Analysis
- max time kernel
151s - max time network
154s - platform
windows7_x64 - resource
win7-20220718-en - resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system - submitted
20/07/2022, 04:08
Static task
static1
Behavioral task
behavioral1
Sample
54b2bd4c6396ff50acd1710dbef840bf.dll
Resource
win7-20220718-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
54b2bd4c6396ff50acd1710dbef840bf.dll
Resource
win10v2004-20220414-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 54b2bd4c6396ff50acd1710dbef840bf.dll
- Size 5.0MB
- Sample220720-ep92nsccbk
- SHA256 83d1b64a9bca34640ec3722e9ef0dcb18669ec1b5a866f4e7517e760005b7d73
- MD5 54b2bd4c6396ff50acd1710dbef840bf
- SHA1 119e0db6c12e3836bfd966d65286ffbb1c5adc9f
- SHA512 e1ecb06295637faf16eab9150b54ae1ca86b582d03d1f3874ee61e9ed6c1d7e3fa21f400365c6e6bdb6b9250c56c8f7044880f4f0a538c841874a0586d30fda6
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Wannacry
WannaCry is a ransomware cryptoworm.
- Contacts a large (1258) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Executes dropped EXE 2 IoCs
pid Process 1652 mssecsvc.exe 516 mssecsvc.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvc.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\WINDOWS\mssecsvc.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvc.exe - Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1652 mssecsvc.exe 516 mssecsvc.exe - Suspicious behavior: MapViewOfSection 45 IoCs
pid Process 1652 mssecsvc.exe 1652 mssecsvc.exe 1652 mssecsvc.exe 1652 mssecsvc.exe 1652 mssecsvc.exe 1652 mssecsvc.exe 1652 mssecsvc.exe 1652 mssecsvc.exe 1652 mssecsvc.exe 1652 mssecsvc.exe 1652 mssecsvc.exe 1652 mssecsvc.exe 1652 mssecsvc.exe 1652 mssecsvc.exe 1652 mssecsvc.exe 1652 mssecsvc.exe 1652 mssecsvc.exe 1652 mssecsvc.exe 1652 mssecsvc.exe 1652 mssecsvc.exe 1652 mssecsvc.exe 1652 mssecsvc.exe 516 mssecsvc.exe 516 mssecsvc.exe 516 mssecsvc.exe 516 mssecsvc.exe 516 mssecsvc.exe 516 mssecsvc.exe 516 mssecsvc.exe 516 mssecsvc.exe 516 mssecsvc.exe 516 mssecsvc.exe 516 mssecsvc.exe 516 mssecsvc.exe 516 mssecsvc.exe 516 mssecsvc.exe 516 mssecsvc.exe 516 mssecsvc.exe 516 mssecsvc.exe 516 mssecsvc.exe 516 mssecsvc.exe 516 mssecsvc.exe 516 mssecsvc.exe 516 mssecsvc.exe 516 mssecsvc.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1652 mssecsvc.exe Token: SeDebugPrivilege 516 mssecsvc.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1680 wrote to memory of 1924 1680 rundll32.exe 28 PID 1680 wrote to memory of 1924 1680 rundll32.exe 28 PID 1680 wrote to memory of 1924 1680 rundll32.exe 28 PID 1680 wrote to memory of 1924 1680 rundll32.exe 28 PID 1680 wrote to memory of 1924 1680 rundll32.exe 28 PID 1680 wrote to memory of 1924 1680 rundll32.exe 28 PID 1680 wrote to memory of 1924 1680 rundll32.exe 28 PID 1924 wrote to memory of 1652 1924 rundll32.exe 29 PID 1924 wrote to memory of 1652 1924 rundll32.exe 29 PID 1924 wrote to memory of 1652 1924 rundll32.exe 29 PID 1924 wrote to memory of 1652 1924 rundll32.exe 29 PID 1652 wrote to memory of 368 1652 mssecsvc.exe 25 PID 1652 wrote to memory of 368 1652 mssecsvc.exe 25 PID 1652 wrote to memory of 368 1652 mssecsvc.exe 25 PID 1652 wrote to memory of 368 1652 mssecsvc.exe 25 PID 1652 wrote to memory of 368 1652 mssecsvc.exe 25 PID 1652 wrote to memory of 368 1652 mssecsvc.exe 25 PID 1652 wrote to memory of 368 1652 mssecsvc.exe 25 PID 1652 wrote to memory of 380 1652 mssecsvc.exe 4 PID 1652 wrote to memory of 380 1652 mssecsvc.exe 4 PID 1652 wrote to memory of 380 1652 mssecsvc.exe 4 PID 1652 wrote to memory of 380 1652 mssecsvc.exe 4 PID 1652 wrote to memory of 380 1652 mssecsvc.exe 4 PID 1652 wrote to memory of 380 1652 mssecsvc.exe 4 PID 1652 wrote to memory of 380 1652 mssecsvc.exe 4 PID 1652 wrote to memory of 416 1652 mssecsvc.exe 3 PID 1652 wrote to memory of 416 1652 mssecsvc.exe 3 PID 1652 wrote to memory of 416 1652 mssecsvc.exe 3 PID 1652 wrote to memory of 416 1652 mssecsvc.exe 3 PID 1652 wrote to memory of 416 1652 mssecsvc.exe 3 PID 1652 wrote to memory of 416 1652 mssecsvc.exe 3 PID 1652 wrote to memory of 416 1652 mssecsvc.exe 3 PID 1652 wrote to memory of 464 1652 mssecsvc.exe 2 PID 1652 wrote to memory of 464 1652 mssecsvc.exe 2 PID 1652 wrote to memory of 464 1652 mssecsvc.exe 2 PID 1652 wrote to memory of 464 1652 mssecsvc.exe 2 PID 1652 wrote to memory of 464 1652 mssecsvc.exe 2 PID 1652 wrote to memory of 464 1652 mssecsvc.exe 2 PID 1652 wrote to memory of 464 1652 mssecsvc.exe 2 PID 1652 