Analysis
- max time kernel
151s - max time network
155s - platform
windows7_x64 - resource
win7-20220715-en - resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system - submitted
20/07/2022, 02:30
Static task
static1
Behavioral task
behavioral1
Sample
1fc89ece03929425de3ecd437fe74c39.dll
Resource
win7-20220715-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
1fc89ece03929425de3ecd437fe74c39.dll
Resource
win10v2004-20220715-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 1fc89ece03929425de3ecd437fe74c39.dll
- Size 5.0MB
- Sample220720-cy6phabaa3
- SHA256 5810c7be87e79ff5f358d7867aaa05c53b76319cc88fe04b1f548fac05504867
- MD5 1fc89ece03929425de3ecd437fe74c39
- SHA1 8f49425dbaa464cdeccf4e397828b9a2130e6447
- SHA512 e21b4cc0e1d3dcb5ac95be9676dbac5003f2be2202356864e2eb12c04bb4b6c08c30c329a3c505f6296b9db77802300f9ead4e12205d6a30835a674c07be59c0
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Wannacry
WannaCry is a ransomware cryptoworm.
- Contacts a large (1231) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Executes dropped EXE 3 IoCs
pid Process 1968 mssecsvc.exe 1412 mssecsvc.exe 1768 tasksche.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvc.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\WINDOWS\mssecsvc.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvc.exe - Program crash 1 IoCs
pid pid_target Process procid_target 1556 1768 WerFault.exe 31 - Modifies data under HKEY_USERS 24 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C321097C-58FA-4DD6-B563-F9FA36548596}\WpadDecisionReason = "1" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C321097C-58FA-4DD6-B563-F9FA36548596}\a2-35-a4-69-4c-20 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C321097C-58FA-4DD6-B563-F9FA36548596} mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C321097C-58FA-4DD6-B563-F9FA36548596}\WpadDecision = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a2-35-a4-69-4c-20 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a2-35-a4-69-4c-20\WpadDecisionReason = "1" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a2-35-a4-69-4c-20\WpadDecisionTime = 60ea27b4e09bd801 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a2-35-a4-69-4c-20\WpadDecision = "0" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C321097C-58FA-4DD6-B563-F9FA36548596}\WpadNetworkName = "Network 3" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00fe000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C321097C-58FA-4DD6-B563-F9FA36548596}\WpadDecisionTime = 60ea27b4e09bd801 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe - Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 2024 wrote to memory of 1148 2024 rundll32.exe 27 PID 2024 wrote to memory of 1148 2024 rundll32.exe 27 PID 2024 wrote to memory of 1148 2024 rundll32.exe 27 PID 2024 wrote to memory of 1148 2024 rundll32.exe 27 PID 2024 wrote to memory of 1148 2024 rundll32.exe 27 PID 2024 wrote to memory of 1148 2024 rundll32.exe 27 PID 2024 wrote to memory of 1148 2024 rundll32.exe 27 PID 1148 wrote to memory of 1968 1148 rundll32.exe 28 PID 1148 wrote to memory of 1968 1148 rundll32.exe 28 PID 1148 wrote to memory of 1968 1148 rundll32.exe 28 PID 1148 wrote to memory of 1968 1148 rundll32.exe 28 PID 1968 wrote to memory of 1768 1968 mssecsvc.exe 31 PID 1968 wrote to memory of 1768 1968 