wannacry | e155cd74fbd32cc492ae1c9557212de69aceecf703750c3b956018ea046db4a4

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 09:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
45955c1b9dd69343a5ce44e6c287cf6a_JaffaCakes118.dll
Size 5.0MB
Sample240515-lp951abf4s
SHA256 e155cd74fbd32cc492ae1c9557212de69aceecf703750c3b956018ea046db4a4
MD5 45955c1b9dd69343a5ce44e6c287cf6a
SHA1 662c4359e843e077b2fbdaa7eb3d2733304fe5d5
SHA512 edd15ee7f7dc9bcbc8d124a561ab7507ce2d701742a3a669f6479df1ff5bff7cdee71a2f437aafd7eacaca2e777607631fd936cf449432191cd90da86ed43ee3
SSDEEP 98304:3DqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2H:3DqPe1Cxcxk3ZAEUadzR8yc4H
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

wannacry discovery evasion ransomware worm

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	mssecsvc.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\WINDOWS\mssecsvc.exe = "C:\\WINDOWS\\mssecsvc.exe:*:enabled:@shell32.dll,-1"	mssecsvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	mssecsvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	mssecsvc.exe

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3306) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 2 IoCs

pid	Process
4840	mssecsvc.exe
5384	mssecsvc.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3480	4840	WerFault.exe	83

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4840	mssecsvc.exe
4840	mssecsvc.exe
5384	mssecsvc.exe
5384	mssecsvc.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
4840	mssecsvc.exe
4840	mssecsvc.exe
4840	mssecsvc.exe
4840	mssecsvc.exe
4840	mssecsvc.exe
4840	mssecsvc.exe
4840	mssecsvc.exe
4840	mssecsvc.exe
4840	mssecsvc.exe
4840	mssecsvc.exe
4840	mssecsvc.exe
4840	mssecsvc.exe
4840	mssecsvc.exe
4840	mssecsvc.exe
4840	mssecsvc.exe
4840	mssecsvc.exe
4840	mssecsvc.exe
4840	mssecsvc.exe
4840	mssecsvc.exe
4840	mssecsvc.exe
4840	mssecsvc.exe
4840	mssecsvc.exe
4840	mssecsvc.exe
4840	mssecsvc.exe
4840	mssecsvc.exe
4840	mssecsvc.exe
4840	mssecsvc.exe
4840	mssecsvc.exe
4840	mssecsvc.exe
4840	mssecsvc.exe
4840	mssecsvc.exe
4840	mssecsvc.exe
4840	mssecsvc.exe
4840	mssecsvc.exe
4840	mssecsvc.exe
4840	mssecsvc.exe
4840	mssecsvc.exe
4840	mssecsvc.exe
4840	mssecsvc.exe
4840	mssecsvc.exe
4840	mssecsvc.exe
4840	mssecsvc.exe
4840	mssecsvc.exe
4840	mssecsvc.exe
4840	mssecsvc.exe
4840	mssecsvc.exe
4840	mssecsvc.exe
4840	mssecsvc.exe
4840	mssecsvc.exe
4840	mssecsvc.exe
4840	mssecsvc.exe
4840	mssecsvc.exe
4840	mssecsvc.exe
4840	mssecsvc.exe
4840	mssecsvc.exe
4840	mssecsvc.exe
4840	mssecsvc.exe
4840	mssecsvc.exe
4840	mssecsvc.exe
4840	mssecsvc.exe
4840	mssecsvc.exe
4840	mssecsvc.exe
4840	mssecsvc.exe
4840	mssecsvc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4840	mssecsvc.exe
Token: SeDebugPrivilege	5384	mssecsvc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 448	2668	rundll32.exe	82
PID 2668 wrote to memory of 448	2668	rundll32.exe	82
PID 2668 wrote to memory of 448	2668	rundll32.exe	82
PID 448 wrote to memory of 4840	448	rundll32.exe	83
PID 448 wrote to memory of 4840	448	rundll32.exe	83
PID 448 wrote to memory of 4840	448	rundll32.exe	83
PID 4840 wrote to memory of 612	4840	mssecsvc.exe	5
PID 4840 wrote to memory of 612	4840	mssecsvc.exe	5
PID 4840 wrote to memory of 612	4840	mssecsvc.exe	5
PID 4840 wrote to memory of 612	4840	mssecsvc.exe	5
PID 4840 wrote to memory of 612	4840	mssecsvc.exe	5
PID 4840 wrote to memory of 612	4840	mssecsvc.exe	5
PID 4840 wrote to memory of 676	4840	mssecsvc.exe	7
PID 4840 wrote to memory of 676	4840	mssecsvc.exe	7
PID 4840 wrote to memory of 676	4840	mssecsvc.exe	7
PID 4840 wrote to memory of 676	4840	mssecsvc.exe	7
PID 4840 wrote to memory of 676	4840	mssecsvc.exe	7
PID 4840 wrote to memory of 676	4840	mssecsvc.exe	7
PID 4840 wrote to memory of 776	4840	mssecsvc.exe	8
PID 4840 wrote to memory of 776	4840	mssecsvc.exe	8
PID 4840 wrote to memory of 776	4840	mssecsvc.exe	8
PID 4840 wrote to memory of 776	4840	mssecsvc.exe	8
PID 4840 wrote to memory of 776	4840	mssecsvc.exe	8
PID 4840 wrote to memory of 776	4840	mssecsvc.exe	8
PID 4840 wrote to memory of 784	4840	mssecsvc.exe	9
PID 4840 wrote to memory of 784	4840	mssecsvc.exe	9
PID 4840 wrote to memory of 784	4840	mssecsvc.exe	9
PID 4840 wrote to memory of 784	4840	mssecsvc.exe	9
PID 4840 wrote to memory of 784	4840	mssecsvc.exe	9
PID 4840 wrote to memory of 784	4840	mssecsvc.exe	9
PID 4840 wrote to memory of 792	4840	mssecsvc.exe	10
PID 4840 wrote to memory of 792	4840	mssecsvc.exe	10
PID 4840 wrote to memory of 792	4840	mssecsvc.exe	10
PID 4840 wrote to memory of 792	4840	mssecsvc.exe	10
PID 4840 wrote to memory of 792	4840	mssecsvc.exe	10
PID 4840 wrote to memory of 792	4840	mssecsvc.exe	10
PID 4840 wrote to memory of 904	4840	mssecsvc.exe	11
PID 4840 wrote to memory of 904	4840	mssecsvc.exe	11
PID 4840 wrote to memory of 904	4840	mssecsvc.exe	11
PID 4840 wrote to memory of 904	4840	mssecsvc.exe	11
PID 4840 wrote to memory of 904	4840	mssecsvc.exe	11
PID 4840 wrote to memory of 904	4840	mssecsvc.exe	11
PID 4840 wrote to memory of 952	4840	mssecsvc.exe	12
PID 4840 wrote to memory of 952	4840	mssecsvc.exe	12
PID 4840 wrote to memory of 952	4840	mssecsvc.exe	12
PID 4840 wrote to memory of 952	4840	mssecsvc.exe	12
PID 4840 wrote to memory of 952	4840	mssecsvc.exe	12
PID 4840 wrote to memory of 952	4840	mssecsvc.exe	12
PID 4840 wrote to memory of 316	4840	mssecsvc.exe	13
PID 4840 wrote to memory of 316	4840	mssecsvc.exe	13
PID 4840 wrote to memory of 316	4840	mssecsvc.exe	13
PID 4840 wrote to memory of 316	4840	mssecsvc.exe	13
PID 4840 wrote to memory of 316	4840	mssecsvc.exe	13
PID 4840 wrote to memory of 316	4840	mssecsvc.exe	13
PID 4840 wrote to memory of 436	4840	mssecsvc.exe	14
PID 4840 wrote to memory of 436	4840	mssecsvc.exe	14
PID 4840 wrote to memory of 436	4840	mssecsvc.exe	14
PID 4840 wrote to memory of 436	4840	mssecsvc.exe	14
PID 4840 wrote to memory of 436	4840	mssecsvc.exe	14
PID 4840 wrote to memory of 436	4840	mssecsvc.exe	14
PID 4840 wrote to memory of 528	4840	mssecsvc.exe	15
PID 4840 wrote to memory of 528	4840	mssecsvc.exe	15
PID 4840 wrote to memory of 528	4840	mssecsvc.exe	15
PID 4840 wrote to memory of 528	4840	mssecsvc.exe	15

