Analysis
- max time kernel
151s - max time network
179s - platform
windows7_x64 - resource
win7-20220718-en - resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system - submitted
20/07/2022, 02:23
Static task
static1
Behavioral task
behavioral1
Sample
17709dc17f56a851a189204c7845d0e9.dll
Resource
win7-20220718-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
17709dc17f56a851a189204c7845d0e9.dll
Resource
win10v2004-20220718-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 17709dc17f56a851a189204c7845d0e9.dll
- Size 5.0MB
- Sample220720-ct576sbean
- SHA256 b95ce7cf432b0a9af6affc3637c377b7aea5da351b433513e4136f4741a43357
- MD5 17709dc17f56a851a189204c7845d0e9
- SHA1 aef64fac37eb172d9e4d74c3f9d309fb0f2d012d
- SHA512 d61f03ff5410f49b848d4cab512565267366f482944afb512adcef8b28395cf971556a2f05382f6636ac59d2209d4ba3e5535620277d8e90e14c49b1a084b305
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Wannacry
WannaCry is a ransomware cryptoworm.
- Contacts a large (1337) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Executes dropped EXE 3 IoCs
pid Process 1960 mssecsvc.exe 1712 mssecsvc.exe 808 tasksche.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvc.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\WINDOWS\tasksche.exe mssecsvc.exe File created C:\WINDOWS\mssecsvc.exe rundll32.exe - Modifies data under HKEY_USERS 24 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0916F404-CB4C-4236-B527-B9986B804060}\WpadDecisionTime = 409a3d81f09bd801 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\76-c7-1a-46-0c-c4\WpadDecision = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0916F404-CB4C-4236-B527-B9986B804060}\WpadDecision = "0" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\76-c7-1a-46-0c-c4\WpadDecisionReason = "1" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\76-c7-1a-46-0c-c4\WpadDecisionTime = 409a3d81f09bd801 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00c7000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0916F404-CB4C-4236-B527-B9986B804060} mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0916F404-CB4C-4236-B527-B9986B804060}\WpadDecisionReason = "1" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0916F404-CB4C-4236-B527-B9986B804060}\WpadNetworkName = "Network 3" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\76-c7-1a-46-0c-c4 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0916F404-CB4C-4236-B527-B9986B804060}\76-c7-1a-46-0c-c4 mssecsvc.exe - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1988 wrote to memory of 1996 1988 rundll32.exe 26 PID 1988 wrote to memory of 1996 1988 rundll32.exe 26 PID 1988 wrote to memory of 1996 1988 rundll32.exe 26 PID 1988 wrote to memory of 1996 1988 rundll32.exe 26 PID 1988 wrote to memory of 1996 1988 rundll32.exe 26 PID 1988 wrote to memory of 1996 1988 rundll32.exe 26 PID 1988 wrote to memory of 1996 1988 rundll32.exe 26 PID 1996 wrote to memory of 1960 1996 rundll32.exe 27 PID 1996 wrote to memory of 1960 1996 rundll32.exe 27 PID 1996 wrote to memory of 1960 1996 rundll32.exe 27 PID 1996 wrote to memory of 1960 1996 rundll32.exe 27
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\17709dc17f56a851a189204c7845d0e9.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\17709dc17f56a851a189204c7845d0e9.dll,#12⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1960 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i4⤵
- Executes dropped EXE
PID:808
-
-
-
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1712
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\WINDOWS\mssecsvc.exe
- Size 3.6MB
- SHA256 c6f7834e99ae0d66c10f4996cfde6ea08b4b11c6779ae809b784f750dacce1d5
- MD5 3722eb1a54af89634b8a80965de5c831
- SHA1 e2eb42851acc61c8912da1a6d532e4822ca9d73a
- SHA512 fc74f087e1813b05e1ef5bb5e282b6e70f00efc63b6a3beabad29b8c9db83a082cf7b276a8725b12a70cb5f7378dc7bb2b2cbf0c79b33f90aaa870d3295ab8a8
- SSDEEP 24576:2bLgddQhfdmMSirYbcMNgef056M+ouME7A4kqAH1pNZtA0p+9XEkI:2nAQqMSPbcBVF+xR8yAH1plAHI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mssecsvc.exe
- Size 3.6MB
- SHA256 c6f7834e99ae0d66c10f4996cfde6ea08b4b11c6779ae809b784f750dacce1d5
- MD5 3722eb1a54af89634b8a80965de5c831
- SHA1 e2eb42851acc61c8912da1a6d532e4822ca9d73a
- SHA512 fc74f087e1813b05e1ef5bb5e282b6e70f00efc63b6a3beabad29b8c9db83a082cf7b276a8725b12a70cb5f7378dc7bb2b2cbf0c79b33f90aaa870d3295ab8a8
- SSDEEP 24576:2bLgddQhfdmMSirYbcMNgef056M+ouME7A4kqAH1pNZtA0p+9XEkI:2nAQqMSPbcBVF+xR8yAH1plAHI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mssecsvc.exe
- Size 3.6MB
- SHA256 c6f7834e99ae0d66c10f4996cfde6ea08b4b11c6779ae809b784f750dacce1d5
- MD5 3722eb1a54af89634b8a80965de5c831
- SHA1 e2eb42851acc61c8912da1a6d532e4822ca9d73a
- SHA512 fc74f087e1813b05e1ef5bb5e282b6e70f00efc63b6a3beabad29b8c9db83a082cf7b276a8725b12a70cb5f7378dc7bb2b2cbf0c79b33f90aaa870d3295ab8a8
- SSDEEP 24576:2bLgddQhfdmMSirYbcMNgef056M+ouME7A4kqAH1pNZtA0p+9XEkI:2nAQqMSPbcBVF+xR8yAH1plAHI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\tasksche.exe
- Size 3.4MB
- SHA256 9c1d6a200e81b34fe4e741b85d6f221a84551176895afd6d93ef6d22219bc32a
- MD5 849eda64d2a3b873c32f7971410406c7
- SHA1 a732381f957b7cda94f4fa9f6e59009c69d6e2d9
- SHA512 a2c2aa9db27beca6e1a47bc7d3e5f100994b1ac8e5e4d57155a122f5f73fec195968a6e0a774dfa22fcda1f465a05c5997e5a0952c3661c9a2dd4364c66001de
- SSDEEP 24576:nQhfdmMSirYbcMNgef056M+ouME7A4kqAH1pNZtA0p+9XEkj:nQqMSPbcBVF+xR8yAH1plAHj
- MD5 SHA1 SHA512 SSDEEP