Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220718-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220718-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/07/2022, 07:47

General

  • Target

    45ad974baceeff788483166a7786bb63.dll

  • Size

    5.0MB

  • MD5

    45ad974baceeff788483166a7786bb63

  • SHA1

    fa664f3f1be66e634ab107f13a8027063118588e

  • SHA256

    92cd8b9b69c8bcdae1140fcee116f5d3243dd52a512462dd8309e3637fae60d5

  • SHA512

    0ab5b04383871904531a4359db24cf324212a37503d8815e8fad68f9f667208ac19bca505a03872737dd427ce3ab29ba30c16f0169b82387d1c485d3ba58be28

Malware Config

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

  • Contacts a large (3237) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Executes dropped EXE 2 IoCs
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Drops file in Windows directory 2 IoCs
  • Modifies data under HKEY_USERS 5 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\45ad974baceeff788483166a7786bb63.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3432
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\45ad974baceeff788483166a7786bb63.dll,#1
      2⤵
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:3304
      • C:\WINDOWS\mssecsvr.exe
        C:\WINDOWS\mssecsvr.exe
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        PID:4124
  • C:\WINDOWS\mssecsvr.exe
    C:\WINDOWS\mssecsvr.exe -m security
    1⤵
    • Executes dropped EXE
    • Modifies data under HKEY_USERS
    PID:3076

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\WINDOWS\mssecsvr.exe

          Filesize

          2.2MB

          MD5

          6190b771d948ffe8e7b21af9a89892ad

          SHA1

          793a19f58eaba2498860346b92c48d18bed121c4

          SHA256

          4656c612d3dc4150b30120fe5db240a450d608ebb700db05b21c8961f1e8b1a2

          SHA512

          7e9180fbf9319e6e1d965ff77ab9486d6095ec694ef5b3ef6f3aca3b210bbbe9d4c9a026ff9dd4b95beafad44e08b55803f15b3854d36d5e8e28cccc72cc0c07

        • C:\Windows\mssecsvr.exe

          Filesize

          2.2MB

          MD5

          6190b771d948ffe8e7b21af9a89892ad

          SHA1

          793a19f58eaba2498860346b92c48d18bed121c4

          SHA256

          4656c612d3dc4150b30120fe5db240a450d608ebb700db05b21c8961f1e8b1a2

          SHA512

          7e9180fbf9319e6e1d965ff77ab9486d6095ec694ef5b3ef6f3aca3b210bbbe9d4c9a026ff9dd4b95beafad44e08b55803f15b3854d36d5e8e28cccc72cc0c07

        • C:\Windows\mssecsvr.exe

          Filesize

          2.2MB

          MD5

          6190b771d948ffe8e7b21af9a89892ad

          SHA1

          793a19f58eaba2498860346b92c48d18bed121c4

          SHA256

          4656c612d3dc4150b30120fe5db240a450d608ebb700db05b21c8961f1e8b1a2

          SHA512

          7e9180fbf9319e6e1d965ff77ab9486d6095ec694ef5b3ef6f3aca3b210bbbe9d4c9a026ff9dd4b95beafad44e08b55803f15b3854d36d5e8e28cccc72cc0c07