Analysis
- max time kernel
150s - max time network
154s - platform
windows7_x64 - resource
win7-20220901-en - resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system - submitted
22/12/2022, 09:03
Static task
static1
Behavioral task
behavioral1
Sample
98df58e71b5202e49ba6f9e6e43ef6ef.dll
Resource
win7-20220901-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
98df58e71b5202e49ba6f9e6e43ef6ef.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 98df58e71b5202e49ba6f9e6e43ef6ef.dll
- Size 5.0MB
- Sample221222-kz15eaeb82
- SHA256 b5d543c8a8334519f013bb236d43d0561088b52b0d5602ea9b58fc453f2c4156
- MD5 98df58e71b5202e49ba6f9e6e43ef6ef
- SHA1 7ee6e1082c30108ae631c6193878195c1abe7112
- SHA512 1eba0f2e6f38cf4b53c84926396a0a18f0e524bbea3fc2fcd9326c43a001ae9bfb80556ce07c489dae09b8e4830c89276589cb208f23a5aa78776a01c692520b
- SSDEEP 49152:RnpENbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnv:1p+oBhz1aRxcSUDk36SAEdhv
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Wannacry
WannaCry is a ransomware cryptoworm.
- Executes dropped EXE 3 IoCs
pid Process 1108 mssecsvr.exe 1896 mssecsvr.exe 632 tasksche.exe - Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\72CLLV0D.txt mssecsvr.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvr.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\72CLLV0D.txt mssecsvr.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\__tmp_rar_sfx_access_check_7087640 tasksche.exe File created C:\Windows\eee.exe tasksche.exe File created C:\WINDOWS\mssecsvr.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvr.exe - Modifies data under HKEY_USERS 24 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5AC7D188-5E1B-45B5-8B9E-4E1BECD6D9A8}\WpadDecisionReason = "1" mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5AC7D188-5E1B-45B5-8B9E-4E1BECD6D9A8}\WpadDecision = "0" mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\6a-9b-22-b4-3b-a7\WpadDecisionTime = 403ef93ae415d901 mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\6a-9b-22-b4-3b-a7\WpadDecision = "0" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5AC7D188-5E1B-45B5-8B9E-4E1BECD6D9A8} mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5AC7D188-5E1B-45B5-8B9E-4E1BECD6D9A8}\WpadNetworkName = "Network" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\6a-9b-22-b4-3b-a7 mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5AC7D188-5E1B-45B5-8B9E-4E1BECD6D9A8}\6a-9b-22-b4-3b-a7 mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5AC7D188-5E1B-45B5-8B9E-4E1BECD6D9A8}\WpadDecisionTime = 403ef93ae415d901 mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\6a-9b-22-b4-3b-a7\WpadDecisionReason = "1" mssecsvr.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1324 wrote to memory of 1808 1324 rundll32.exe 27 PID 1324 wrote to memory of 1808 1324 rundll32.exe 27 PID 1324 wrote to memory of 1808 1324 rundll32.exe 27 PID 1324 wrote to memory of 1808 1324 rundll32.exe 27 PID 1324 wrote to memory of 1808 1324 rundll32.exe 27 PID 1324 wrote to memory of 1808 1324 rundll32.exe 27 PID 1324 wrote to memory of 1808 1324 rundll32.exe 27 PID 1808 wrote to memory of 1108 1808 rundll32.exe 28 PID 1808 wrote to memory of 1108 1808 rundll32.exe 28 PID 1808 wrote to memory of 1108 1808 rundll32.exe 28 PID 1808 wrote to memory of 1108 1808 rundll32.exe 28 PID 1108 wrote to memory of 632 1108 mssecsvr.exe 31 PID 1108 wrote to memory of 632 1108 mssecsvr.exe 31 PID 1108 wrote to memory of 632 1108 mssecsvr.exe 31 PID 1108 wrote to memory of 632 1108 mssecsvr.exe 31 PID 1108 wrote to memory of 632 1108 mssecsvr.exe 31 PID 1108 wrote to memory of 632 1108 mssecsvr.exe 31 PID 1108 wrote to memory of 632 1108 mssecsvr.