Analysis

  • max time kernel
    151s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-09-2022 03:53

General

  • Target

    0b332e6ac79094a04d9825f86c9a663e53e936fd835edcef1e29b422132f6590.dll

  • Size

    5MB

  • MD5

    008b9895ed29a02b2ad9c15d10fe250c

  • SHA1

    6dba81733aa199fd64dcfbb17e43d1a575a02086

  • SHA256

    0b332e6ac79094a04d9825f86c9a663e53e936fd835edcef1e29b422132f6590

  • SHA512

    3deeeaa92cb98ce7fcca23a30fe08834c10af7e13b7ab8cbdceaa23408798a9dbf94cd4e3eecc25123abd93fbad8759a3c772d30bcffb34b1cb48ac39f8e0aea

  • SSDEEP

    24576:RbLgurgDdmMSirYbcMNgef0jjG/D8k0k+RdhA:RnsEMSPbcBVu/oRdh

Malware Config

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

  • Contacts a large (3031) amount of remote hosts ⋅ 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Executes dropped EXE ⋅ 2 IoCs
  • Creates a large amount of network flows ⋅ 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Drops file in Windows directory ⋅ 2 IoCs
  • Modifies data under HKEY_USERS ⋅ 12 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 6 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\0b332e6ac79094a04d9825f86c9a663e53e936fd835edcef1e29b422132f6590.dll,#1
    Suspicious use of WriteProcessMemory
    PID:2180
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\0b332e6ac79094a04d9825f86c9a663e53e936fd835edcef1e29b422132f6590.dll,#1
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:2232
      • C:\WINDOWS\mssecsvr.exe
        C:\WINDOWS\mssecsvr.exe
        Executes dropped EXE
        Drops file in Windows directory
        PID:4696
  • C:\WINDOWS\mssecsvr.exe
    C:\WINDOWS\mssecsvr.exe -m security
    Executes dropped EXE
    Modifies data under HKEY_USERS
    PID:920

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

          Execution

            Exfiltration

              Impact

                Initial Access

                  Lateral Movement

                    Persistence

                      Privilege Escalation

                        Replay Monitor

                        00:00 00:00

                        Downloads

                        • C:\WINDOWS\mssecsvr.exe
                          MD5

                          476e46074243409cd11eb699a1e87238

                          SHA1

                          462087544ff91ef506079a684419b8d5748462fd

                          SHA256

                          23534cc1894091377e8ee9e7864bd1dd58e5ecefe0cd3f305a1e06de4fdb512c

                          SHA512

                          c87985972ef8f399a4b19e7ce55833e4b0256b3af8a14b0f118be6fde1118de22728f4a2fe15eca816afc1fe244f473c87a49bdb33ee076a11dc9fa87e471194

                        • C:\Windows\mssecsvr.exe
                          MD5

                          476e46074243409cd11eb699a1e87238

                          SHA1

                          462087544ff91ef506079a684419b8d5748462fd

                          SHA256

                          23534cc1894091377e8ee9e7864bd1dd58e5ecefe0cd3f305a1e06de4fdb512c

                          SHA512

                          c87985972ef8f399a4b19e7ce55833e4b0256b3af8a14b0f118be6fde1118de22728f4a2fe15eca816afc1fe244f473c87a49bdb33ee076a11dc9fa87e471194

                        • C:\Windows\mssecsvr.exe
                          MD5

                          476e46074243409cd11eb699a1e87238

                          SHA1

                          462087544ff91ef506079a684419b8d5748462fd

                          SHA256

                          23534cc1894091377e8ee9e7864bd1dd58e5ecefe0cd3f305a1e06de4fdb512c

                          SHA512

                          c87985972ef8f399a4b19e7ce55833e4b0256b3af8a14b0f118be6fde1118de22728f4a2fe15eca816afc1fe244f473c87a49bdb33ee076a11dc9fa87e471194

                        • memory/2232-132-0x0000000000000000-mapping.dmp
                        • memory/4696-133-0x0000000000000000-mapping.dmp