Analysis
-
max time kernel
152s -
max time network
183s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
20-07-2022 02:17
Static task
static1
Behavioral task
behavioral1
Sample
a7879a2d28a2827c01d284d0ed5e20c8.dll
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
a7879a2d28a2827c01d284d0ed5e20c8.dll
Resource
win10v2004-20220718-en
General
-
Target
a7879a2d28a2827c01d284d0ed5e20c8.dll
-
Size
5.0MB
-
MD5
a7879a2d28a2827c01d284d0ed5e20c8
-
SHA1
1c0e2df2d4712b8f3cdaca632cf885dd658bc703
-
SHA256
b825f05ca316b65aa51b03070d1f31c2c5ed03cf950efdb16e7e75535bed6124
-
SHA512
d1955dd00a443e2c6bf24ac5e740ea460f0d4df848cffe8a5d121ff741c82d88c5d9030e6f16135b4ce30d50f5b12e1d0f6b1120438967a344d7eddfe637c8ae
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (1265) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 2 IoCs
Processes:
mssecsvr.exemssecsvr.exepid process 1656 mssecsvr.exe 592 mssecsvr.exe -
Drops file in System32 directory 1 IoCs
Processes:
mssecsvr.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvr.exe -
Drops file in Windows directory 2 IoCs
Processes:
rundll32.exemssecsvr.exedescription ioc process File created C:\WINDOWS\mssecsvr.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvr.exe -
Modifies data under HKEY_USERS 24 IoCs
Processes:
mssecsvr.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-fd-da-49-6e-f8\WpadDecisionReason = "1" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{121F6D94-F911-403A-AC73-5AA3B2D1DAE0} mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{121F6D94-F911-403A-AC73-5AA3B2D1DAE0}\WpadDecisionTime = 60ea7cb4ef9bd801 mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{121F6D94-F911-403A-AC73-5AA3B2D1DAE0}\WpadNetworkName = "Network 3" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00c9000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-fd-da-49-6e-f8 mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{121F6D94-F911-403A-AC73-5AA3B2D1DAE0}\ca-fd-da-49-6e-f8 mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-fd-da-49-6e-f8\WpadDecisionTime = 60ea7cb4ef9bd801 mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{121F6D94-F911-403A-AC73-5AA3B2D1DAE0}\WpadDecisionReason = "1" mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{121F6D94-F911-403A-AC73-5AA3B2D1DAE0}\WpadDecision = "0" mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-fd-da-49-6e-f8\WpadDecision = "0" mssecsvr.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1928 wrote to memory of 1904 1928 rundll32.exe rundll32.exe PID 1928 wrote to memory of 1904 1928 rundll32.exe rundll32.exe PID 1928 wrote to memory of 1904 1928 rundll32.exe rundll32.exe PID 1928 wrote to memory of 1904 1928 rundll32.exe rundll32.exe PID 1928 wrote to memory of 1904 1928 rundll32.exe rundll32.exe PID 1928 wrote to memory of 1904 1928 rundll32.exe rundll32.exe PID 1928 wrote to memory of 1904 1928 rundll32.exe rundll32.exe PID 1904 wrote to memory of 1656 1904 rundll32.exe mssecsvr.exe PID 1904 wrote to memory of 1656 1904 rundll32.exe mssecsvr.exe PID 1904 wrote to memory of 1656 1904 rundll32.exe mssecsvr.exe PID 1904 wrote to memory of 1656 1904 rundll32.exe mssecsvr.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a7879a2d28a2827c01d284d0ed5e20c8.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a7879a2d28a2827c01d284d0ed5e20c8.dll,#12⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\WINDOWS\mssecsvr.exeC:\WINDOWS\mssecsvr.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\WINDOWS\mssecsvr.exeC:\WINDOWS\mssecsvr.exe -m security1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\WINDOWS\mssecsvr.exeFilesize
2.2MB
MD58e769fcd7957b264fc70ed25a83b8862
SHA1015c7b01dfe62964385cbe850ded325f70cff7fd
SHA256089c3146d7d3bf2317e348a03684aa52ce0d2fab03060655c954e676be1ad2b1
SHA5120097b8252fe341fa1cff8027f9d22f5315c6edb0163d7ef5f7c718f7804dcfefd62609928b25c9b64c9f9a773642b11e821d1162dc4486b31f46e4b33e46fe73
-
C:\Windows\mssecsvr.exeFilesize
2.2MB
MD58e769fcd7957b264fc70ed25a83b8862
SHA1015c7b01dfe62964385cbe850ded325f70cff7fd
SHA256089c3146d7d3bf2317e348a03684aa52ce0d2fab03060655c954e676be1ad2b1
SHA5120097b8252fe341fa1cff8027f9d22f5315c6edb0163d7ef5f7c718f7804dcfefd62609928b25c9b64c9f9a773642b11e821d1162dc4486b31f46e4b33e46fe73
-
C:\Windows\mssecsvr.exeFilesize
2.2MB
MD58e769fcd7957b264fc70ed25a83b8862
SHA1015c7b01dfe62964385cbe850ded325f70cff7fd
SHA256089c3146d7d3bf2317e348a03684aa52ce0d2fab03060655c954e676be1ad2b1
SHA5120097b8252fe341fa1cff8027f9d22f5315c6edb0163d7ef5f7c718f7804dcfefd62609928b25c9b64c9f9a773642b11e821d1162dc4486b31f46e4b33e46fe73
-
memory/1656-56-0x0000000000000000-mapping.dmp
-
memory/1904-54-0x0000000000000000-mapping.dmp
-
memory/1904-55-0x00000000768F1000-0x00000000768F3000-memory.dmpFilesize
8KB