Analysis
- max time kernel
154s - max time network
164s - platform
windows7_x64 - resource
win7-20220718-en - resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system - submitted
20/07/2022, 07:29
Static task
static1
Behavioral task
behavioral1
Sample
66bb0b650bfdf95d6000f97d4bbf0f25.dll
Resource
win7-20220718-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
66bb0b650bfdf95d6000f97d4bbf0f25.dll
Resource
win10v2004-20220718-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 66bb0b650bfdf95d6000f97d4bbf0f25.dll
- Size 5.0MB
- Sample220720-jbaf4sdfbn
- SHA256 0ce349c3dba0d77585320010f0531548729455aaedd56c2ecb9d5fb7bd4d2abc
- MD5 66bb0b650bfdf95d6000f97d4bbf0f25
- SHA1 fcaa64a6708b2a2d5541aff4396099fc0fc369bf
- SHA512 450c39719b90cbe335242381888fc6a4b55f60bebf8bfc4b8b6e19ae84b4cdc3938123e340a3a05065c4ac317d948ab63325204c8a91e2edd7cc27e54359b2b1
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Wannacry
WannaCry is a ransomware cryptoworm.
- Contacts a large (1278) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Executes dropped EXE 2 IoCs
pid Process 976 mssecsvr.exe 2016 mssecsvr.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvr.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\WINDOWS\mssecsvr.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvr.exe - Modifies data under HKEY_USERS 24 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00bc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-31-93-ef-c4-8f\WpadDecisionReason = "1" mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{91B91427-278C-456F-90B8-31FE4C81EBD2} mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{91B91427-278C-456F-90B8-31FE4C81EBD2}\WpadDecisionTime = 401a8b381b9cd801 mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{91B91427-278C-456F-90B8-31FE4C81EBD2}\WpadNetworkName = "Network 3" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-31-93-ef-c4-8f mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{91B91427-278C-456F-90B8-31FE4C81EBD2}\WpadDecision = "0" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{91B91427-278C-456F-90B8-31FE4C81EBD2}\52-31-93-ef-c4-8f mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{91B91427-278C-456F-90B8-31FE4C81EBD2}\WpadDecisionReason = "1" mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-31-93-ef-c4-8f\WpadDecisionTime = 401a8b381b9cd801 mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-31-93-ef-c4-8f\WpadDecision = "0" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvr.exe - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1452 wrote to memory of 888 1452 rundll32.exe 27 PID 1452 wrote to memory of 888 1452 rundll32.exe 27 PID 1452 wrote to memory of 888 1452 rundll32.exe 27 PID 1452 wrote to memory of 888 1452 rundll32.exe 27 PID 1452 wrote to memory of 888 1452 rundll32.exe 27 PID 1452 wrote to memory of 888 1452 rundll32.exe 27 PID 1452 wrote to memory of 888 1452 rundll32.exe 27 PID 888 wrote to memory of 976 888 rundll32.exe 28 PID 888 wrote to memory of 976 888 rundll32.exe 28 PID 888 wrote to memory of 976 888 rundll32.exe 28 PID 888 wrote to memory of 976 888 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\66bb0b650bfdf95d6000f97d4bbf0f25.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\66bb0b650bfdf95d6000f97d4bbf0f25.dll,#12⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:888 -
C:\WINDOWS\mssecsvr.exeC:\WINDOWS\mssecsvr.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:976
-
-
-
C:\WINDOWS\mssecsvr.exeC:\WINDOWS\mssecsvr.exe -m security1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2016
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\WINDOWS\mssecsvr.exe
- Size 2.2MB
- SHA256 8f05fd2aeb84d04a34fd94c9821d757cbbf40d9e81714e7dfe44975f3008caa0
- MD5 542240dbf341dc3828a89d33075e3f20
- SHA1 cf9cbb18cc2417020ee9fba99dce0fddc9e7ce5a
- SHA512 b3965e30664013be236aa9ca4728a183c1ddfc0a470271b5adb174b91d418c6d20a676cb2e331988e3e60c64a99d090d7d6e0bcf8a7c2453812ad82212071515
- SSDEEP 24576:QbLguripdmMSirYbcMNgef0QeQjGRdhAdmvn:QnvMSPbcBVQejRdhnvn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mssecsvr.exe
- Size 2.2MB
- SHA256 8f05fd2aeb84d04a34fd94c9821d757cbbf40d9e81714e7dfe44975f3008caa0
- MD5 542240dbf341dc3828a89d33075e3f20
- SHA1 cf9cbb18cc2417020ee9fba99dce0fddc9e7ce5a
- SHA512 b3965e30664013be236aa9ca4728a183c1ddfc0a470271b5adb174b91d418c6d20a676cb2e331988e3e60c64a99d090d7d6e0bcf8a7c2453812ad82212071515
- SSDEEP 24576:QbLguripdmMSirYbcMNgef0QeQjGRdhAdmvn:QnvMSPbcBVQejRdhnvn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mssecsvr.exe
- Size 2.2MB
- SHA256 8f05fd2aeb84d04a34fd94c9821d757cbbf40d9e81714e7dfe44975f3008caa0
- MD5 542240dbf341dc3828a89d33075e3f20
- SHA1 cf9cbb18cc2417020ee9fba99dce0fddc9e7ce5a
- SHA512 b3965e30664013be236aa9ca4728a183c1ddfc0a470271b5adb174b91d418c6d20a676cb2e331988e3e60c64a99d090d7d6e0bcf8a7c2453812ad82212071515
- SSDEEP 24576:QbLguripdmMSirYbcMNgef0QeQjGRdhAdmvn:QnvMSPbcBVQejRdhnvn
- MD5 SHA1 SHA512 SSDEEP