB05E13E0}\WpadNetworkName = "Network 3" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-75-a7-dd-b9-dc mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mssecsvr.exe - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1800 wrote to memory of 1224 1800 rundll32.exe 27 PID 1800 wrote to memory of 1224 1800 rundll32.exe 27 PID 1800 wrote to memory of 1224 1800 rundll32.exe 27 PID 1800 wrote to memory of 1224 1800 rundll32.exe 27 PID 1800 wrote to memory of 1224 1800 rundll32.exe 27 PID 1800 wrote to memory of 1224 1800 rundll32.exe 27 PID 1800 wrote to memory of 1224 1800 rundll32.exe 27 PID 1224 wrote to memory of 1364 1224 rundll32.exe 28 PID 1224 wrote to memory of 1364 1224 rundll32.exe 28 PID 1224 wrote to memory of 1364 1224 rundll32.exe 28 PID 1224 wrote to memory of 1364 1224 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6927111c4d2937c06c1cc3978d2e9214.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6927111c4d2937c06c1cc3978d2e9214.dll,#12⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\WINDOWS\mssecsvr.exeC:\WINDOWS\mssecsvr.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1364
-
-
-
C:\WINDOWS\mssecsvr.exeC:\WINDOWS\mssecsvr.exe -m security1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2028
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\WINDOWS\mssecsvr.exe
- Size 2.2MB
- SHA256 6201c93531f535842ba413bbfec852119d3349c48f93110521ac74d61c01c326
- MD5 ad1a6a33842bac7618e6796767ab556d
- SHA1 6622c1514b7c7d677669cdae5497736727941e2e
- SHA512 5f3fd6cef4cf27c4362e5b23c7380594f2b3f7d3596b56fb1a1eb58d688e2147b3ee538ce3da3dd6d67d3789fa68ef6744d62cc598050869ac4e7dc305694b8d
- SSDEEP 49152:QnGMSPbcBVYej/1INRx+TSqTdX1HkQo6SA:QGPoB1z1aRxcSUDk36SA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mssecsvr.exe
- Size 2.2MB
- SHA256 6201c93531f535842ba413bbfec852119d3349c48f93110521ac74d61c01c326
- MD5 ad1a6a33842bac7618e6796767ab556d
- SHA1 6622c1514b7c7d677669cdae5497736727941e2e
- SHA512 5f3fd6cef4cf27c4362e5b23c7380594f2b3f7d3596b56fb1a1eb58d688e2147b3ee538ce3da3dd6d67d3789fa68ef6744d62cc598050869ac4e7dc305694b8d
- SSDEEP 49152:QnGMSPbcBVYej/1INRx+TSqTdX1HkQo6SA:QGPoB1z1aRxcSUDk36SA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mssecsvr.exe
- Size 2.2MB
- SHA256 6201c93531f535842ba413bbfec852119d3349c48f93110521ac74d61c01c326
- MD5 ad1a6a33842bac7618e6796767ab556d
- SHA1 6622c1514b7c7d677669cdae5497736727941e2e
- SHA512 5f3fd6cef4cf27c4362e5b23c7380594f2b3f7d3596b56fb1a1eb58d688e2147b3ee538ce3da3dd6d67d3789fa68ef6744d62cc598050869ac4e7dc305694b8d
- SSDEEP 49152:QnGMSPbcBVYej/1INRx+TSqTdX1HkQo6SA:QGPoB1z1aRxcSUDk36SA
- MD5 SHA1 SHA512 SSDEEP