Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220718-en -
resource tags
arch:x64arch:x86image:win10v2004-20220718-enlocale:en-usos:windows10-2004-x64system -
submitted
20/07/2022, 07:47
Static task
static1
Behavioral task
behavioral1
Sample
45ad974baceeff788483166a7786bb63.dll
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
45ad974baceeff788483166a7786bb63.dll
Resource
win10v2004-20220718-en
General
-
Target
45ad974baceeff788483166a7786bb63.dll
-
Size
5.0MB
-
MD5
45ad974baceeff788483166a7786bb63
-
SHA1
fa664f3f1be66e634ab107f13a8027063118588e
-
SHA256
92cd8b9b69c8bcdae1140fcee116f5d3243dd52a512462dd8309e3637fae60d5
-
SHA512
0ab5b04383871904531a4359db24cf324212a37503d8815e8fad68f9f667208ac19bca505a03872737dd427ce3ab29ba30c16f0169b82387d1c485d3ba58be28
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (3237) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 2 IoCs
pid Process 4124 mssecsvr.exe 3076 mssecsvr.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\WINDOWS\tasksche.exe mssecsvr.exe File created C:\WINDOWS\mssecsvr.exe rundll32.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" mssecsvr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3432 wrote to memory of 3304 3432 rundll32.exe 75 PID 3432 wrote to memory of 3304 3432 rundll32.exe 75 PID 3432 wrote to memory of 3304 3432 rundll32.exe 75 PID 3304 wrote to memory of 4124 3304 rundll32.exe 76 PID 3304 wrote to memory of 4124 3304 rundll32.exe 76 PID 3304 wrote to memory of 4124 3304 rundll32.exe 76
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\45ad974baceeff788483166a7786bb63.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\45ad974baceeff788483166a7786bb63.dll,#12⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\WINDOWS\mssecsvr.exeC:\WINDOWS\mssecsvr.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4124
-
-
-
C:\WINDOWS\mssecsvr.exeC:\WINDOWS\mssecsvr.exe -m security1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:3076
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD56190b771d948ffe8e7b21af9a89892ad
SHA1793a19f58eaba2498860346b92c48d18bed121c4
SHA2564656c612d3dc4150b30120fe5db240a450d608ebb700db05b21c8961f1e8b1a2
SHA5127e9180fbf9319e6e1d965ff77ab9486d6095ec694ef5b3ef6f3aca3b210bbbe9d4c9a026ff9dd4b95beafad44e08b55803f15b3854d36d5e8e28cccc72cc0c07
-
Filesize
2.2MB
MD56190b771d948ffe8e7b21af9a89892ad
SHA1793a19f58eaba2498860346b92c48d18bed121c4
SHA2564656c612d3dc4150b30120fe5db240a450d608ebb700db05b21c8961f1e8b1a2
SHA5127e9180fbf9319e6e1d965ff77ab9486d6095ec694ef5b3ef6f3aca3b210bbbe9d4c9a026ff9dd4b95beafad44e08b55803f15b3854d36d5e8e28cccc72cc0c07
-
Filesize
2.2MB
MD56190b771d948ffe8e7b21af9a89892ad
SHA1793a19f58eaba2498860346b92c48d18bed121c4
SHA2564656c612d3dc4150b30120fe5db240a450d608ebb700db05b21c8961f1e8b1a2
SHA5127e9180fbf9319e6e1d965ff77ab9486d6095ec694ef5b3ef6f3aca3b210bbbe9d4c9a026ff9dd4b95beafad44e08b55803f15b3854d36d5e8e28cccc72cc0c07