Analysis
-
max time kernel
157s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20220718-en -
resource tags
arch:x64arch:x86image:win10v2004-20220718-enlocale:en-usos:windows10-2004-x64system -
submitted
20-07-2022 02:58
Static task
static1
Behavioral task
behavioral1
Sample
5c75788acca3a2efc5db41dc9c6330d8.dll
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
5c75788acca3a2efc5db41dc9c6330d8.dll
Resource
win10v2004-20220718-en
General
-
Target
5c75788acca3a2efc5db41dc9c6330d8.dll
-
Size
5.0MB
-
MD5
5c75788acca3a2efc5db41dc9c6330d8
-
SHA1
67b88e3e3221cdd65d21641843ad55777f98194e
-
SHA256
69d9ac6b3533520ec458645a14a7538da4dcbad315aeb8737017f27d5c1c62d9
-
SHA512
b67d69a47b38057e09eca8a2f1235784c2786fcd218d837253fdf43724a01f2a08ce3152b0e5caf5da6a8cf3bb7efe8f7757554ae6bd2797c82bfc04c411692e
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (3033) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 3 IoCs
Processes:
mssecsvc.exemssecsvc.exetasksche.exepid process 2592 mssecsvc.exe 3080 mssecsvc.exe 5008 tasksche.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in Windows directory 2 IoCs
Processes:
rundll32.exemssecsvc.exedescription ioc process File created C:\WINDOWS\mssecsvc.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 3848 wrote to memory of 2256 3848 rundll32.exe rundll32.exe PID 3848 wrote to memory of 2256 3848 rundll32.exe rundll32.exe PID 3848 wrote to memory of 2256 3848 rundll32.exe rundll32.exe PID 2256 wrote to memory of 2592 2256 rundll32.exe mssecsvc.exe PID 2256 wrote to memory of 2592 2256 rundll32.exe mssecsvc.exe PID 2256 wrote to memory of 2592 2256 rundll32.exe mssecsvc.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5c75788acca3a2efc5db41dc9c6330d8.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5c75788acca3a2efc5db41dc9c6330d8.dll,#12⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i4⤵
- Executes dropped EXE
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\WINDOWS\mssecsvc.exeFilesize
3.6MB
MD55a5fc66f983c4900a0a66b3f22df70a5
SHA1dce4efd779d512b507619dfa4b18dee6c4856d63
SHA256834bf0b3f4970a87789693bc40d8d2f52a0f1e06fb7427704c35836378dfb075
SHA512a344ffca84fb8ea856afe06c04cd83bffc094f9946385a890d5dfcaa32c33ecfa1e4e805310efc358e276440c28996054434728c3d58ce90c84214f84c781b2d
-
C:\Windows\mssecsvc.exeFilesize
3.6MB
MD55a5fc66f983c4900a0a66b3f22df70a5
SHA1dce4efd779d512b507619dfa4b18dee6c4856d63
SHA256834bf0b3f4970a87789693bc40d8d2f52a0f1e06fb7427704c35836378dfb075
SHA512a344ffca84fb8ea856afe06c04cd83bffc094f9946385a890d5dfcaa32c33ecfa1e4e805310efc358e276440c28996054434728c3d58ce90c84214f84c781b2d
-
C:\Windows\mssecsvc.exeFilesize
3.6MB
MD55a5fc66f983c4900a0a66b3f22df70a5
SHA1dce4efd779d512b507619dfa4b18dee6c4856d63
SHA256834bf0b3f4970a87789693bc40d8d2f52a0f1e06fb7427704c35836378dfb075
SHA512a344ffca84fb8ea856afe06c04cd83bffc094f9946385a890d5dfcaa32c33ecfa1e4e805310efc358e276440c28996054434728c3d58ce90c84214f84c781b2d
-
C:\Windows\tasksche.exeFilesize
3.4MB
MD58f1f756a4789b6cf57bb7b34ce42fa3d
SHA1a4431c539f7d45401346854b6151a34857fb8237
SHA2562e6dd230043ee174ac89cc0059da2840a92635893f70358a3d101372c3355021
SHA5129887099fab7c7343f16bbcb2e85cddadb1138f5a76f9baa83599f658f24a0ed279ad688860f95f11cda07d039473ed85ca21603e44735e25ae44570c22af03e4
-
memory/2256-130-0x0000000000000000-mapping.dmp
-
memory/2592-131-0x0000000000000000-mapping.dmp