wannacry | 8af0930d043642283db87908a19b32db4a79b662789dc4a18cc64033b40e28b0

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2024, 01:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4df36fc85e781b72cb479f2559cc6704_JaffaCakes118.dll
Size 5.0MB
Sample240517-cbcsxacc38
SHA256 8af0930d043642283db87908a19b32db4a79b662789dc4a18cc64033b40e28b0
MD5 4df36fc85e781b72cb479f2559cc6704
SHA1 eb34a21c9ebedaf7f5e3d5eb5b89a80774eac945
SHA512 ccab58e9e02b63b4f6788b1a0aab002091936a1a4116d658ccb807257d16db11caabe0c736b22aebd2653d7b84a1b4343e13630e24faca4c581604dc56812a70
SSDEEP 24576:QbLgddQhfdmMSirYbcMNgef0QeQjG/D8kIqRYoAdNLKz6626Wo/GsnjQ:QnAQqMSPbcBVQej/1INRAW+GsjQ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

wannacry discovery evasion ransomware worm

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\WINDOWS\mssecsvc.exe = "C:\\WINDOWS\\mssecsvc.exe:*:enabled:@shell32.dll,-1"	mssecsvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	mssecsvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	mssecsvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	mssecsvc.exe

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3248) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 2 IoCs

pid	Process
4544	mssecsvc.exe
60	mssecsvc.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1956	4544	WerFault.exe	93

