Analysis
- max time kernel
150s - max time network
154s - platform
windows7_x64 - resource
win7-20220715-en - resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system - submitted
20/07/2022, 03:27
Static task
static1
Behavioral task
behavioral1
Sample
faed32ee420704e18792dadaade82c2d.dll
Resource
win7-20220715-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
faed32ee420704e18792dadaade82c2d.dll
Resource
win10v2004-20220718-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target faed32ee420704e18792dadaade82c2d.dll
- Size 5.0MB
- Sample220720-dzrseabdb2
- SHA256 a60b47e8c834aa97ddda9bd70dd41d8dc61649fd878ea913bc242ae79fe8cc77
- MD5 faed32ee420704e18792dadaade82c2d
- SHA1 3386d17c56ad13ab1ed43829a1d90a72453e8c3c
- SHA512 865d77647dd622bd68330f5af9238c98f9fd272f1aa4cdf24f2c73937c4215d904b9162376bab4dbef0734254c99634056038a89cf9040a373c2cd796d40ed0b
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Wannacry
WannaCry is a ransomware cryptoworm.
- Contacts a large (1309) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Executes dropped EXE 2 IoCs
pid Process 1968 mssecsvc.exe 1924 mssecsvc.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvc.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\WINDOWS\mssecsvc.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvc.exe - Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1968 mssecsvc.exe 1924 mssecsvc.exe - Suspicious behavior: MapViewOfSection 43 IoCs
pid Process 1968 mssecsvc.exe 1968 mssecsvc.exe 1968 mssecsvc.exe 1968 mssecsvc.exe 1968 mssecsvc.exe 1968 mssecsvc.exe 1968 mssecsvc.exe 1968 mssecsvc.exe 1968 mssecsvc.exe 1968 mssecsvc.exe 1968 mssecsvc.exe 1968 mssecsvc.exe 1968 mssecsvc.exe 1968 mssecsvc.exe 1968 mssecsvc.exe 1968 mssecsvc.exe 1968 mssecsvc.exe 1968 mssecsvc.exe 1968 mssecsvc.exe 1968 mssecsvc.exe 1968 mssecsvc.exe 1924 mssecsvc.exe 1924 mssecsvc.exe 1924 mssecsvc.exe 1924 mssecsvc.exe 1924 mssecsvc.exe 1924 mssecsvc.exe 1924 mssecsvc.exe 1924 mssecsvc.exe 1924 mssecsvc.exe 1924 mssecsvc.exe 1924 mssecsvc.exe 1924 mssecsvc.exe 1924 mssecsvc.exe 1924 mssecsvc.exe 1924 mssecsvc.exe 1924 mssecsvc.exe 1924 mssecsvc.exe 1924 mssecsvc.exe 1924 mssecsvc.exe 1924 mssecsvc.exe 1924 mssecsvc.exe 1924 mssecsvc.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1968 mssecsvc.exe Token: SeDebugPrivilege 1924 mssecsvc.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1028 wrote to memory of 1652 1028 rundll32.exe 27 PID 1028 wrote to memory of 1652 1028 rundll32.exe 27 PID 1028 wrote to memory of 1652 1028 rundll32.exe 27 PID 1028 wrote to memory of 1652 1028 rundll32.exe 27 PID 1028 wrote to memory of 1652 1028 rundll32.exe 27 PID 1028 wrote to memory of 1652 1028 rundll32.exe 27 PID 1028 wrote to memory of 1652 1028 rundll32.exe 27 PID 1652 wrote to memory of 1968 1652 rundll32.exe 28 PID 1652 wrote to memory of 1968 1652 rundll32.exe 28 PID 1652 wrote to memory of 1968 1652 rundll32.exe 28 PID 1652 wrote to memory of 1968 1652 rundll32.exe 28 PID 1968 wrote to memory of 372 1968 mssecsvc.exe 24 PID 1968 wrote to memory of 372 1968 mssecsvc.exe 24 PID 1968 wrote to memory of 372 1968 mssecsvc.exe 24 PID 1968 wrote to memory of 372 1968 mssecsvc.exe 24 PID 1968 wrote to memory of 372 1968 mssecsvc.exe 24 PID 1968 wrote to memory of 372 1968 mssecsvc.exe 24 PID 1968 wrote to memory of 372 1968 mssecsvc.exe 24 PID 1968 wrote to memory of 384 1968 mssecsvc.exe 23 PID 1968 wrote to memory of 384 1968 mssecsvc.exe 23 PID 1968 wrote to memory of 384 1968 mssecsvc.exe 23 PID 1968 wrote to memory of 384 1968 mssecsvc.exe 23 PID 1968 wrote to memory of 384 1968 mssecsvc.exe 23 PID 1968 wrote to memory of 384 1968 mssecsvc.exe 23 PID 1968 wrote to memory of 384 1968 mssecsvc.exe 23 PID 1968 wrote to memory of 420 1968 mssecsvc.exe 3 PID 1968 wrote to memory of 420 1968 mssecsvc.exe 3 PID 1968 wrote to memory of 420 1968 mssecsvc.exe 3 PID 1968 wrote to memory of 420 1968 mssecsvc.exe 3 PID 1968 wrote to memory of 420 1968 mssecsvc.exe 3 PID 1968 wrote to memory of 420 1968 mssecsvc.exe 3 PID 1968 wrote to memory of 420 1968 mssecsvc.exe 3 PID 1968 wrote to memory of 464 1968 mssecsvc.exe 2 PID 1968 wrote to memory of 464 1968 mssecsvc.exe 2 PID 1968 wrote to memory of 464 1968 mssecsvc.exe 2 PID 1968 wrote to memory of 464 1968 mssecsvc.exe 2 PID 1968 wrote to memory of 464 1968 mssecsvc.exe 2 PID 1968 wrote to memory of 464 1968 mssecsvc.exe 2 PID 1968 wrote to memory