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:612
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:792
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:316

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:776
- C:\Windows\system32\wbem\unsecapp.exe
  C:\Windows\system32\wbem\unsecapp.exe -Embedding
  2⤵
  PID:3116
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3864
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3952
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4020
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:396
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4204
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:4588
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:5056
- C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
  2⤵
  PID:2156
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:2752
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
  2⤵
  PID:6060
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:4060

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:436

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:528

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:948

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1048

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1056

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1136
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2776
- C:\Windows\system32\MusNotification.exe
  C:\Windows\system32\MusNotification.exe
  2⤵
  PID:1820

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1244

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1256

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1376
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2480

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1448

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1612

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1652

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1708

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1732

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1900

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1908

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2024

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1660

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2184

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2192

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2256

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2832

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2852

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2872

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2880

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:2916

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3408

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3544
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\45955c1b9dd69343a5ce44e6c287cf6a_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\45955c1b9dd69343a5ce44e6c287cf6a_JaffaCakes118.dll,#1
    3⤵
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:448
  - - C:\WINDOWS\mssecsvc.exe
      C:\WINDOWS\mssecsvc.exe
      4⤵
      Modifies firewall policy service
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4840
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 1408
        5⤵
        Program crash
        
        PID:3480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3664

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4784

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:5920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:6096

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:544

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:5484

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4840 -ip 4840
1⤵
PID:4756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 60cdf0b52a04f6083004f852ec0219ca8ee5170e834f8f95402c641413d9f34f
MD5 9b9994fa566c47736490aec455ee2f50
SHA1 a32e28c4ae24eac41f9f9a801b776eee4066e7ea
SHA512 3f00d21144ab57308b3a0380bfb44783d1f729da4ffc8a47e9aa5acd602b6008fd7f4aa73623f9a9e3ebfb4e7a43ad0ee870260855244b3f21c99eb066787dd0
SSDEEP 98304:6DqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2H:6DqPe1Cxcxk3ZAEUadzR8yc4H
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4840-4-0x0000000000400000-0x0000000000A72000-memory.dmp

Download

memory/4840-5-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Download

memory/4840-7-0x0000000076F13000-0x0000000076F14000-memory.dmp

Download

memory/4840-6-0x0000000076F12000-0x0000000076F13000-memory.dmp

Download

memory/4840-8-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Download

memory/4840-11-0x000000007FE30000-0x000000007FE3C000-memory.dmp

Download

memory/4840-10-0x000000007FE30000-0x000000007FE3C000-memory.dmp

Download

memory/4840-13-0x000000007FE30000-0x000000007FE3C000-memory.dmp

Download

memory/4840-15-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Download

memory/4840-17-0x0000000000400000-0x0000000000A72000-memory.dmp

Download