Analysis
- max time kernel
151s - max time network
155s - platform
windows7_x64 - resource
win7-20220715-en - resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system - submitted
20/07/2022, 07:28
Static task
static1
Behavioral task
behavioral1
Sample
de02a847a18547aef3617b211dd8ed08.dll
Resource
win7-20220715-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
de02a847a18547aef3617b211dd8ed08.dll
Resource
win10v2004-20220718-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target de02a847a18547aef3617b211dd8ed08.dll
- Size 5.0MB
- Sample220720-janmcadba9
- SHA256 4244b83d32b31b5090b64b6bc8289542d3dc7889aff6ce7041ba33eda27ee424
- MD5 de02a847a18547aef3617b211dd8ed08
- SHA1 cdfb40c1c08fbe86b9a82a3d813df9d92ec049c3
- SHA512 a0e1afaffb041477ba52877aac16a482a55106f10839d3b422126f86ad441339292a5c1cb38c12925354cc1c7beddf454eb6627a2e73b49e1c383f2d52c858e9
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Wannacry
WannaCry is a ransomware cryptoworm.
- Contacts a large (1170) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Executes dropped EXE 3 IoCs
pid Process 1704 mssecsvc.exe 1548 mssecsvc.exe 1096 tasksche.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvc.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\WINDOWS\mssecsvc.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvc.exe - Modifies data under HKEY_USERS 21 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\36-ab-99-2e-89-9d\WpadDecisionTime = f0114f4c0a9cd801 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F363206D-C89B-4C23-8337-A926BC36CB0D}\36-ab-99-2e-89-9d mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F363206D-C89B-4C23-8337-A926BC36CB0D} mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F363206D-C89B-4C23-8337-A926BC36CB0D}\WpadDecisionReason = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F363206D-C89B-4C23-8337-A926BC36CB0D}\WpadDecision = "0" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F363206D-C89B-4C23-8337-A926BC36CB0D}\WpadNetworkName = "Network 3" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\36-ab-99-2e-89-9d\WpadDecision = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00f3000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F363206D-C89B-4C23-8337-A926BC36CB0D}\WpadDecisionTime = f0114f4c0a9cd801 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\36-ab-99-2e-89-9d mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\36-ab-99-2e-89-9d\WpadDecisionReason = "1" mssecsvc.exe - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1680 wrote to memory of 828 1680 rundll32.exe 27 PID 1680 wrote to memory of 828 1680 rundll32.exe 27 PID 1680 wrote to memory of 828 1680 rundll32.exe 27 PID 1680 wrote to memory of 828 1680 rundll32.exe 27 PID 1680 wrote to memory of 828 1680 rundll32.exe 27 PID 1680 wrote to memory of 828 1680 rundll32.exe 27 PID 1680 wrote to memory of 828 1680 rundll32.exe 27 PID 828 wrote to memory of 1704 828 rundll32.exe 28 PID 828 wrote to memory of 1704 828 rundll32.exe 28 PID 828 wrote to memory of 1704 828 rundll32.exe 28 PID 828 wrote to memory of 1704 828 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\de02a847a18547aef3617b211dd8ed08.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\de02a847a18547aef3617b211dd8ed08.dll,#12⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:828 -
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1704 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i4⤵
- Executes dropped EXE
PID:1096
-
-
-
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1548
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\WINDOWS\mssecsvc.exe
- Size 3.6MB
- SHA256 e5867fcba50087f156b2b04169685fdb7e8d2117d79faee5e8bcbe8383f801c4
- MD5 656f270ec6ee81eef0996ad1efaa6374
- SHA1 dad5f71de94d4236f7cb707f92a7b95f8cae79ba
- SHA512 cc5e43f983c2a309f46f1b447059e209f69f35b5add6f50f6ea939655ffee994b2f74e9654b27f558d03112bd74b4a25aedfcdb7a1134335fc54355d26182db7
- SSDEEP 49152:8nQQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnv:czqPoBhz1aRxcSUDk36SAEdhv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mssecsvc.exe
- Size 3.6MB
- SHA256 e5867fcba50087f156b2b04169685fdb7e8d2117d79faee5e8bcbe8383f801c4
- MD5 656f270ec6ee81eef0996ad1efaa6374
- SHA1 dad5f71de94d4236f7cb707f92a7b95f8cae79ba
- SHA512 cc5e43f983c2a309f46f1b447059e209f69f35b5add6f50f6ea939655ffee994b2f74e9654b27f558d03112bd74b4a25aedfcdb7a1134335fc54355d26182db7
- SSDEEP 49152:8nQQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnv:czqPoBhz1aRxcSUDk36SAEdhv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mssecsvc.exe
- Size 3.6MB
- SHA256 e5867fcba50087f156b2b04169685fdb7e8d2117d79faee5e8bcbe8383f801c4
- MD5 656f270ec6ee81eef0996ad1efaa6374
- SHA1 dad5f71de94d4236f7cb707f92a7b95f8cae79ba
- SHA512 cc5e43f983c2a309f46f1b447059e209f69f35b5add6f50f6ea939655ffee994b2f74e9654b27f558d03112bd74b4a25aedfcdb7a1134335fc54355d26182db7
- SSDEEP 49152:8nQQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnv:czqPoBhz1aRxcSUDk36SAEdhv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\tasksche.exe
- Size 3.4MB
- SHA256 e3825cad783a302902576ca4cfae9fdfc8640a012876402c89e7dd22475cda91
- MD5 ba8922fceaeed80297c3c391c8844b70
- SHA1 2ef2a451fbcd42a938ae3d7bfad93dbc8ebe144f
- SHA512 faee2d00623ab8a0db455a4b26074faed6da189220630f5260c331ed3d7f633f4cb253efaae25101c64ca836bea92b2de9e8c18614da483d4614b2e176d159bb
- SSDEEP 49152:nQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnv:QqPoBhz1aRxcSUDk36SAEdhv
- MD5 SHA1 SHA512 SSDEEP