Analysis
- max time kernel
151s - max time network
154s - platform
windows7_x64 - resource
win7-20220715-en - resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system - submitted
20/07/2022, 02:19
Static task
static1
Behavioral task
behavioral1
Sample
b46b61f29402626a483f28f99644b8b7.dll
Resource
win7-20220715-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
b46b61f29402626a483f28f99644b8b7.dll
Resource
win10v2004-20220718-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target b46b61f29402626a483f28f99644b8b7.dll
- Size 5.0MB
- Sample220720-crvcwsaga4
- SHA256 38dee9dac68372b67ca358f8acce624c8d7f7c871a540cc43744eae196908a59
- MD5 b46b61f29402626a483f28f99644b8b7
- SHA1 5ec4e9298eb2116f16564f139f0a455219a94685
- SHA512 07b435014a40739c8c783f2d1d7a5fab3e76cce70e8cd4c27cfd6126acc64fa63acc414afacb53e53c86e948d0e7b414625a5049fd53525690efa9bc78417d14
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Wannacry
WannaCry is a ransomware cryptoworm.
- Contacts a large (1272) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Executes dropped EXE 3 IoCs
pid Process 896 mssecsvc.exe 1116 mssecsvc.exe 1720 tasksche.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvc.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\WINDOWS\mssecsvc.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvc.exe - Modifies data under HKEY_USERS 24 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\36-59-49-f0-51-d2\WpadDecision = "0" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00d2000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C19B379F-7A9C-44D0-AFC3-8D4F51FCE64D} mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C19B379F-7A9C-44D0-AFC3-8D4F51FCE64D}\36-59-49-f0-51-d2 mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\36-59-49-f0-51-d2\WpadDecisionTime = b0c729e4ef9bd801 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C19B379F-7A9C-44D0-AFC3-8D4F51FCE64D}\WpadDecision = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C19B379F-7A9C-44D0-AFC3-8D4F51FCE64D}\WpadDecisionReason = "1" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C19B379F-7A9C-44D0-AFC3-8D4F51FCE64D}\WpadDecisionTime = b0c729e4ef9bd801 mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C19B379F-7A9C-44D0-AFC3-8D4F51FCE64D}\WpadNetworkName = "Network 3" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\36-59-49-f0-51-d2 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\36-59-49-f0-51-d2\WpadDecisionReason = "1" mssecsvc.exe - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 944 wrote to memory of 1048 944 rundll32.exe 27 PID 944 wrote to memory of 1048 944 rundll32.exe 27 PID 944 wrote to memory of 1048 944 rundll32.exe 27 PID 944 wrote to memory of 1048 944 rundll32.exe 27 PID 944 wrote to memory of 1048 944 rundll32.exe 27 PID 944 wrote to memory of 1048 944 rundll32.exe 27 PID 944 wrote to memory of 1048 944 rundll32.exe 27 PID 1048 wrote to memory of 896 1048 rundll32.exe 28 PID 1048 wrote to memory of 896 1048 rundll32.exe 28 PID 1048 wrote to memory of 896 1048 rundll32.exe 28 PID 1048 wrote to memory of 896 1048 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b46b61f29402626a483f28f99644b8b7.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b46b61f29402626a483f28f99644b8b7.dll,#12⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:896 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i4⤵
- Executes dropped EXE
PID:1720
-
-
-
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1116
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\WINDOWS\mssecsvc.exe
- Size 3.6MB
- SHA256 bbaa68119f6f874cc9eb50b74ffe5c5a9216ea27076e0be064a00121db1f552f
- MD5 74e0f1f84be994485df225aed140b5ad
- SHA1 e570cb1c2f4acfa270cb5a7255b77b621ab9e615
- SHA512 3144b03240aa75d13024bad3c1cc12276f3b00f9c07ea2782e31a42460bc53583d8704119341e83ea8f33593d24cb0903ddfa67493bb086f1b7485e150a45506
- SSDEEP 24576:2bLgddQhfdmMSirYbcMNgef0QeQjG/D8kIqRYoAdNLKz662:2nAQqMSPbcBVQej/1INR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mssecsvc.exe
- Size 3.6MB
- SHA256 bbaa68119f6f874cc9eb50b74ffe5c5a9216ea27076e0be064a00121db1f552f
- MD5 74e0f1f84be994485df225aed140b5ad
- SHA1 e570cb1c2f4acfa270cb5a7255b77b621ab9e615
- SHA512 3144b03240aa75d13024bad3c1cc12276f3b00f9c07ea2782e31a42460bc53583d8704119341e83ea8f33593d24cb0903ddfa67493bb086f1b7485e150a45506
- SSDEEP 24576:2bLgddQhfdmMSirYbcMNgef0QeQjG/D8kIqRYoAdNLKz662:2nAQqMSPbcBVQej/1INR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mssecsvc.exe
- Size 3.6MB
- SHA256 bbaa68119f6f874cc9eb50b74ffe5c5a9216ea27076e0be064a00121db1f552f
- MD5 74e0f1f84be994485df225aed140b5ad
- SHA1 e570cb1c2f4acfa270cb5a7255b77b621ab9e615
- SHA512 3144b03240aa75d13024bad3c1cc12276f3b00f9c07ea2782e31a42460bc53583d8704119341e83ea8f33593d24cb0903ddfa67493bb086f1b7485e150a45506
- SSDEEP 24576:2bLgddQhfdmMSirYbcMNgef0QeQjG/D8kIqRYoAdNLKz662:2nAQqMSPbcBVQej/1INR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\tasksche.exe
- Size 3.4MB
- SHA256 63c6e3254620f3b0a6bdf3e6415bb88a13c86c0c9cc291aa6a5864491b6ddf84
- MD5 75b149225a657984d61baf702f1f4be0
- SHA1 c7a9a8de140001eedbed6689b65d77fce78de252
- SHA512 4371254c5e6c6dc3f71ecc2101330fb65d93e7c2ae8680f93867ad031e31fde09ba649e17fcdc7c05b1fe4356ec0845a707dafc39f33d4f05f56ab6002714a33
- SSDEEP 24576:nQhfdmMSirYbcMNgef0QeQjG/D8kIqRYoAdNLKz662:nQqMSPbcBVQej/1INR
- MD5 SHA1 SHA512 SSDEEP