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4544	mssecsvc.exe
4544	mssecsvc.exe
60	mssecsvc.exe
60	mssecsvc.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
4544	mssecsvc.exe
4544	mssecsvc.exe
4544	mssecsvc.exe
4544	mssecsvc.exe
4544	mssecsvc.exe
4544	mssecsvc.exe
4544	mssecsvc.exe
4544	mssecsvc.exe
4544	mssecsvc.exe
4544	mssecsvc.exe
4544	mssecsvc.exe
4544	mssecsvc.exe
4544	mssecsvc.exe
4544	mssecsvc.exe
4544	mssecsvc.exe
4544	mssecsvc.exe
4544	mssecsvc.exe
4544	mssecsvc.exe
4544	mssecsvc.exe
4544	mssecsvc.exe
4544	mssecsvc.exe
4544	mssecsvc.exe
4544	mssecsvc.exe
4544	mssecsvc.exe
4544	mssecsvc.exe
4544	mssecsvc.exe
4544	mssecsvc.exe
4544	mssecsvc.exe
4544	mssecsvc.exe
4544	mssecsvc.exe
4544	mssecsvc.exe
4544	mssecsvc.exe
4544	mssecsvc.exe
4544	mssecsvc.exe
4544	mssecsvc.exe
4544	mssecsvc.exe
4544	mssecsvc.exe
4544	mssecsvc.exe
4544	mssecsvc.exe
4544	mssecsvc.exe
4544	mssecsvc.exe
4544	mssecsvc.exe
4544	mssecsvc.exe
4544	mssecsvc.exe
4544	mssecsvc.exe
4544	mssecsvc.exe
4544	mssecsvc.exe
4544	mssecsvc.exe
4544	mssecsvc.exe
4544	mssecsvc.exe
4544	mssecsvc.exe
4544	mssecsvc.exe
4544	mssecsvc.exe
4544	mssecsvc.exe
4544	mssecsvc.exe
4544	mssecsvc.exe
4544	mssecsvc.exe
4544	mssecsvc.exe
4544	mssecsvc.exe
4544	mssecsvc.exe
4544	mssecsvc.exe
4544	mssecsvc.exe
4544	mssecsvc.exe
4544	mssecsvc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4544	mssecsvc.exe
Token: SeDebugPrivilege	60	mssecsvc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 3480	3044	rundll32.exe	92
PID 3044 wrote to memory of 3480	3044	rundll32.exe	92
PID 3044 wrote to memory of 3480	3044	rundll32.exe	92
PID 3480 wrote to memory of 4544	3480	rundll32.exe	93
PID 3480 wrote to memory of 4544	3480	rundll32.exe	93
PID 3480 wrote to memory of 4544	3480	rundll32.exe	93
PID 4544 wrote to memory of 616	4544	mssecsvc.exe	5
PID 4544 wrote to memory of 616	4544	mssecsvc.exe	5
PID 4544 wrote to memory of 616	4544	mssecsvc.exe	5
PID 4544 wrote to memory of 616	4544	mssecsvc.exe	5
PID 4544 wrote to memory of 616	4544	mssecsvc.exe	5
PID 4544 wrote to memory of 616	4544	mssecsvc.exe	5
PID 4544 wrote to memory of 672	4544	mssecsvc.exe	7
PID 4544 wrote to memory of 672	4544	mssecsvc.exe	7
PID 4544 wrote to memory of 672	4544	mssecsvc.exe	7
PID 4544 wrote to memory of 672	4544	mssecsvc.exe	7
PID 4544 wrote to memory of 672	4544	mssecsvc.exe	7
PID 4544 wrote to memory of 672	4544	mssecsvc.exe	7
PID 4544 wrote to memory of 772	4544	mssecsvc.exe	8
PID 4544 wrote to memory of 772	4544	mssecsvc.exe	8
PID 4544 wrote to memory of 772	4544	mssecsvc.exe	8
PID 4544 wrote to memory of 772	4544	mssecsvc.exe	8
PID 4544 wrote to memory of 772	4544	mssecsvc.exe	8
PID 4544 wrote to memory of 772	4544	mssecsvc.exe	8
PID 4544 wrote to memory of 780	4544	mssecsvc.exe	9
PID 4544 wrote to memory of 780	4544	mssecsvc.exe	9
PID 4544 wrote to memory of 780	4544	mssecsvc.exe	9
PID 4544 wrote to memory of 780	4544	mssecsvc.exe	9
PID 4544 wrote to memory of 780	4544	mssecsvc.exe	9
PID 4544 wrote to memory of 780	4544	mssecsvc.exe	9
PID 4544 wrote to memory of 788	4544	mssecsvc.exe	10
PID 4544 wrote to memory of 788	4544	mssecsvc.exe	10
PID 4544 wrote to memory of 788	4544	mssecsvc.exe	10
PID 4544 wrote to memory of 788	4544	mssecsvc.exe	10
PID 4544 wrote to memory of 788	4544	mssecsvc.exe	10
PID 4544 wrote to memory of 788	4544	mssecsvc.exe	10
PID 4544 wrote to memory of 900	4544	mssecsvc.exe	11
PID 4544 wrote to memory of 900	4544	mssecsvc.exe	11
PID 4544 wrote to memory of 900	4544	mssecsvc.exe	11
PID 4544 wrote to memory of 900	4544	mssecsvc.exe	11
PID 4544 wrote to memory of 900	4544	mssecsvc.exe	11
PID 4544 wrote to memory of 900	4544	mssecsvc.exe	11
PID 4544 wrote to memory of 948	4544	mssecsvc.exe	12
PID 4544 wrote to memory of 948	4544	mssecsvc.exe	12
PID 4544 wrote to memory of 948	4544	mssecsvc.exe	12
PID 4544 wrote to memory of 948	4544	mssecsvc.exe	12
PID 4544 wrote to memory of 948	4544	mssecsvc.exe	12
PID 4544 wrote to memory of 948	4544	mssecsvc.exe	12
PID 4544 wrote to memory of 1016	4544	mssecsvc.exe	13
PID 4544 wrote to memory of 1016	4544	mssecsvc.exe	13
PID 4544 wrote to memory of 1016	4544	mssecsvc.exe	13
PID 4544 wrote to memory of 1016	4544	mssecsvc.exe	13
PID 4544 wrote to memory of 1016	4544	mssecsvc.exe	13
PID 4544 wrote to memory of 1016	4544	mssecsvc.exe	13
PID 4544 wrote to memory of 416	4544	mssecsvc.exe	14
PID 4544 wrote to memory of 416	4544	mssecsvc.exe	14
PID 4544 wrote to memory of 416	4544	mssecsvc.exe	14
PID 4544 wrote to memory of 416	4544	mssecsvc.exe	14
PID 4544 wrote to memory of 416	4544	mssecsvc.exe	14
PID 4544 wrote to memory of 416	4544	mssecsvc.exe	14
PID 4544 wrote to memory of 1044	4544	mssecsvc.exe	15
PID 4544 wrote to memory of 1044	4544	mssecsvc.exe	15
PID 4544 wrote to memory of 1044	4544	mssecsvc.exe	15
PID 4544 wrote to memory of 1044	4544	mssecsvc.exe	15

