Analysis
- max time kernel
150s - max time network
153s - platform
windows7_x64 - resource
win7-20220718-en - resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system - submitted
20/07/2022, 05:15
Static task
static1
Behavioral task
behavioral1
Sample
ec905346a1cd50a09d5cee5a0eda2b35.dll
Resource
win7-20220718-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
ec905346a1cd50a09d5cee5a0eda2b35.dll
Resource
win10v2004-20220414-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target ec905346a1cd50a09d5cee5a0eda2b35.dll
- Size 5.0MB
- Sample220720-fxkmescffr
- SHA256 3aef98f047e5e65351a18e84cd10a42a092915acb89a446bade7e12a97a5c816
- MD5 ec905346a1cd50a09d5cee5a0eda2b35
- SHA1 e83449a6acfa5eaa8c0e07be108ab6f82e6d2448
- SHA512 68180c9ecbd6e008672ba351d693804b330be64c07e871abb6db60f0c23a23767d7024d79e8d0bf436e28b2e1eab2db71c8af3be3b838ca67f4502adb620dc47
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Wannacry
WannaCry is a ransomware cryptoworm.
- Contacts a large (1238) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Executes dropped EXE 3 IoCs
pid Process 1384 mssecsvc.exe 1720 mssecsvc.exe 560 tasksche.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvc.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\WINDOWS\tasksche.exe mssecsvc.exe File created C:\WINDOWS\mssecsvc.exe rundll32.exe - Modifies data under HKEY_USERS 24 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{53AD3FDE-7298-4E50-9853-0162DA26E8F8}\WpadDecision = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{53AD3FDE-7298-4E50-9853-0162DA26E8F8}\26-23-c3-8c-41-59 mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\26-23-c3-8c-41-59\WpadDecisionTime = 50105d78089cd801 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00bb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{53AD3FDE-7298-4E50-9853-0162DA26E8F8} mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{53AD3FDE-7298-4E50-9853-0162DA26E8F8}\WpadDecisionTime = 50105d78089cd801 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\26-23-c3-8c-41-59 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{53AD3FDE-7298-4E50-9853-0162DA26E8F8}\WpadDecisionReason = "1" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{53AD3FDE-7298-4E50-9853-0162DA26E8F8}\WpadNetworkName = "Network 3" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\26-23-c3-8c-41-59\WpadDecisionReason = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\26-23-c3-8c-41-59\WpadDecision = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mssecsvc.exe - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1140 wrote to memory of 1008 1140 rundll32.exe 28 PID 1140 wrote to memory of 1008 1140 rundll32.exe 28 PID 1140 wrote to memory of 1008 1140 rundll32.exe 28 PID 1140 wrote to memory of 1008 1140 rundll32.exe 28 PID 1140 wrote to memory of 1008 1140 rundll32.exe 28 PID 1140 wrote to memory of 1008 1140 rundll32.exe 28 PID 1140 wrote to memory of 1008 1140 rundll32.exe 28 PID 1008 wrote to memory of 1384 1008 rundll32.exe 29 PID 1008 wrote to memory of 1384 1008 rundll32.exe 29 PID 1008 wrote to memory of 1384 1008 rundll32.exe 29 PID 1008 wrote to memory of 1384 1008 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ec905346a1cd50a09d5cee5a0eda2b35.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ec905346a1cd50a09d5cee5a0eda2b35.dll,#12⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1384 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i4⤵
- Executes dropped EXE
PID:560
-
-
-
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1720
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\WINDOWS\mssecsvc.exe
- Size 3.6MB
- SHA256 eac305546cc67aa45de8d6fe57af524b6e7245f6f7a1862e444bbe8ef2f345d3
- MD5 2dcbbb9a4b69563e6b262d357aaf46e8
- SHA1 115a276323672cc68871d373091fe40cfb0c67ec
- SHA512 0d6ae1dcbe7d2c9c1660b5fe83f8c3482330dbf6366d74a1041b05f5abad24ba957ccdacafdd7d07a8d80a1d0618afaf0282e1784b25ec8d530ea47bc5f47344
- SSDEEP 98304:XDqPoBhz1aRxcSUDk36SAEdhvxWa9P59358yAVp2HI:XDqPe1Cxcxk3ZAEUadz58yc4HI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mssecsvc.exe
- Size 3.6MB
- SHA256 eac305546cc67aa45de8d6fe57af524b6e7245f6f7a1862e444bbe8ef2f345d3
- MD5 2dcbbb9a4b69563e6b262d357aaf46e8
- SHA1 115a276323672cc68871d373091fe40cfb0c67ec
- SHA512 0d6ae1dcbe7d2c9c1660b5fe83f8c3482330dbf6366d74a1041b05f5abad24ba957ccdacafdd7d07a8d80a1d0618afaf0282e1784b25ec8d530ea47bc5f47344
- SSDEEP 98304:XDqPoBhz1aRxcSUDk36SAEdhvxWa9P59358yAVp2HI:XDqPe1Cxcxk3ZAEUadz58yc4HI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mssecsvc.exe
- Size 3.6MB
- SHA256 eac305546cc67aa45de8d6fe57af524b6e7245f6f7a1862e444bbe8ef2f345d3
- MD5 2dcbbb9a4b69563e6b262d357aaf46e8
- SHA1 115a276323672cc68871d373091fe40cfb0c67ec
- SHA512 0d6ae1dcbe7d2c9c1660b5fe83f8c3482330dbf6366d74a1041b05f5abad24ba957ccdacafdd7d07a8d80a1d0618afaf0282e1784b25ec8d530ea47bc5f47344
- SSDEEP 98304:XDqPoBhz1aRxcSUDk36SAEdhvxWa9P59358yAVp2HI:XDqPe1Cxcxk3ZAEUadz58yc4HI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\tasksche.exe
- Size 3.4MB
- SHA256 149b43f1ebaf4ce9400020521fd7bd74f99f03f1eaa2e66a3df53c0c52565799
- MD5 6803f13093775593eebb1ece792811d0
- SHA1 2f0293a04d0503480c4c5399d80aba08c9418786
- SHA512 92660ee9d12a43848a753afaf36de7ebf60c686db17b502b19a1dfedf88b009925abc9dbbc9b42d45e77621a7e8b671e7be6202e1d733a313c18c1668993599a
- SSDEEP 98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P59358yAVp2Hj:QqPe1Cxcxk3ZAEUadz58yc4Hj
- MD5 SHA1 SHA512 SSDEEP