Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
20/07/2022, 07:37
Static task
static1
Behavioral task
behavioral1
Sample
d30aa7aad0beb177a00f6af0946239b6.dll
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
d30aa7aad0beb177a00f6af0946239b6.dll
Resource
win10v2004-20220414-en
General
-
Target
d30aa7aad0beb177a00f6af0946239b6.dll
-
Size
5.0MB
-
MD5
d30aa7aad0beb177a00f6af0946239b6
-
SHA1
3ad164445af28132cb660566e69b0fbf90f72855
-
SHA256
f6969106a17b8a55207264c2f32131870cb5c83cef4182eea9a6e3f4e7af49f8
-
SHA512
bbb1fb3316f224655d88e85a05831132296a8214567c32ed58d8d8f4f828bc57b8b0eed45296835e683a33d3b90ab249b00c1e02c749b2cd4ea7b17f1e74d8c0
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (1249) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 2 IoCs
pid Process 768 mssecsvr.exe 1684 mssecsvr.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvr.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\WINDOWS\mssecsvr.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvr.exe -
Modifies data under HKEY_USERS 24 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b2-0a-de-bd-86-5e\WpadDecisionReason = "1" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00c7000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{8FEDC65B-D4CA-4096-B940-AF1249F83A0D} mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{8FEDC65B-D4CA-4096-B940-AF1249F83A0D}\WpadDecisionTime = 7038b34d1c9cd801 mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{8FEDC65B-D4CA-4096-B940-AF1249F83A0D}\WpadDecision = "0" mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{8FEDC65B-D4CA-4096-B940-AF1249F83A0D}\WpadNetworkName = "Network 3" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b2-0a-de-bd-86-5e\WpadDecisionTime = 7038b34d1c9cd801 mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b2-0a-de-bd-86-5e\WpadDecision = "0" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{8FEDC65B-D4CA-4096-B940-AF1249F83A0D}\b2-0a-de-bd-86-5e mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{8FEDC65B-D4CA-4096-B940-AF1249F83A0D}\WpadDecisionReason = "1" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b2-0a-de-bd-86-5e mssecsvr.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1488 wrote to memory of 1828 1488 rundll32.exe 28 PID 1488 wrote to memory of 1828 1488 rundll32.exe 28 PID 1488 wrote to memory of 1828 1488 rundll32.exe 28 PID 1488 wrote to memory of 1828 1488 rundll32.exe 28 PID 1488 wrote to memory of 1828 1488 rundll32.exe 28 PID 1488 wrote to memory of 1828 1488 rundll32.exe 28 PID 1488 wrote to memory of 1828 1488 rundll32.exe 28 PID 1828 wrote to memory of 768 1828 rundll32.exe 29 PID 1828 wrote to memory of 768 1828 rundll32.exe 29 PID 1828 wrote to memory of 768 1828 rundll32.exe 29 PID 1828 wrote to memory of 768 1828 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d30aa7aad0beb177a00f6af0946239b6.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d30aa7aad0beb177a00f6af0946239b6.dll,#12⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\WINDOWS\mssecsvr.exeC:\WINDOWS\mssecsvr.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:768
-
-
-
C:\WINDOWS\mssecsvr.exeC:\WINDOWS\mssecsvr.exe -m security1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1684
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD5ab99254eb8ac5e75e056dade7d45966b
SHA10f6e413774e815b4cfe0fe03a975f6e52d250864
SHA2560a6da0d644dc2e343c418abe052490abc54ea8ae8ed41db6e0842677425faab4
SHA51232672194e66876dee6a3c269e4f7eb637bf0694069db432a88f631180d7da99725299bb9785ccc7c776f937ccdff644cd8525a5da0a6305d3d3f735868aa99e9
-
Filesize
2.2MB
MD5ab99254eb8ac5e75e056dade7d45966b
SHA10f6e413774e815b4cfe0fe03a975f6e52d250864
SHA2560a6da0d644dc2e343c418abe052490abc54ea8ae8ed41db6e0842677425faab4
SHA51232672194e66876dee6a3c269e4f7eb637bf0694069db432a88f631180d7da99725299bb9785ccc7c776f937ccdff644cd8525a5da0a6305d3d3f735868aa99e9
-
Filesize
2.2MB
MD5ab99254eb8ac5e75e056dade7d45966b
SHA10f6e413774e815b4cfe0fe03a975f6e52d250864
SHA2560a6da0d644dc2e343c418abe052490abc54ea8ae8ed41db6e0842677425faab4
SHA51232672194e66876dee6a3c269e4f7eb637bf0694069db432a88f631180d7da99725299bb9785ccc7c776f937ccdff644cd8525a5da0a6305d3d3f735868aa99e9