Analysis

  • max time kernel
    151s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20220718-en
  • resource tags

    arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
  • submitted
    20/07/2022, 07:47

General

  • Target

    45ad974baceeff788483166a7786bb63.dll

  • Size

    5.0MB

  • MD5

    45ad974baceeff788483166a7786bb63

  • SHA1

    fa664f3f1be66e634ab107f13a8027063118588e

  • SHA256

    92cd8b9b69c8bcdae1140fcee116f5d3243dd52a512462dd8309e3637fae60d5

  • SHA512

    0ab5b04383871904531a4359db24cf324212a37503d8815e8fad68f9f667208ac19bca505a03872737dd427ce3ab29ba30c16f0169b82387d1c485d3ba58be28

Malware Config

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

  • Contacts a large (1279) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies data under HKEY_USERS 24 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\45ad974baceeff788483166a7786bb63.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1936
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\45ad974baceeff788483166a7786bb63.dll,#1
      2⤵
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:1780
      • C:\WINDOWS\mssecsvr.exe
        C:\WINDOWS\mssecsvr.exe
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        PID:1632
  • C:\WINDOWS\mssecsvr.exe
    C:\WINDOWS\mssecsvr.exe -m security
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Modifies data under HKEY_USERS
    PID:2036

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\WINDOWS\mssecsvr.exe

          Filesize

          2.2MB

          MD5

          6190b771d948ffe8e7b21af9a89892ad

          SHA1

          793a19f58eaba2498860346b92c48d18bed121c4

          SHA256

          4656c612d3dc4150b30120fe5db240a450d608ebb700db05b21c8961f1e8b1a2

          SHA512

          7e9180fbf9319e6e1d965ff77ab9486d6095ec694ef5b3ef6f3aca3b210bbbe9d4c9a026ff9dd4b95beafad44e08b55803f15b3854d36d5e8e28cccc72cc0c07

        • C:\Windows\mssecsvr.exe

          Filesize

          2.2MB

          MD5

          6190b771d948ffe8e7b21af9a89892ad

          SHA1

          793a19f58eaba2498860346b92c48d18bed121c4

          SHA256

          4656c612d3dc4150b30120fe5db240a450d608ebb700db05b21c8961f1e8b1a2

          SHA512

          7e9180fbf9319e6e1d965ff77ab9486d6095ec694ef5b3ef6f3aca3b210bbbe9d4c9a026ff9dd4b95beafad44e08b55803f15b3854d36d5e8e28cccc72cc0c07

        • C:\Windows\mssecsvr.exe

          Filesize

          2.2MB

          MD5

          6190b771d948ffe8e7b21af9a89892ad

          SHA1

          793a19f58eaba2498860346b92c48d18bed121c4

          SHA256

          4656c612d3dc4150b30120fe5db240a450d608ebb700db05b21c8961f1e8b1a2

          SHA512

          7e9180fbf9319e6e1d965ff77ab9486d6095ec694ef5b3ef6f3aca3b210bbbe9d4c9a026ff9dd4b95beafad44e08b55803f15b3854d36d5e8e28cccc72cc0c07

        • memory/1780-55-0x00000000760F1000-0x00000000760F3000-memory.dmp

          Filesize

          8KB