Analysis

  • max time kernel
    151s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-09-2022 03:55

General

  • Target

    0afb07f4dc3f28c640534c4282af4f467e0f25f271407b7deea06b6e8ec559a3.dll

  • Size

    5MB

  • MD5

    f019831d5f37a996e5f8f7338de3f50d

  • SHA1

    e52d9f459059e297a0802d4c99cabf9b8f9540ff

  • SHA256

    0afb07f4dc3f28c640534c4282af4f467e0f25f271407b7deea06b6e8ec559a3

  • SHA512

    cee576bd57d2dd20df722d19cb797db022e832f2ca281c499b473685a25f51586843ffd8ffef898f02e8ab8fbbc984cc913eca591670560594aaf9b2ad9f70db

  • SSDEEP

    49152:RnxQqMSPbcBVQej/1INRx+TSqTdX1HkQ9nK4JKAR:16qPoBhz1aRxcSUDk

Malware Config

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

  • Contacts a large (3130) amount of remote hosts ⋅ 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Executes dropped EXE ⋅ 2 IoCs
  • Creates a large amount of network flows ⋅ 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Drops file in Windows directory ⋅ 2 IoCs
  • Modifies data under HKEY_USERS ⋅ 12 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 6 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\0afb07f4dc3f28c640534c4282af4f467e0f25f271407b7deea06b6e8ec559a3.dll,#1
    Suspicious use of WriteProcessMemory
    PID:1944
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\0afb07f4dc3f28c640534c4282af4f467e0f25f271407b7deea06b6e8ec559a3.dll,#1
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:3112
      • C:\WINDOWS\mssecsvr.exe
        C:\WINDOWS\mssecsvr.exe
        Executes dropped EXE
        Drops file in Windows directory
        PID:4956
  • C:\WINDOWS\mssecsvr.exe
    C:\WINDOWS\mssecsvr.exe -m security
    Executes dropped EXE
    Modifies data under HKEY_USERS
    PID:4580

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

          Execution

            Exfiltration

              Impact

                Initial Access

                  Lateral Movement

                    Persistence

                      Privilege Escalation

                        Replay Monitor

                        00:00 00:00

                        Downloads

                        • C:\WINDOWS\mssecsvr.exe
                          MD5

                          76a488b08f2181c80d34bac0dded51b9

                          SHA1

                          2560b67b0ab4fb9030eb915359efe1e6eb369b8d

                          SHA256

                          73d6217e112c5c2eeff2d4f77a5567814f272a9524ea00ffb0895118883fb9c9

                          SHA512

                          10e7045fc566010e92fe5fbe25a096fbab5df848c9103bf6c2f5baaa9e10d678df5578297236dc8c6efee0a093af4486a6551e1d574daeb856e8e06cdcbb4a5d

                        • C:\Windows\mssecsvr.exe
                          MD5

                          76a488b08f2181c80d34bac0dded51b9

                          SHA1

                          2560b67b0ab4fb9030eb915359efe1e6eb369b8d

                          SHA256

                          73d6217e112c5c2eeff2d4f77a5567814f272a9524ea00ffb0895118883fb9c9

                          SHA512

                          10e7045fc566010e92fe5fbe25a096fbab5df848c9103bf6c2f5baaa9e10d678df5578297236dc8c6efee0a093af4486a6551e1d574daeb856e8e06cdcbb4a5d

                        • C:\Windows\mssecsvr.exe
                          MD5

                          76a488b08f2181c80d34bac0dded51b9

                          SHA1

                          2560b67b0ab4fb9030eb915359efe1e6eb369b8d

                          SHA256

                          73d6217e112c5c2eeff2d4f77a5567814f272a9524ea00ffb0895118883fb9c9

                          SHA512

                          10e7045fc566010e92fe5fbe25a096fbab5df848c9103bf6c2f5baaa9e10d678df5578297236dc8c6efee0a093af4486a6551e1d574daeb856e8e06cdcbb4a5d

                        • memory/3112-132-0x0000000000000000-mapping.dmp
                        • memory/4956-133-0x0000000000000000-mapping.dmp