Analysis
- max time kernel
150s - max time network
154s - platform
windows7_x64 - resource
win7-20220715-en - resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system - submitted
20/07/2022, 02:55
Static task
static1
Behavioral task
behavioral1
Sample
5091c8470383ab149157d9b645e6aaa5.dll
Resource
win7-20220715-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
5091c8470383ab149157d9b645e6aaa5.dll
Resource
win10v2004-20220718-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 5091c8470383ab149157d9b645e6aaa5.dll
- Size 5.0MB
- Sample220720-defveabgdj
- SHA256 c41fd8476e584fb994e234397446431e1bc7d08e30cc96dd080bc65c91a52406
- MD5 5091c8470383ab149157d9b645e6aaa5
- SHA1 a24a88aeb8d10fbef6cbba2805755b18db380711
- SHA512 81db7c7420d39534eea2ed7ddbc1d55a50880a5c8574e680bd85795db2a1f42e151547adc755488740eb23abbbb406fdc1e00352159e9c7241f50d4475783d96
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Wannacry
WannaCry is a ransomware cryptoworm.
- Contacts a large (1217) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Executes dropped EXE 3 IoCs
pid Process 1896 mssecsvc.exe 2036 mssecsvc.exe 2040 tasksche.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvc.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\WINDOWS\mssecsvc.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvc.exe File created C:\Windows\__tmp_rar_sfx_access_check_7085159 tasksche.exe File created C:\Windows\eee.exe tasksche.exe - Modifies data under HKEY_USERS 24 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3e-e5-9e-66-76-48\WpadDecisionTime = 709ea226e49bd801 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3e-e5-9e-66-76-48\WpadDecision = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A5430331-FC30-446D-83E5-809B66A15B6F} mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3e-e5-9e-66-76-48\WpadDecisionReason = "1" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00ec000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A5430331-FC30-446D-83E5-809B66A15B6F}\WpadDecisionTime = 709ea226e49bd801 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A5430331-FC30-446D-83E5-809B66A15B6F}\WpadDecision = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3e-e5-9e-66-76-48 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A5430331-FC30-446D-83E5-809B66A15B6F}\3e-e5-9e-66-76-48 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A5430331-FC30-446D-83E5-809B66A15B6F}\WpadDecisionReason = "1" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A5430331-FC30-446D-83E5-809B66A15B6F}\WpadNetworkName = "Network 3" mssecsvc.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1704 wrote to memory of 1768 1704 rundll32.exe 27 PID 1704 wrote to memory of 1768 1704 rundll32.exe 27 PID 1704 wrote to memory of 1768 1704 rundll32.exe 27 PID 1704 wrote to memory of 1768 1704 rundll32.exe 27 PID 1704 wrote to memory of 1768 1704 rundll32.exe 27 PID 1704 wrote to memory of 1768 1704 rundll32.exe 27 PID 1704 wrote to memory of 1768 1704 rundll32.exe 27 PID 1768 wrote to memory of 1896 1768 rundll32.exe 28 PID 1768 wrote to memory of 1896 1768 rundll32.exe 28 PID 1768 wrote to memory of 1896 1768 rundll32.exe 28 PID 1768 wrote to memory of 1896 1768 rundll32.exe 28 PID 1896 wrote to memory of 2040 1896 mssecsvc.exe 31 PID 1896 wrote to memory of 2040 1896 mssecsvc.exe 31 PID 1896 wrote to memory of 2040 1896 mssecsvc.exe 31 PID 1896 wrote to memory of 2040 1896 mssecsvc.exe 31 PID 1896 wrote to memory of 2040 1896 mssecsvc.exe 31 PID 1896 wrote to memory of 2040 1896 mssecsvc.exe 31 PID 1896 wrote to memory of 2040 1896 mssecsvc.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5091c8470383ab149157d9b645e6aaa5.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5091c8470383ab149157d9b645e6aaa5.dll,#12⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i4⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2040
-
-
-
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2036
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\WINDOWS\mssecsvc.exe
- Size 3.6MB
- SHA256 f43223e6b8df51d54d81fb6f4dfb8ad17274ae22b58f514870737019942d7a11
- MD5 e13f14b004703cd9a0cf74b81e36eb0f
- SHA1 855d017e3341490d288f7ff571c44b96d684682e
- SHA512 a7af370dfb0e9f76cd65a5df2f20d430960725d0f181c572cf26b3c8fef8d927ddf44ea2b29102a41b9368775a6894af7cd685b27041ab22cb5de9e73a353da4
- SSDEEP 49152:2nsEKUv0cBVQej/1ICRx+TSqTdX1HkQo6SAARdhnv:ysyvZBhz1hRxcSUDk36SAEdhv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\WINDOWS\tasksche.exe
- Size 2.0MB
- SHA256 28c19226c6c403ba4a0d8078c2ab776a30b6c53e360bb8c74b0920b5b5316078
- MD5 8edec9b3a6d0ca313387ef8a422fe458
- SHA1 b733ad6b6a342cff3a4b91746d528528008b9029
- SHA512 1514ebab0972f7b343f0897623099217c40aa5d6179f5ed6a82630d7a061e52827fcbcbc0f519c4727eb2f1ee87f295fc0346f185a1721fc4fb5767b06d8560a
- SSDEEP 49152:XEKUv0cBVQej/1ICRx+TSqTdX1HkQo6SAARdhnvm:XyvZBhz1hRxcSUDk36SAEdhvm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mssecsvc.exe
- Size 3.6MB
- SHA256 f43223e6b8df51d54d81fb6f4dfb8ad17274ae22b58f514870737019942d7a11
- MD5 e13f14b004703cd9a0cf74b81e36eb0f
- SHA1 855d017e3341490d288f7ff571c44b96d684682e
- SHA512 a7af370dfb0e9f76cd65a5df2f20d430960725d0f181c572cf26b3c8fef8d927ddf44ea2b29102a41b9368775a6894af7cd685b27041ab22cb5de9e73a353da4
- SSDEEP 49152:2nsEKUv0cBVQej/1ICRx+TSqTdX1HkQo6SAARdhnv:ysyvZBhz1hRxcSUDk36SAEdhv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mssecsvc.exe
- Size 3.6MB
- SHA256 f43223e6b8df51d54d81fb6f4dfb8ad17274ae22b58f514870737019942d7a11
- MD5 e13f14b004703cd9a0cf74b81e36eb0f
- SHA1 855d017e3341490d288f7ff571c44b96d684682e
- SHA512 a7af370dfb0e9f76cd65a5df2f20d430960725d0f181c572cf26b3c8fef8d927ddf44ea2b29102a41b9368775a6894af7cd685b27041ab22cb5de9e73a353da4
- SSDEEP 49152:2nsEKUv0cBVQej/1ICRx+TSqTdX1HkQo6SAARdhnv:ysyvZBhz1hRxcSUDk36SAEdhv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\tasksche.exe
- Size 2.0MB
- SHA256 28c19226c6c403ba4a0d8078c2ab776a30b6c53e360bb8c74b0920b5b5316078
- MD5 8edec9b3a6d0ca313387ef8a422fe458
- SHA1 b733ad6b6a342cff3a4b91746d528528008b9029
- SHA512 1514ebab0972f7b343f0897623099217c40aa5d6179f5ed6a82630d7a061e52827fcbcbc0f519c4727eb2f1ee87f295fc0346f185a1721fc4fb5767b06d8560a
- SSDEEP 49152:XEKUv0cBVQej/1ICRx+TSqTdX1HkQo6SAARdhnvm:XyvZBhz1hRxcSUDk36SAEdhvm
- MD5 SHA1 SHA512 SSDEEP