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\98df58e71b5202e49ba6f9e6e43ef6ef.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\98df58e71b5202e49ba6f9e6e43ef6ef.dll,#12⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\WINDOWS\mssecsvr.exeC:\WINDOWS\mssecsvr.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i4⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:632
-
-
-
-
C:\WINDOWS\mssecsvr.exeC:\WINDOWS\mssecsvr.exe -m security1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1896
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\WINDOWS\mssecsvr.exe
- Size 2.2MB
- SHA256 528ea2825f49b83a9d2774233e46ce145f09c1c2daf1cb0fa251d406c38bc851
- MD5 06f05fa7206b546118253c33d60541dc
- SHA1 b27f9dc8394423c38591367a87827b5e51d31719
- SHA512 df5e762182346f090ca912c8a5149ad08c47addd57bf453a0b88b052d1deeb0024efc1af680c6e8b024c24a3d2a1dc8e375eebc3aa16e4b87346d5de2c0a87d3
- SSDEEP 49152:QnpENbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvn:Qp+oBhz1aRxcSUDk36SAEdhvn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\WINDOWS\tasksche.exe
- Size 2.0MB
- SHA256 486a1da92d0a86066de7714104451c10051432c6eb357b7cd04125b685f43f63
- MD5 06773c385b9f9a55b70067ed1d5739de
- SHA1 3e65f2c71708e103e7036a2f877ebcc88063c67b
- SHA512 ae728eb69c5da7208a240e50d99ffbde0282ebf8291d130e3417357074dc1efa3c397e9f4ae2e7b20ff05fa9e7353cfc76167234fcc21a223a34b30701acc075
- SSDEEP 49152:XENbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvm:X+oBhz1aRxcSUDk36SAEdhvm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mssecsvr.exe
- Size 2.2MB
- SHA256 528ea2825f49b83a9d2774233e46ce145f09c1c2daf1cb0fa251d406c38bc851
- MD5 06f05fa7206b546118253c33d60541dc
- SHA1 b27f9dc8394423c38591367a87827b5e51d31719
- SHA512 df5e762182346f090ca912c8a5149ad08c47addd57bf453a0b88b052d1deeb0024efc1af680c6e8b024c24a3d2a1dc8e375eebc3aa16e4b87346d5de2c0a87d3
- SSDEEP 49152:QnpENbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvn:Qp+oBhz1aRxcSUDk36SAEdhvn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mssecsvr.exe
- Size 2.2MB
- SHA256 528ea2825f49b83a9d2774233e46ce145f09c1c2daf1cb0fa251d406c38bc851
- MD5 06f05fa7206b546118253c33d60541dc
- SHA1 b27f9dc8394423c38591367a87827b5e51d31719
- SHA512 df5e762182346f090ca912c8a5149ad08c47addd57bf453a0b88b052d1deeb0024efc1af680c6e8b024c24a3d2a1dc8e375eebc3aa16e4b87346d5de2c0a87d3
- SSDEEP 49152:QnpENbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvn:Qp+oBhz1aRxcSUDk36SAEdhvn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\tasksche.exe
- Size 2.0MB
- SHA256 486a1da92d0a86066de7714104451c10051432c6eb357b7cd04125b685f43f63
- MD5 06773c385b9f9a55b70067ed1d5739de
- SHA1 3e65f2c71708e103e7036a2f877ebcc88063c67b
- SHA512 ae728eb69c5da7208a240e50d99ffbde0282ebf8291d130e3417357074dc1efa3c397e9f4ae2e7b20ff05fa9e7353cfc76167234fcc21a223a34b30701acc075
- SSDEEP 49152:XENbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvm:X+oBhz1aRxcSUDk36SAEdhvm
- MD5 SHA1 SHA512 SSDEEP