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:616
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:780
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1016

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:672

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:788
- C:\Windows\system32\wbem\unsecapp.exe
  C:\Windows\system32\wbem\unsecapp.exe -Embedding
  2⤵
  PID:3168
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3860
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3976
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4036
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:668
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4100
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:2096
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:1556
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:4788
- C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
  2⤵
  PID:3392
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:512
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:2128
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
  2⤵
  PID:3492
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:4680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1044

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1052

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1124

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1204
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1448

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1508
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1664

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1716

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1728

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1796

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1876

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1996

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1352

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1348

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:1568

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2140

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2336

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:2716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2852

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2912

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2944

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2980

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3312

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3496
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4df36fc85e781b72cb479f2559cc6704_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3044
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\4df36fc85e781b72cb479f2559cc6704_JaffaCakes118.dll,#1
    3⤵
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:3480
  - - C:\WINDOWS\mssecsvc.exe
      C:\WINDOWS\mssecsvc.exe
      4⤵
      Modifies firewall policy service
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4544
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4544 -s 1416
        5⤵
        Program crash
        
        PID:1956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3652

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:3340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:4960

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:1860

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
1⤵
PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=124.0.6367.118 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=124.0.2478.80 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffe970dceb8,0x7ffe970dcec4,0x7ffe970dced0
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2276,i,11266875042087428226,16669718873272757238,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1952,i,11266875042087428226,16669718873272757238,262144 --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:3
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2340,i,11266875042087428226,16669718873272757238,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:8
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4116,i,11266875042087428226,16669718873272757238,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:8
  2⤵
  PID:3044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:5040

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:60

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4544 -ip 4544
1⤵
PID:4672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 a66536798eec4a36e7a9cf621902010bb5836f841f59f57fcb508466bd017270
MD5 f927d5a11431ab431f6f04ee4be9473d
SHA1 b8298f57071f78254a17956a65438cc4eda9ba59
SHA512 bfd8d28a165736a58d5ed392a69851f39ec80300ffd28112e12436d1d4cbe9faa4e87ed2864c39febd29b3702aa82f505eb7a5192984e35eb4c094553a5917ef
SSDEEP 24576:1bLgddQhfdmMSirYbcMNgef0QeQjG/D8kIqRYoAdNLKz6626Wo/GsnjQ:1nAQqMSPbcBVQej/1INRAW+GsjQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/60-23-0x0000000000400000-0x0000000000A72000-memory.dmp

Download

memory/60-11-0x0000000000400000-0x0000000000A72000-memory.dmp

Download

memory/4544-9-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Download

memory/4544-8-0x0000000077E33000-0x0000000077E34000-memory.dmp

Download

memory/4544-7-0x0000000077E32000-0x0000000077E33000-memory.dmp

Download

memory/4544-6-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Download

memory/4544-5-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Download

memory/4544-14-0x000000007FE30000-0x000000007FE3C000-memory.dmp

Download

memory/4544-13-0x000000007FE30000-0x000000007FE3C000-memory.dmp

Download

memory/4544-12-0x000000007FE30000-0x000000007FE3C000-memory.dmp

Download

memory/4544-19-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Download

memory/4544-16-0x000000007FE30000-0x000000007FE3C000-memory.dmp

Download

memory/4544-22-0x0000000000400000-0x0000000000A72000-memory.dmp

Download

memory/4544-4-0x0000000000400000-0x0000000000A72000-memory.dmp

Download