Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
20/07/2022, 07:47
Static task
static1
Behavioral task
behavioral1
Sample
45ad974baceeff788483166a7786bb63.dll
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
45ad974baceeff788483166a7786bb63.dll
Resource
win10v2004-20220718-en
General
-
Target
45ad974baceeff788483166a7786bb63.dll
-
Size
5.0MB
-
MD5
45ad974baceeff788483166a7786bb63
-
SHA1
fa664f3f1be66e634ab107f13a8027063118588e
-
SHA256
92cd8b9b69c8bcdae1140fcee116f5d3243dd52a512462dd8309e3637fae60d5
-
SHA512
0ab5b04383871904531a4359db24cf324212a37503d8815e8fad68f9f667208ac19bca505a03872737dd427ce3ab29ba30c16f0169b82387d1c485d3ba58be28
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (1279) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 2 IoCs
pid Process 1632 mssecsvr.exe 2036 mssecsvr.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvr.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\WINDOWS\mssecsvr.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvr.exe -
Modifies data under HKEY_USERS 24 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-15-89-e4-62-9b\WpadDecisionReason = "1" mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6204A69B-0179-4F4F-BEF1-B23CB1064584} mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6204A69B-0179-4F4F-BEF1-B23CB1064584}\WpadDecisionReason = "1" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6204A69B-0179-4F4F-BEF1-B23CB1064584}\72-15-89-e4-62-9b mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-15-89-e4-62-9b mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-15-89-e4-62-9b\WpadDecisionTime = 7084b9b31d9cd801 mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6204A69B-0179-4F4F-BEF1-B23CB1064584}\WpadDecisionTime = 7084b9b31d9cd801 mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6204A69B-0179-4F4F-BEF1-B23CB1064584}\WpadNetworkName = "Network 3" mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00c3000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6204A69B-0179-4F4F-BEF1-B23CB1064584}\WpadDecision = "0" mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-15-89-e4-62-9b\WpadDecision = "0" mssecsvr.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1936 wrote to memory of 1780 1936 rundll32.exe 28 PID 1936 wrote to memory of 1780 1936 rundll32.exe 28 PID 1936 wrote to memory of 1780 1936 rundll32.exe 28 PID 1936 wrote to memory of 1780 1936 rundll32.exe 28 PID 1936 wrote to memory of 1780 1936 rundll32.exe 28 PID 1936 wrote to memory of 1780 1936 rundll32.exe 28 PID 1936 wrote to memory of 1780 1936 rundll32.exe 28 PID 1780 wrote to memory of 1632 1780 rundll32.exe 29 PID 1780 wrote to memory of 1632 1780 rundll32.exe 29 PID 1780 wrote to memory of 1632 1780 rundll32.exe 29 PID 1780 wrote to memory of 1632 1780 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\45ad974baceeff788483166a7786bb63.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\45ad974baceeff788483166a7786bb63.dll,#12⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\WINDOWS\mssecsvr.exeC:\WINDOWS\mssecsvr.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1632
-
-
-
C:\WINDOWS\mssecsvr.exeC:\WINDOWS\mssecsvr.exe -m security1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2036
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD56190b771d948ffe8e7b21af9a89892ad
SHA1793a19f58eaba2498860346b92c48d18bed121c4
SHA2564656c612d3dc4150b30120fe5db240a450d608ebb700db05b21c8961f1e8b1a2
SHA5127e9180fbf9319e6e1d965ff77ab9486d6095ec694ef5b3ef6f3aca3b210bbbe9d4c9a026ff9dd4b95beafad44e08b55803f15b3854d36d5e8e28cccc72cc0c07
-
Filesize
2.2MB
MD56190b771d948ffe8e7b21af9a89892ad
SHA1793a19f58eaba2498860346b92c48d18bed121c4
SHA2564656c612d3dc4150b30120fe5db240a450d608ebb700db05b21c8961f1e8b1a2
SHA5127e9180fbf9319e6e1d965ff77ab9486d6095ec694ef5b3ef6f3aca3b210bbbe9d4c9a026ff9dd4b95beafad44e08b55803f15b3854d36d5e8e28cccc72cc0c07
-
Filesize
2.2MB
MD56190b771d948ffe8e7b21af9a89892ad
SHA1793a19f58eaba2498860346b92c48d18bed121c4
SHA2564656c612d3dc4150b30120fe5db240a450d608ebb700db05b21c8961f1e8b1a2
SHA5127e9180fbf9319e6e1d965ff77ab9486d6095ec694ef5b3ef6f3aca3b210bbbe9d4c9a026ff9dd4b95beafad44e08b55803f15b3854d36d5e8e28cccc72cc0c07