Analysis
- max time kernel
151s - max time network
169s - platform
windows7_x64 - resource
win7-20220718-en - resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system - submitted
20/07/2022, 02:12
Static task
static1
Behavioral task
behavioral1
Sample
a07e202cc146dd5dc0b238a72e95fc9c.dll
Resource
win7-20220718-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
a07e202cc146dd5dc0b238a72e95fc9c.dll
Resource
win10v2004-20220718-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target a07e202cc146dd5dc0b238a72e95fc9c.dll
- Size 5.0MB
- Sample220720-cmvg4abbdj
- SHA256 258b3f320f0548dea3d65fc7a9f99c962b1a11c0c0cf894115fb860495c94f90
- MD5 a07e202cc146dd5dc0b238a72e95fc9c
- SHA1 83881af4942bed2de3b80a6c2382cecf25a5c1a6
- SHA512 4f4af7b884678977ec7d39d83fa8b4817d173ed1341c5b0e7ea61453a907dafb679374ba2f8bcdb98da6595298288f8e5ea92557d91218e990ec2bc92b08a9e6
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Wannacry
WannaCry is a ransomware cryptoworm.
- Executes dropped EXE 3 IoCs
pid Process 948 mssecsvc.exe 1752 mssecsvc.exe 748 tasksche.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvc.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\WINDOWS\mssecsvc.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvc.exe - Modifies data under HKEY_USERS 24 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CC7B9447-BD8D-4E20-895C-6B6F7836A7AF} mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CC7B9447-BD8D-4E20-895C-6B6F7836A7AF}\WpadDecisionReason = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CC7B9447-BD8D-4E20-895C-6B6F7836A7AF}\WpadDecision = "0" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-9a-b0-7d-5c-4f\WpadDecision = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00be000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-9a-b0-7d-5c-4f mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CC7B9447-BD8D-4E20-895C-6B6F7836A7AF}\aa-9a-b0-7d-5c-4f mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-9a-b0-7d-5c-4f\WpadDecisionTime = 00bbc70def9bd801 mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CC7B9447-BD8D-4E20-895C-6B6F7836A7AF}\WpadDecisionTime = 00bbc70def9bd801 mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CC7B9447-BD8D-4E20-895C-6B6F7836A7AF}\WpadNetworkName = "Network 3" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-9a-b0-7d-5c-4f\WpadDecisionReason = "1" mssecsvc.exe - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1984 wrote to memory of 1704 1984 rundll32.exe 28 PID 1984 wrote to memory of 1704 1984 rundll32.exe 28 PID 1984 wrote to memory of 1704 1984 rundll32.exe 28 PID 1984 wrote to memory of 1704 1984 rundll32.exe 28 PID 1984 wrote to memory of 1704 1984 rundll32.exe 28 PID 1984 wrote to memory of 1704 1984 rundll32.exe 28 PID 1984 wrote to memory of 1704 1984 rundll32.exe 28 PID 1704 wrote to memory of 948 1704 rundll32.exe 29 PID 1704 wrote to memory of 948 1704 rundll32.exe 29 PID 1704 wrote to memory of 948 1704 rundll32.exe 29 PID 1704 wrote to memory of 948 1704 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a07e202cc146dd5dc0b238a72e95fc9c.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a07e202cc146dd5dc0b238a72e95fc9c.dll,#12⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:948 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i4⤵
- Executes dropped EXE
PID:748
-
-
-
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1752
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\WINDOWS\mssecsvc.exe
- Size 3.6MB
- SHA256 51224e22dfca48144bd1a71085cbc6a03c0fa632132703c5afbee2a0387c6f1b
- MD5 869c609bc935752a2215f257fa2e3584
- SHA1 06604cf4d05a95c5abda74c26e66b44b2b6e8b96
- SHA512 7498bc12f7319d4bfb8f14f4022f5b0f6b0d09f16c59dba43f3b8b6f40611cbcb629b601bb9c785da69bf2f0c0104adb1b490d8beca3df8420ad3e563a15e0f9
- SSDEEP 98304:XDqPoBhz1aRxcSUDk36SAEdhvxWa9P5HBPI:XDqPe1Cxcxk3ZAEUadpBPI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mssecsvc.exe
- Size 3.6MB
- SHA256 51224e22dfca48144bd1a71085cbc6a03c0fa632132703c5afbee2a0387c6f1b
- MD5 869c609bc935752a2215f257fa2e3584
- SHA1 06604cf4d05a95c5abda74c26e66b44b2b6e8b96
- SHA512 7498bc12f7319d4bfb8f14f4022f5b0f6b0d09f16c59dba43f3b8b6f40611cbcb629b601bb9c785da69bf2f0c0104adb1b490d8beca3df8420ad3e563a15e0f9
- SSDEEP 98304:XDqPoBhz1aRxcSUDk36SAEdhvxWa9P5HBPI:XDqPe1Cxcxk3ZAEUadpBPI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mssecsvc.exe
- Size 3.6MB
- SHA256 51224e22dfca48144bd1a71085cbc6a03c0fa632132703c5afbee2a0387c6f1b
- MD5 869c609bc935752a2215f257fa2e3584
- SHA1 06604cf4d05a95c5abda74c26e66b44b2b6e8b96
- SHA512 7498bc12f7319d4bfb8f14f4022f5b0f6b0d09f16c59dba43f3b8b6f40611cbcb629b601bb9c785da69bf2f0c0104adb1b490d8beca3df8420ad3e563a15e0f9
- SSDEEP 98304:XDqPoBhz1aRxcSUDk36SAEdhvxWa9P5HBPI:XDqPe1Cxcxk3ZAEUadpBPI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\tasksche.exe
- Size 3.4MB
- SHA256 44b0bca51a73888c2b514a1ba113e5829bd09e67076f3040a75e588ed5da2e07
- MD5 aa6b91ba01dc3f2bcd1edf06ce6b4c61
- SHA1 d9805d0357863a2a9416b820b3a7f84add942db8
- SHA512 6a7b6a0403eb439067852bf055a307f7c1c01f376fa5114a6f931af8cc797e299db9ca749fc11c70c1e440a637e259973650054934a5fcce6b1b6ced553f24ea
- SSDEEP 98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P5HBPj:QqPe1Cxcxk3ZAEUadpBPj
- MD5 SHA1 SHA512 SSDEEP