Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
20/07/2022, 07:42
Static task
static1
Behavioral task
behavioral1
Sample
b9f7069adbd290e6d9ec6c97d9c98a53.dll
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
b9f7069adbd290e6d9ec6c97d9c98a53.dll
Resource
win10v2004-20220414-en
General
-
Target
b9f7069adbd290e6d9ec6c97d9c98a53.dll
-
Size
5.0MB
-
MD5
b9f7069adbd290e6d9ec6c97d9c98a53
-
SHA1
cc92098be427e8824f24d33f644e24f1332c1d8f
-
SHA256
5d52eec99f5bb3342372f1667b61cd0297db540a84c091c358696073ce1dcbaa
-
SHA512
946d812a115bb4fdc7198d5c7d5ca7569e3bf08f2bff13bc6acba80aca0672da62fad76b684750eca7766ba88c985ff5121dc3c65aa73962c33d6a5b61ec11b3
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (1258) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 3 IoCs
pid Process 2008 mssecsvr.exe 1308 mssecsvr.exe 320 tasksche.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvr.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\WINDOWS\mssecsvr.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvr.exe File created C:\Windows\__tmp_rar_sfx_access_check_7085050 tasksche.exe File created C:\Windows\eee.exe tasksche.exe -
Modifies data under HKEY_USERS 24 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00ee000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-34-70-84-18-6e\WpadDecisionTime = a0a3ba3d0c9cd801 mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-34-70-84-18-6e\WpadDecision = "0" mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E2FD4529-A260-44A9-A15B-DD656A88BF35}\WpadDecisionReason = "1" mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E2FD4529-A260-44A9-A15B-DD656A88BF35}\WpadDecisionTime = a0a3ba3d0c9cd801 mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-34-70-84-18-6e mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E2FD4529-A260-44A9-A15B-DD656A88BF35} mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E2FD4529-A260-44A9-A15B-DD656A88BF35}\WpadDecision = "0" mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E2FD4529-A260-44A9-A15B-DD656A88BF35}\WpadNetworkName = "Network 3" mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E2FD4529-A260-44A9-A15B-DD656A88BF35}\9a-34-70-84-18-6e mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-34-70-84-18-6e\WpadDecisionReason = "1" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mssecsvr.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1624 wrote to memory of 1836 1624 rundll32.exe 27 PID 1624 wrote to memory of 1836 1624 rundll32.exe 27 PID 1624 wrote to memory of 1836 1624 rundll32.exe 27 PID 1624 wrote to memory of 1836 1624 rundll32.exe 27 PID 1624 wrote to memory of 1836 1624 rundll32.exe 27 PID 1624 wrote to memory of 1836 1624 rundll32.exe 27 PID 1624 wrote to memory of 1836 1624 rundll32.exe 27 PID 1836 wrote to memory of 2008 1836 rundll32.exe 28 PID 1836 wrote to memory of 2008 1836 rundll32.exe 28 PID 1836 wrote to memory of 2008 1836 rundll32.exe 28 PID 1836 wrote to memory of 2008 1836 rundll32.exe 28 PID 2008 wrote to memory of 320 2008 mssecsvr.exe 31 PID 2008 wrote to memory of 320 2008 mssecsvr.exe 31 PID 2008 wrote to memory of 320 2008 mssecsvr.exe 31 PID 2008 wrote to memory of 320 2008 mssecsvr.exe 31 PID 2008 wrote to memory of 320 2008 mssecsvr.exe 31 PID 2008 wrote to memory of 320 2008 mssecsvr.exe 31 PID 2008 wrote to memory of 320 2008 mssecsvr.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b9f7069adbd290e6d9ec6c97d9c98a53.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b9f7069adbd290e6d9ec6c97d9c98a53.dll,#12⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\WINDOWS\mssecsvr.exeC:\WINDOWS\mssecsvr.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i4⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:320
-
-
-
-
C:\WINDOWS\mssecsvr.exeC:\WINDOWS\mssecsvr.exe -m security1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1308
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD536eaefe7bd29722caf93a2c35d43e26d
SHA183b3c33fa008122e5828d17c6546c8c732e97107
SHA2566c3dcf66abc7ab7c0c6bccb492ad4ab3604b88796e3db6d79d025c4cbcfc077d
SHA512a6db849ea99d2b4a3f04a0d0b9f9e8180404782624008e0049e3c7175ceeb29b2210d74e7430ee53f42968b3dd987241ed05672e1b7feeebe3aac56009ac5fae
-
Filesize
2.0MB
MD5821d10b8f06f9d2dc7acd5ad9fd6fb01
SHA1a94e5aef4d32e4b3d69c6c501905a9cf5c96b7a1
SHA256a94ceffc16534405e9961cf2ebe70c5a9164db45346d9ed0262c14a7853be36f
SHA512e2135b6aaa98c666207724697bd43b0bc8a34d1b25ecbad8e13db67988b0e4a00f3b489042f24cd24623cf31db5d564e0359110626409a82855e861dd2c060c1
-
Filesize
2.2MB
MD536eaefe7bd29722caf93a2c35d43e26d
SHA183b3c33fa008122e5828d17c6546c8c732e97107
SHA2566c3dcf66abc7ab7c0c6bccb492ad4ab3604b88796e3db6d79d025c4cbcfc077d
SHA512a6db849ea99d2b4a3f04a0d0b9f9e8180404782624008e0049e3c7175ceeb29b2210d74e7430ee53f42968b3dd987241ed05672e1b7feeebe3aac56009ac5fae
-
Filesize
2.2MB
MD536eaefe7bd29722caf93a2c35d43e26d
SHA183b3c33fa008122e5828d17c6546c8c732e97107
SHA2566c3dcf66abc7ab7c0c6bccb492ad4ab3604b88796e3db6d79d025c4cbcfc077d
SHA512a6db849ea99d2b4a3f04a0d0b9f9e8180404782624008e0049e3c7175ceeb29b2210d74e7430ee53f42968b3dd987241ed05672e1b7feeebe3aac56009ac5fae
-
Filesize
2.0MB
MD5821d10b8f06f9d2dc7acd5ad9fd6fb01
SHA1a94e5aef4d32e4b3d69c6c501905a9cf5c96b7a1
SHA256a94ceffc16534405e9961cf2ebe70c5a9164db45346d9ed0262c14a7853be36f
SHA512e2135b6aaa98c666207724697bd43b0bc8a34d1b25ecbad8e13db67988b0e4a00f3b489042f24cd24623cf31db5d564e0359110626409a82855e861dd2c060c1