Analysis
- max time kernel
150s - max time network
158s - platform
windows7_x64 - resource
win7-20220718-en - resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system - submitted
20/07/2022, 02:24
Static task
static1
Behavioral task
behavioral1
Sample
545be7ed21bf84ea1dbc8be64150f815.dll
Resource
win7-20220718-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
545be7ed21bf84ea1dbc8be64150f815.dll
Resource
win10v2004-20220718-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 545be7ed21bf84ea1dbc8be64150f815.dll
- Size 5.0MB
- Sample220720-cvrfeabecn
- SHA256 bbff03d255890f428b9613ef49963161a79920033672a227dc736031b19fe4db
- MD5 545be7ed21bf84ea1dbc8be64150f815
- SHA1 11a742b7692be45945c1a807713b06b6f73ed222
- SHA512 e85881133b2fe77fb1f95cdefffbaae908f8651b9d807041a15c163db15d97327a1e180725a0582e54b69573057bc215d048e928e88b742cb2b012ea8646a47e
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Wannacry
WannaCry is a ransomware cryptoworm.
- Contacts a large (1169) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Executes dropped EXE 3 IoCs
pid Process 1656 mssecsvc.exe 1236 mssecsvc.exe 1440 tasksche.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvc.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\WINDOWS\mssecsvc.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvc.exe - Modifies data under HKEY_USERS 21 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{68A262D9-8B48-4BA6-846B-FB4217E138F5}\WpadDecisionTime = b0e4c59df09bd801 mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\76-77-b3-a3-16-f3\WpadDecisionTime = b0e4c59df09bd801 mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{68A262D9-8B48-4BA6-846B-FB4217E138F5}\WpadNetworkName = "Network 3" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\76-77-b3-a3-16-f3\WpadDecisionReason = "1" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{68A262D9-8B48-4BA6-846B-FB4217E138F5} mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{68A262D9-8B48-4BA6-846B-FB4217E138F5}\76-77-b3-a3-16-f3 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\76-77-b3-a3-16-f3 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{68A262D9-8B48-4BA6-846B-FB4217E138F5}\WpadDecision = "0" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\76-77-b3-a3-16-f3\WpadDecision = "0" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00c5000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{68A262D9-8B48-4BA6-846B-FB4217E138F5}\WpadDecisionReason = "1" mssecsvc.exe - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1768 wrote to memory of 964 1768 rundll32.exe 28 PID 1768 wrote to memory of 964 1768 rundll32.exe 28 PID 1768 wrote to memory of 964 1768 rundll32.exe 28 PID 1768 wrote to memory of 964 1768 rundll32.exe 28 PID 1768 wrote to memory of 964 1768 rundll32.exe 28 PID 1768 wrote to memory of 964 1768 rundll32.exe 28 PID 1768 wrote to memory of 964 1768 rundll32.exe 28 PID 964 wrote to memory of 1656 964 rundll32.exe 29 PID 964 wrote to memory of 1656 964 rundll32.exe 29 PID 964 wrote to memory of 1656 964 rundll32.exe 29 PID 964 wrote to memory of 1656 964 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\545be7ed21bf84ea1dbc8be64150f815.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\545be7ed21bf84ea1dbc8be64150f815.dll,#12⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:964 -
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1656 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i4⤵
- Executes dropped EXE
PID:1440
-
-
-
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1236
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\WINDOWS\mssecsvc.exe
- Size 3.6MB
- SHA256 1ddfc6fa1b6ac50e77b52262dcbc9abe74ed37914b12accd8de4f47d28b79e49
- MD5 1f12c97044b36cf7836ea62f6a80af8d
- SHA1 f9bf48d4f201c18e6c50281c839d7df9e479c0ed
- SHA512 75a50955a3fb65ebb85c461367757b12794f29df4f33cb0316f86120839e152cca948ce9c570305d016433526bb0cf65acb63397e8cba28dc60c4bdc04299eba
- SSDEEP 98304:yzqPoBhz1uxcSUDk36SAEdhvxWa9P593R8yAVp2MI:yzqPe1uxcxk3ZAEUadzR8yc4MI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mssecsvc.exe
- Size 3.6MB
- SHA256 1ddfc6fa1b6ac50e77b52262dcbc9abe74ed37914b12accd8de4f47d28b79e49
- MD5 1f12c97044b36cf7836ea62f6a80af8d
- SHA1 f9bf48d4f201c18e6c50281c839d7df9e479c0ed
- SHA512 75a50955a3fb65ebb85c461367757b12794f29df4f33cb0316f86120839e152cca948ce9c570305d016433526bb0cf65acb63397e8cba28dc60c4bdc04299eba
- SSDEEP 98304:yzqPoBhz1uxcSUDk36SAEdhvxWa9P593R8yAVp2MI:yzqPe1uxcxk3ZAEUadzR8yc4MI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mssecsvc.exe
- Size 3.6MB
- SHA256 1ddfc6fa1b6ac50e77b52262dcbc9abe74ed37914b12accd8de4f47d28b79e49
- MD5 1f12c97044b36cf7836ea62f6a80af8d
- SHA1 f9bf48d4f201c18e6c50281c839d7df9e479c0ed
- SHA512 75a50955a3fb65ebb85c461367757b12794f29df4f33cb0316f86120839e152cca948ce9c570305d016433526bb0cf65acb63397e8cba28dc60c4bdc04299eba
- SSDEEP 98304:yzqPoBhz1uxcSUDk36SAEdhvxWa9P593R8yAVp2MI:yzqPe1uxcxk3ZAEUadzR8yc4MI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\tasksche.exe
- Size 3.4MB
- SHA256 cae127e0c331cc90daeb1688c12d0da0e33814bc6b061d78991db10a3e1fdafc
- MD5 c84e7d6469c1b06ff1968ad2c517512c
- SHA1 be83fd59490dbb29250981af30740b24b9072409
- SHA512 bd9fd08c903402ad1447f1bd9e05cf5467f443dd2d6b474918de59d0e74eb58ef8dce2b366b10873afb017c470154458ae938d2c10292aacd6589a2907a78211
- SSDEEP 98304:QqPoBhz1uxcSUDk36SAEdhvxWa9P593R8yAVp2Mj:QqPe1uxcxk3ZAEUadzR8yc4Mj
- MD5 SHA1 SHA512 SSDEEP