Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220718-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220718-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-07-2022 03:00

General

  • Target

    c122b1bbf01fbea4985e455083c8cbf3.dll

  • Size

    5.0MB

  • MD5

    c122b1bbf01fbea4985e455083c8cbf3

  • SHA1

    554b28c4fd74a59091ad01004626928c4af21b12

  • SHA256

    46ef01945311c5790603ea2bd38444f0bbdaed1a50c53101a82856f81d924089

  • SHA512

    1321704c7b44b1590b8b6d0f8127055f55a6445c052be13af4161f4f5e27e3245ee85db43e38455c999d35615035a18927d430f0d143041bf844e0e2a8cba123

Malware Config

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

  • Contacts a large (3144) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Executes dropped EXE 3 IoCs
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Drops file in Windows directory 2 IoCs
  • Modifies data under HKEY_USERS 5 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\c122b1bbf01fbea4985e455083c8cbf3.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:916
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\c122b1bbf01fbea4985e455083c8cbf3.dll,#1
      2⤵
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:3944
      • C:\WINDOWS\mssecsvc.exe
        C:\WINDOWS\mssecsvc.exe
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        PID:424
        • C:\WINDOWS\tasksche.exe
          C:\WINDOWS\tasksche.exe /i
          4⤵
          • Executes dropped EXE
          PID:2916
  • C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe -m security
    1⤵
    • Executes dropped EXE
    • Modifies data under HKEY_USERS
    PID:2068

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\WINDOWS\mssecsvc.exe

    Filesize

    3.6MB

    MD5

    798c86bf295feb1d8b6ebc4d77dbc3d4

    SHA1

    e878fda33287a92b2edf5b17389bf3a8e2c41c4f

    SHA256

    92800d90070740d9399389ca089b82684ae25607349a0e15b3bfda772e81199a

    SHA512

    006ac6536c6bb4d84f64486d65067b6285460e6342f18ce3062ddc0e92ad31081f4fe782965efa72fe37933acf578f162c5c39c8d98d7dddadc198babefce6d8

  • C:\Windows\mssecsvc.exe

    Filesize

    3.6MB

    MD5

    798c86bf295feb1d8b6ebc4d77dbc3d4

    SHA1

    e878fda33287a92b2edf5b17389bf3a8e2c41c4f

    SHA256

    92800d90070740d9399389ca089b82684ae25607349a0e15b3bfda772e81199a

    SHA512

    006ac6536c6bb4d84f64486d65067b6285460e6342f18ce3062ddc0e92ad31081f4fe782965efa72fe37933acf578f162c5c39c8d98d7dddadc198babefce6d8

  • C:\Windows\mssecsvc.exe

    Filesize

    3.6MB

    MD5

    798c86bf295feb1d8b6ebc4d77dbc3d4

    SHA1

    e878fda33287a92b2edf5b17389bf3a8e2c41c4f

    SHA256

    92800d90070740d9399389ca089b82684ae25607349a0e15b3bfda772e81199a

    SHA512

    006ac6536c6bb4d84f64486d65067b6285460e6342f18ce3062ddc0e92ad31081f4fe782965efa72fe37933acf578f162c5c39c8d98d7dddadc198babefce6d8

  • C:\Windows\tasksche.exe

    Filesize

    3.4MB

    MD5

    72a0273e5bdad2089ab90020265fcbce

    SHA1

    4a64856c9b86cc9f74fc6e74524d3cb09c3668a4

    SHA256

    45dc98a814d1bfd4ba7790b607da53678df7c99e3e1747f7ad4f56899e3805e4

    SHA512

    e02a324565dee584ba64e47936c5ab6a70d0c00e69e9767bf82d8c8195771a8270699f72ad0d64a490d22b0be32b54ce04c3df973baa8e8b65434781e848eb02

  • memory/424-131-0x0000000000000000-mapping.dmp

  • memory/3944-130-0x0000000000000000-mapping.dmp