Analysis
-
max time kernel
154s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220718-en -
resource tags
arch:x64arch:x86image:win10v2004-20220718-enlocale:en-usos:windows10-2004-x64system -
submitted
20-07-2022 03:18
Static task
static1
Behavioral task
behavioral1
Sample
9a0007dc87e330fa8ac51b67735f90c4.dll
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
9a0007dc87e330fa8ac51b67735f90c4.dll
Resource
win10v2004-20220718-en
General
-
Target
9a0007dc87e330fa8ac51b67735f90c4.dll
-
Size
5.0MB
-
MD5
9a0007dc87e330fa8ac51b67735f90c4
-
SHA1
d66a867d4b5c045c2248abfb61a0c70da7dd71d7
-
SHA256
0593c6b23a9e41f7f6dda4b603bfe6109aa0ce0d26ef015edff95497d41947a1
-
SHA512
e3bbda2afb2fff367bc5daa70712a0138d0e62aa2130bb246d4e46e8f9be1fae1adac5f89a54ba6369b69042ae88eb7a96ca4ad17e9b3d83ed63d10ef97a9c31
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (2932) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 3 IoCs
Processes:
mssecsvc.exemssecsvc.exetasksche.exepid process 2776 mssecsvc.exe 2640 mssecsvc.exe 3504 tasksche.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in Windows directory 2 IoCs
Processes:
rundll32.exemssecsvc.exedescription ioc process File created C:\WINDOWS\mssecsvc.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvc.exe -
Modifies data under HKEY_USERS 5 IoCs
Processes:
mssecsvc.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" mssecsvc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1800 wrote to memory of 1384 1800 rundll32.exe rundll32.exe PID 1800 wrote to memory of 1384 1800 rundll32.exe rundll32.exe PID 1800 wrote to memory of 1384 1800 rundll32.exe rundll32.exe PID 1384 wrote to memory of 2776 1384 rundll32.exe mssecsvc.exe PID 1384 wrote to memory of 2776 1384 rundll32.exe mssecsvc.exe PID 1384 wrote to memory of 2776 1384 rundll32.exe mssecsvc.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9a0007dc87e330fa8ac51b67735f90c4.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9a0007dc87e330fa8ac51b67735f90c4.dll,#12⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2776 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i4⤵
- Executes dropped EXE
PID:3504
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:2640
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.6MB
MD534f0ba461f5fbfac35bc0d28bc065c3a
SHA16dcaa535d2d7b80856e7d42f9e5a5bb23b9bbdf0
SHA2562dc592fd09d6454188e28caaf13d0dcd61a56eb34a14bfde4afe34d22c65929d
SHA512e57e26c363932ab58a4f78160d1b354883b856080f3783666e673060df21c52bd6b653283c393e7c5869183ada2afbef5f4db5caaa9ca4dcad8287f71d40f837
-
Filesize
3.6MB
MD534f0ba461f5fbfac35bc0d28bc065c3a
SHA16dcaa535d2d7b80856e7d42f9e5a5bb23b9bbdf0
SHA2562dc592fd09d6454188e28caaf13d0dcd61a56eb34a14bfde4afe34d22c65929d
SHA512e57e26c363932ab58a4f78160d1b354883b856080f3783666e673060df21c52bd6b653283c393e7c5869183ada2afbef5f4db5caaa9ca4dcad8287f71d40f837
-
Filesize
3.6MB
MD534f0ba461f5fbfac35bc0d28bc065c3a
SHA16dcaa535d2d7b80856e7d42f9e5a5bb23b9bbdf0
SHA2562dc592fd09d6454188e28caaf13d0dcd61a56eb34a14bfde4afe34d22c65929d
SHA512e57e26c363932ab58a4f78160d1b354883b856080f3783666e673060df21c52bd6b653283c393e7c5869183ada2afbef5f4db5caaa9ca4dcad8287f71d40f837
-
Filesize
3.4MB
MD57f7ccaa16fb15eb1c7399d422f8363e8
SHA1bd44d0ab543bf814d93b719c24e90d8dd7111234
SHA2562584e1521065e45ec3c17767c065429038fc6291c091097ea8b22c8a502c41dd
SHA51283e334b80de08903cfa9891a3fa349c1ece7e19f8e62b74a017512fa9a7989a0fd31929bf1fc13847bee04f2da3dacf6bc3f5ee58f0e4b9d495f4b9af12ed2b7