of 464 1968 mssecsvc.exe 2 PID 1968 wrote to memory of 480 1968 mssecsvc.exe 1 PID 1968 wrote to memory of 480 1968 mssecsvc.exe 1 PID 1968 wrote to memory of 480 1968 mssecsvc.exe 1 PID 1968 wrote to memory of 480 1968 mssecsvc.exe 1 PID 1968 wrote to memory of 480 1968 mssecsvc.exe 1 PID 1968 wrote to memory of 480 1968 mssecsvc.exe 1 PID 1968 wrote to memory of 480 1968 mssecsvc.exe 1 PID 1968 wrote to memory of 488 1968 mssecsvc.exe 22 PID 1968 wrote to memory of 488 1968 mssecsvc.exe 22 PID 1968 wrote to memory of 488 1968 mssecsvc.exe 22 PID 1968 wrote to memory of 488 1968 mssecsvc.exe 22 PID 1968 wrote to memory of 488 1968 mssecsvc.exe 22 PID 1968 wrote to memory of 488 1968 mssecsvc.exe 22 PID 1968 wrote to memory of 488 1968 mssecsvc.exe 22 PID 1968 wrote to memory of 584 1968 mssecsvc.exe 21 PID 1968 wrote to memory of 584 1968 mssecsvc.exe 21 PID 1968 wrote to memory of 584 1968 mssecsvc.exe 21 PID 1968 wrote to memory of 584 1968 mssecsvc.exe 21 PID 1968 wrote to memory of 584 1968 mssecsvc.exe 21 PID 1968 wrote to memory of 584 1968 mssecsvc.exe 21 PID 1968 wrote to memory of 584 1968 mssecsvc.exe 21 PID 1968 wrote to memory of 660 1968 mssecsvc.exe 20 PID 1968 wrote to memory of 660 1968 mssecsvc.exe 20 PID 1968 wrote to memory of 660 1968 mssecsvc.exe 20 PID 1968 wrote to memory of 660 1968 mssecsvc.exe 20
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:480
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵PID:464
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork2⤵PID:1076
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe2⤵PID:1704
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation2⤵PID:1628
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"2⤵PID:1092
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe2⤵PID:924
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService2⤵PID:336
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵PID:868
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService2⤵PID:824
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted2⤵PID:796
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted2⤵PID:748
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS2⤵PID:660
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch2⤵PID:584
-
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1924
-
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:420
-
\\?\C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R1⤵PID:1824
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1208
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\faed32ee420704e18792dadaade82c2d.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\faed32ee420704e18792dadaade82c2d.dll,#13⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe4⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1968
-
-
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1180
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe1⤵PID:488
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:384
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:372
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\WINDOWS\MSSECSVC.EXE
- Size 3.6MB
- SHA256 9c415ab9b62fd48ccc69ac52bb02e2434251e2bf284c0fa8c3ce4e92a8491181
- MD5 6bfb87be19b27ae2bfc5e42931772470
- SHA1 37a6cf87d9c50300302db60a8c23b8542c585a2c
- SHA512 1afb98e69194ded7230f0a313d67d10d0a1be3c70a7ea129463a51b2ad5723e6965d8cc5e67d049ae3897709c94295fa5dc1a0af59d9a5d4f61269089c439ab5
- SSDEEP 6144:wE9l9yNqIYVTH5DgSg8ajldktM0XXrs2Qh9kH/3U:wwbLgPluxQh9Gk
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mssecsvc.exe
- Size 3.6MB
- SHA256 9c415ab9b62fd48ccc69ac52bb02e2434251e2bf284c0fa8c3ce4e92a8491181
- MD5 6bfb87be19b27ae2bfc5e42931772470
- SHA1 37a6cf87d9c50300302db60a8c23b8542c585a2c
- SHA512 1afb98e69194ded7230f0a313d67d10d0a1be3c70a7ea129463a51b2ad5723e6965d8cc5e67d049ae3897709c94295fa5dc1a0af59d9a5d4f61269089c439ab5
- SSDEEP 6144:wE9l9yNqIYVTH5DgSg8ajldktM0XXrs2Qh9kH/3U:wwbLgPluxQh9Gk
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mssecsvc.exe
- Size 3.6MB
- SHA256 9c415ab9b62fd48ccc69ac52bb02e2434251e2bf284c0fa8c3ce4e92a8491181
- MD5 6bfb87be19b27ae2bfc5e42931772470
- SHA1 37a6cf87d9c50300302db60a8c23b8542c585a2c
- SHA512 1afb98e69194ded7230f0a313d67d10d0a1be3c70a7ea129463a51b2ad5723e6965d8cc5e67d049ae3897709c94295fa5dc1a0af59d9a5d4f61269089c439ab5
- SSDEEP 6144:wE9l9yNqIYVTH5DgSg8ajldktM0XXrs2Qh9kH/3U:wwbLgPluxQh9Gk
- MD5 SHA1 SHA512 SSDEEP