Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
24-03-2024 14:22
Static task
static1
Behavioral task
behavioral1
Sample
ce223b231f2862124386c585e9b95ca1.dll
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
ce223b231f2862124386c585e9b95ca1.dll
Resource
win10v2004-20240226-en
General
-
Target
ce223b231f2862124386c585e9b95ca1.dll
-
Size
5.0MB
-
MD5
ce223b231f2862124386c585e9b95ca1
-
SHA1
61673e2be7e3479a818eb98339692bc7e4a5b79c
-
SHA256
92bc02116a72b13d359ba88e0984ea09d2eb230fbf711d92a0c961e08274a09e
-
SHA512
dede42923cae7167fcff56ae1131e6cb5a9c8ef14d76d1be84211504685d628fa1abf658a7ec89d0bca976c35ef6eb58f93e4f59ffcc4c27468e3e44c0ac4faa
-
SSDEEP
12288:TQbLgmluyQhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+DHeQYSUjEXF5:MbLguVQhfdmMSirYbcMNgef0QeQjG
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (2489) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 2 IoCs
Processes:
mssecsvr.exemssecsvr.exepid process 1428 mssecsvr.exe 4904 mssecsvr.exe -
Drops file in Windows directory 2 IoCs
Processes:
rundll32.exemssecsvr.exedescription ioc process File created C:\WINDOWS\mssecsvr.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvr.exe -
Modifies data under HKEY_USERS 5 IoCs
Processes:
mssecsvr.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" mssecsvr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 2460 wrote to memory of 1008 2460 rundll32.exe rundll32.exe PID 2460 wrote to memory of 1008 2460 rundll32.exe rundll32.exe PID 2460 wrote to memory of 1008 2460 rundll32.exe rundll32.exe PID 1008 wrote to memory of 1428 1008 rundll32.exe mssecsvr.exe PID 1008 wrote to memory of 1428 1008 rundll32.exe mssecsvr.exe PID 1008 wrote to memory of 1428 1008 rundll32.exe mssecsvr.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ce223b231f2862124386c585e9b95ca1.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ce223b231f2862124386c585e9b95ca1.dll,#12⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\WINDOWS\mssecsvr.exeC:\WINDOWS\mssecsvr.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1428
-
C:\WINDOWS\mssecsvr.exeC:\WINDOWS\mssecsvr.exe -m security1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4904
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
968KB
MD5228e104f51d524ee34c28d37bfbb8d82
SHA1bf75ffb076fca7144d8b952be9003a965390fe92
SHA256c87ebcb003f937581a8d8e7046644e568da695e21794c97317973c9be616f1cf
SHA512a62e23928f0d93df86517fc2719b192f0bcddbc528b9cd4d52ea066542110d58c8da4fb1b1f7cf7208912d9d139e5cb79f6667c8183f0532412724d96f25de81
-
Filesize
1024KB
MD59b32cf69a46981fefaeaa579211cc2ed
SHA107ee82d8140a00a500e5e7278c753524101d3f53
SHA256269be23b8ce7fcd7c0343d26b13a8f59f05455ddc31b80d09aa22464c0009dea
SHA5123f47e8db3c419ba7c729c8bf05fa7f44cd02e32aa61f836cbe9329cbe8b1bde8768d2690b44a784e95a2d7e46bc22182797ae842633ee79eecd46058f0b5f8a7
-
Filesize
2.2MB
MD560a91a498c0f1ffddef484c5a4d42564
SHA1a15dcd408c0aee1f5f38b50528583bdee6536227
SHA25603dc66c9970481c5958d247f9eba93a6a7ad9f9bbf94845b9fbea8ed1e1e0757
SHA512e7b7a308227fc3c72d8d1bd262389257e1f2fa419f6ceff58f73a06f850245f6e1068ea74cf42388ee2ca2712d7b5d9a2ce0e6f7264c3885b82c1caa70891e55