mssecsvc.exe 31 PID 1968 wrote to memory of 1768 1968 mssecsvc.exe 31 PID 1968 wrote to memory of 1768 1968 mssecsvc.exe 31 PID 1968 wrote to memory of 1768 1968 mssecsvc.exe 31 PID 1968 wrote to memory of 1768 1968 mssecsvc.exe 31 PID 1968 wrote to memory of 1768 1968 mssecsvc.exe 31 PID 1768 wrote to memory of 1556 1768 tasksche.exe 32 PID 1768 wrote to memory of 1556 1768 tasksche.exe 32 PID 1768 wrote to memory of 1556 1768 tasksche.exe 32 PID 1768 wrote to memory of 1556 1768 tasksche.exe 32 PID 1768 wrote to memory of 1556 1768 tasksche.exe 32 PID 1768 wrote to memory of 1556 1768 tasksche.exe 32 PID 1768 wrote to memory of 1556 1768 tasksche.exe 32
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1fc89ece03929425de3ecd437fe74c39.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1fc89ece03929425de3ecd437fe74c39.dll,#12⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 2245⤵
- Program crash
PID:1556
-
-
-
-
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1412
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\WINDOWS\mssecsvc.exe
- Size 3.6MB
- SHA256 ea5ca0a67857fc81967232a8a42f49c1cc590deee996f6e44967459b9dafae59
- MD5 c492f8037a1c4a60cb35e9cdb42b837a
- SHA1 8f09727837d3ead326185bc64692cb8ee5c610c2
- SHA512 e0e4a15843721113596a3ef9f8a78adeff2f8452e77fa533a4f6c9dc5993fc9ee8a1c0dd76c304f3e8c5cba9ddc4bc5c8c5a2f7808b8585ddbc3b49f3a4ef9f4
- SSDEEP 98304:ywOoBhz1aRxcSUDk36SAEdhv7m3MOujtDZnhf/Bg:ybe1Cxcxk3ZAErlFB5g
- MD5 SHA1 SHA512 SSDEEP
- Path C:\WINDOWS\tasksche.exe
- Size 2.0MB
- SHA256 d3e3c54a4d3eb9174afdfb87ac48d17845760cc2f0f4d4f73f69f7290f3d06a5
- MD5 52f8fc1480109b39f566aa0a0ae599d6
- SHA1 0d9e0316b2e78b81fb125d2e2dcc4828ece88c22
- SHA512 ce841b87b64b43bd77e75768086b0d1201a4584d9b713ac4287e8553461e24654da2dc3f3453b742ae902a941fc4df47765135895b89acd5ff693a7fdb9de026
- SSDEEP 49152:DEhPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvm:DOoBhz1aRxcSUDk36SAEdhvm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mssecsvc.exe
- Size 3.6MB
- SHA256 ea5ca0a67857fc81967232a8a42f49c1cc590deee996f6e44967459b9dafae59
- MD5 c492f8037a1c4a60cb35e9cdb42b837a
- SHA1 8f09727837d3ead326185bc64692cb8ee5c610c2
- SHA512 e0e4a15843721113596a3ef9f8a78adeff2f8452e77fa533a4f6c9dc5993fc9ee8a1c0dd76c304f3e8c5cba9ddc4bc5c8c5a2f7808b8585ddbc3b49f3a4ef9f4
- SSDEEP 98304:ywOoBhz1aRxcSUDk36SAEdhv7m3MOujtDZnhf/Bg:ybe1Cxcxk3ZAErlFB5g
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mssecsvc.exe
- Size 3.6MB
- SHA256 ea5ca0a67857fc81967232a8a42f49c1cc590deee996f6e44967459b9dafae59
- MD5 c492f8037a1c4a60cb35e9cdb42b837a
- SHA1 8f09727837d3ead326185bc64692cb8ee5c610c2
- SHA512 e0e4a15843721113596a3ef9f8a78adeff2f8452e77fa533a4f6c9dc5993fc9ee8a1c0dd76c304f3e8c5cba9ddc4bc5c8c5a2f7808b8585ddbc3b49f3a4ef9f4
- SSDEEP 98304:ywOoBhz1aRxcSUDk36SAEdhv7m3MOujtDZnhf/Bg:ybe1Cxcxk3ZAErlFB5g
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\tasksche.exe
- Size 2.0MB
- SHA256 d3e3c54a4d3eb9174afdfb87ac48d17845760cc2f0f4d4f73f69f7290f3d06a5
- MD5 52f8fc1480109b39f566aa0a0ae599d6
- SHA1 0d9e0316b2e78b81fb125d2e2dcc4828ece88c22
- SHA512 ce841b87b64b43bd77e75768086b0d1201a4584d9b713ac4287e8553461e24654da2dc3f3453b742ae902a941fc4df47765135895b89acd5ff693a7fdb9de026
- SSDEEP 49152:DEhPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvm:DOoBhz1aRxcSUDk36SAEdhvm
- MD5 SHA1 SHA512 SSDEEP