wrote to memory of 472 1652 mssecsvc.exe 1 PID 1652 wrote to memory of 472 1652 mssecsvc.exe 1 PID 1652 wrote to memory of 472 1652 mssecsvc.exe 1 PID 1652 wrote to memory of 472 1652 mssecsvc.exe 1 PID 1652 wrote to memory of 472 1652 mssecsvc.exe 1 PID 1652 wrote to memory of 472 1652 mssecsvc.exe 1 PID 1652 wrote to memory of 472 1652 mssecsvc.exe 1 PID 1652 wrote to memory of 480 1652 mssecsvc.exe 24 PID 1652 wrote to memory of 480 1652 mssecsvc.exe 24 PID 1652 wrote to memory of 480 1652 mssecsvc.exe 24 PID 1652 wrote to memory of 480 1652 mssecsvc.exe 24 PID 1652 wrote to memory of 480 1652 mssecsvc.exe 24 PID 1652 wrote to memory of 480 1652 mssecsvc.exe 24 PID 1652 wrote to memory of 480 1652 mssecsvc.exe 24 PID 1652 wrote to memory of 588 1652 mssecsvc.exe 23 PID 1652 wrote to memory of 588 1652 mssecsvc.exe 23 PID 1652 wrote to memory of 588 1652 mssecsvc.exe 23 PID 1652 wrote to memory of 588 1652 mssecsvc.exe 23 PID 1652 wrote to memory of 588 1652 mssecsvc.exe 23 PID 1652 wrote to memory of 588 1652 mssecsvc.exe 23 PID 1652 wrote to memory of 588 1652 mssecsvc.exe 23 PID 1652 wrote to memory of 668 1652 mssecsvc.exe 22 PID 1652 wrote to memory of 668 1652 mssecsvc.exe 22 PID 1652 wrote to memory of 668 1652 mssecsvc.exe 22 PID 1652 wrote to memory of 668 1652 mssecsvc.exe 22
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:472
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵PID:464
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted2⤵PID:752
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe2⤵PID:1044
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation2⤵PID:1276
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork2⤵PID:1108
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"2⤵PID:1088
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe2⤵PID:1028
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService2⤵PID:336
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵PID:876
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService2⤵PID:844
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted2⤵PID:808
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS2⤵PID:668
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch2⤵PID:588
-
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:516
-
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:416
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:380
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1160
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe1⤵PID:1656
-
\\?\C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R1⤵PID:1940
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1184
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\54b2bd4c6396ff50acd1710dbef840bf.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\54b2bd4c6396ff50acd1710dbef840bf.dll,#13⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe4⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1652
-
-
-
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe1⤵PID:480
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:368
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\WINDOWS\MSSECSVC.EXE
- Size 3.6MB
- SHA256 70b302603bf9b3af5cdaf530cb10a15c95376e5dad58c0f84d1054d1289c50ba
- MD5 cd08f091a92497569aaceffe58cb2e39
- SHA1 1a1d061dde7ec483fcb5ea31b48b53055a95905f
- SHA512 678938e5c969eb793b8689b3ecb2a83560be99e203ea52b270a7fe0d3263572cd46ee2da845158fe54724cf8505e9689d570d2df71ab75cfc33f52d7f45928bf
- SSDEEP 98304:H8qPoBSk36SAEdhvxWa9P593R8yAVp2He:H8qP3k3ZAEUadzR8yc4He
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mssecsvc.exe
- Size 3.6MB
- SHA256 70b302603bf9b3af5cdaf530cb10a15c95376e5dad58c0f84d1054d1289c50ba
- MD5 cd08f091a92497569aaceffe58cb2e39
- SHA1 1a1d061dde7ec483fcb5ea31b48b53055a95905f
- SHA512 678938e5c969eb793b8689b3ecb2a83560be99e203ea52b270a7fe0d3263572cd46ee2da845158fe54724cf8505e9689d570d2df71ab75cfc33f52d7f45928bf
- SSDEEP 98304:H8qPoBSk36SAEdhvxWa9P593R8yAVp2He:H8qP3k3ZAEUadzR8yc4He
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mssecsvc.exe
- Size 3.6MB
- SHA256 70b302603bf9b3af5cdaf530cb10a15c95376e5dad58c0f84d1054d1289c50ba
- MD5 cd08f091a92497569aaceffe58cb2e39
- SHA1 1a1d061dde7ec483fcb5ea31b48b53055a95905f
- SHA512 678938e5c969eb793b8689b3ecb2a83560be99e203ea52b270a7fe0d3263572cd46ee2da845158fe54724cf8505e9689d570d2df71ab75cfc33f52d7f45928bf
- SSDEEP 98304:H8qPoBSk36SAEdhvxWa9P593R8yAVp2He:H8qP3k3ZAEUadzR8yc4He
- MD5 SHA1 SHA512 SSDEEP