Analysis
- max time kernel
188s - max time network
192s - platform
windows7_x64 - resource
win7-20220718-en - resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system - submitted
20/07/2022, 18:40
Static task
static1
Behavioral task
behavioral1
Sample
4e1f21bf9d382859153737f285904f460ae217b8ed742099eec4b17f3f30160d.dll
Resource
win7-20220718-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
4e1f21bf9d382859153737f285904f460ae217b8ed742099eec4b17f3f30160d.dll
Resource
win10v2004-20220718-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 4e1f21bf9d382859153737f285904f460ae217b8ed742099eec4b17f3f30160d.dll
- Size 5.0MB
- Sample220720-xa54aaffbq
- SHA256 4e1f21bf9d382859153737f285904f460ae217b8ed742099eec4b17f3f30160d
- MD5 d7008fdb210e2d9797ccba04dcc1dbd1
- SHA1 1487fe5dc2f86438c3fe498ad394b1767f751390
- SHA512 b97f06f283ebcf8febc51c9dff0f40003eca847e943da1d1b8ec781792b04827ea215bbaba930b9c97f8dadb0b8a5f280247b1db583e929049ba1a895993de59
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Wannacry
WannaCry is a ransomware cryptoworm.
- Contacts a large (1206) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Executes dropped EXE 2 IoCs
pid Process 1740 mssecsvc.exe 1232 mssecsvc.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvc.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\WINDOWS\mssecsvc.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvc.exe - Modifies data under HKEY_USERS 24 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C112EFA5-63F1-43EE-A79A-2022C3D11AD5}\WpadDecisionReason = "1" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C112EFA5-63F1-43EE-A79A-2022C3D11AD5}\WpadDecisionTime = d0354bc9919cd801 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C112EFA5-63F1-43EE-A79A-2022C3D11AD5}\96-84-54-89-97-15 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\96-84-54-89-97-15 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C112EFA5-63F1-43EE-A79A-2022C3D11AD5}\WpadNetworkName = "Network 3" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\96-84-54-89-97-15\WpadDecisionReason = "1" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\96-84-54-89-97-15\WpadDecision = "0" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00be000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C112EFA5-63F1-43EE-A79A-2022C3D11AD5} mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C112EFA5-63F1-43EE-A79A-2022C3D11AD5}\WpadDecision = "0" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\96-84-54-89-97-15\WpadDecisionTime = d0354bc9919cd801 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mssecsvc.exe - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1428 wrote to memory of 1456 1428 rundll32.exe 28 PID 1428 wrote to memory of 1456 1428 rundll32.exe 28 PID 1428 wrote to memory of 1456 1428 rundll32.exe 28 PID 1428 wrote to memory of 1456 1428 rundll32.exe 28 PID 1428 wrote to memory of 1456 1428 rundll32.exe 28 PID 1428 wrote to memory of 1456 1428 rundll32.exe 28 PID 1428 wrote to memory of 1456 1428 rundll32.exe 28 PID 1456 wrote to memory of 1740 1456 rundll32.exe 29 PID 1456 wrote to memory of 1740 1456 rundll32.exe 29 PID 1456 wrote to memory of 1740 1456 rundll32.exe 29 PID 1456 wrote to memory of 1740 1456 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4e1f21bf9d382859153737f285904f460ae217b8ed742099eec4b17f3f30160d.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4e1f21bf9d382859153737f285904f460ae217b8ed742099eec4b17f3f30160d.dll,#12⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1740
-
-
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1232
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\WINDOWS\mssecsvc.exe
- Size 3.6MB
- SHA256 aa54cd6abff938c497076f443381f5e33cf3a6df6b46d42b1a5edc5348bd7a31
- MD5 aa875c296e6d67affd0324279f539be4
- SHA1 f3501a0a91ab2b353ffd85b3a34315231ff423cb
- SHA512 4a5ecdace119d94dc1ceb56261066638c413f5011d7ca5e0aa61b7e15ff4cbfb6c96b3be97bd8f0e9592407e5323b940f3b4947904507950e8353d98110f3c51
- SSDEEP 49152:XnsQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAA:X/qPoBhz1aRxcSUDk36SA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mssecsvc.exe
- Size 3.6MB
- SHA256 aa54cd6abff938c497076f443381f5e33cf3a6df6b46d42b1a5edc5348bd7a31
- MD5 aa875c296e6d67affd0324279f539be4
- SHA1 f3501a0a91ab2b353ffd85b3a34315231ff423cb
- SHA512 4a5ecdace119d94dc1ceb56261066638c413f5011d7ca5e0aa61b7e15ff4cbfb6c96b3be97bd8f0e9592407e5323b940f3b4947904507950e8353d98110f3c51
- SSDEEP 49152:XnsQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAA:X/qPoBhz1aRxcSUDk36SA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mssecsvc.exe
- Size 3.6MB
- SHA256 aa54cd6abff938c497076f443381f5e33cf3a6df6b46d42b1a5edc5348bd7a31
- MD5 aa875c296e6d67affd0324279f539be4
- SHA1 f3501a0a91ab2b353ffd85b3a34315231ff423cb
- SHA512 4a5ecdace119d94dc1ceb56261066638c413f5011d7ca5e0aa61b7e15ff4cbfb6c96b3be97bd8f0e9592407e5323b940f3b4947904507950e8353d98110f3c51
- SSDEEP 49152:XnsQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAA:X/qPoBhz1aRxcSUDk36SA
- MD5 SHA1 SHA512 SSDEEP