Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
resource tags
arch:x64arch:x86image:win10v2004-20220414-enlocale:en-usos:windows10-2004-x64system -
submitted
20-07-2022 02:00
Static task
static1
Behavioral task
behavioral1
Sample
203436927dfcfb20518d8c6ea8002588.dll
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
203436927dfcfb20518d8c6ea8002588.dll
Resource
win10v2004-20220414-en
General
-
Target
203436927dfcfb20518d8c6ea8002588.dll
-
Size
5.0MB
-
MD5
203436927dfcfb20518d8c6ea8002588
-
SHA1
acb0ad80e393d0efaac0affbc554350de2dd9742
-
SHA256
0113c0b8f5a263e6aa02658e32446659289f6b18b55ab70f5a5ac2b82d469624
-
SHA512
9301deaaecdaf72300a5be45b1863fa25732c95d774a86d8c31adac91e938778cb4b8a5ef546ccdb1a3d94146ed6f7b1f2d7099a163d7fdf83b9ce5cc71b7498
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (3191) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 2 IoCs
Processes:
mssecsvr.exemssecsvr.exepid process 3836 mssecsvr.exe 1396 mssecsvr.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in Windows directory 2 IoCs
Processes:
mssecsvr.exerundll32.exedescription ioc process File created C:\WINDOWS\tasksche.exe mssecsvr.exe File created C:\WINDOWS\mssecsvr.exe rundll32.exe -
Modifies data under HKEY_USERS 5 IoCs
Processes:
mssecsvr.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" mssecsvr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 3872 wrote to memory of 1328 3872 rundll32.exe rundll32.exe PID 3872 wrote to memory of 1328 3872 rundll32.exe rundll32.exe PID 3872 wrote to memory of 1328 3872 rundll32.exe rundll32.exe PID 1328 wrote to memory of 3836 1328 rundll32.exe mssecsvr.exe PID 1328 wrote to memory of 3836 1328 rundll32.exe mssecsvr.exe PID 1328 wrote to memory of 3836 1328 rundll32.exe mssecsvr.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\203436927dfcfb20518d8c6ea8002588.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\203436927dfcfb20518d8c6ea8002588.dll,#12⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\WINDOWS\mssecsvr.exeC:\WINDOWS\mssecsvr.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\WINDOWS\mssecsvr.exeC:\WINDOWS\mssecsvr.exe -m security1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\WINDOWS\mssecsvr.exeFilesize
2.2MB
MD52dff9bae8c7d5e4a68c74c4f3467228a
SHA164a32e6a94f171eab63c73d5b8942d5191692895
SHA2562ae575a134f05fc486845e302caf6407f2477c1527f15f42df7fb9953d5f197d
SHA5127c0ff6d9aeea6cc2ca8a81acdc5888ea72889acdd285932a35a663de73306ecd6cfb35f4f0b90f0aaf25a103a37a15f65f655a6985a61b9070ff6184b07ae9a3
-
C:\Windows\mssecsvr.exeFilesize
2.2MB
MD52dff9bae8c7d5e4a68c74c4f3467228a
SHA164a32e6a94f171eab63c73d5b8942d5191692895
SHA2562ae575a134f05fc486845e302caf6407f2477c1527f15f42df7fb9953d5f197d
SHA5127c0ff6d9aeea6cc2ca8a81acdc5888ea72889acdd285932a35a663de73306ecd6cfb35f4f0b90f0aaf25a103a37a15f65f655a6985a61b9070ff6184b07ae9a3
-
C:\Windows\mssecsvr.exeFilesize
2.2MB
MD52dff9bae8c7d5e4a68c74c4f3467228a
SHA164a32e6a94f171eab63c73d5b8942d5191692895
SHA2562ae575a134f05fc486845e302caf6407f2477c1527f15f42df7fb9953d5f197d
SHA5127c0ff6d9aeea6cc2ca8a81acdc5888ea72889acdd285932a35a663de73306ecd6cfb35f4f0b90f0aaf25a103a37a15f65f655a6985a61b9070ff6184b07ae9a3
-
memory/1328-130-0x0000000000000000-mapping.dmp
-
memory/3836-131-0x0000000000000000-mapping.dmp