wannacry | 6da34f82d5170e579f967053bc1ecfd27d2777b59ac25807d8dd5148c28748fb

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19/05/2024, 05:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
58dc734f0486efb9ff6b6b6066e114e0_JaffaCakes118.dll
Size 5.0MB
Sample240519-glfd1add45
SHA256 6da34f82d5170e579f967053bc1ecfd27d2777b59ac25807d8dd5148c28748fb
MD5 58dc734f0486efb9ff6b6b6066e114e0
SHA1 a5e210fd3e2f4e114549a567c71ab5e2a7054286
SHA512 c6a238810bc6235a95a01e7ed25e16617b67704ff28bf19a4f9b599b218f3b6c2495c4a43e57f56d6e793a0da07aa54df92abdea25cb1bf14072e1f346e69f8a
SSDEEP 98304:IDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2H:IDqPe1Cxcxk3ZAEUadzR8yc4H
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

wannacry discovery evasion ransomware worm

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\WINDOWS\mssecsvc.exe = "C:\\WINDOWS\\mssecsvc.exe:*:enabled:@shell32.dll,-1"	mssecsvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	mssecsvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	mssecsvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	mssecsvc.exe

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3287) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 2 IoCs

pid	Process
3664	mssecsvc.exe
3480	mssecsvc.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5028	3664	WerFault.exe	83

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3664	mssecsvc.exe
3664	mssecsvc.exe
3480	mssecsvc.exe
3480	mssecsvc.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
3664	mssecsvc.exe
3664	mssecsvc.exe
3664	mssecsvc.exe
3664	mssecsvc.exe
3664	mssecsvc.exe
3664	mssecsvc.exe
3664	mssecsvc.exe
3664	mssecsvc.exe
3664	mssecsvc.exe
3664	mssecsvc.exe
3664	mssecsvc.exe
3664	mssecsvc.exe
3664	mssecsvc.exe
3664	mssecsvc.exe
3664	mssecsvc.exe
3664	mssecsvc.exe
3664	mssecsvc.exe
3664	mssecsvc.exe
3664	mssecsvc.exe
3664	mssecsvc.exe
3664	mssecsvc.exe
3664	mssecsvc.exe
3664	mssecsvc.exe
3664	mssecsvc.exe
3664	mssecsvc.exe
3664	mssecsvc.exe
3664	mssecsvc.exe
3664	mssecsvc.exe
3664	mssecsvc.exe
3664	mssecsvc.exe
3664	mssecsvc.exe
3664	mssecsvc.exe
3664	mssecsvc.exe
3664	mssecsvc.exe
3664	mssecsvc.exe
3664	mssecsvc.exe
3664	mssecsvc.exe
3664	mssecsvc.exe
3664	mssecsvc.exe
3664	mssecsvc.exe
3664	mssecsvc.exe
3664	mssecsvc.exe
3664	mssecsvc.exe
3664	mssecsvc.exe
3664	mssecsvc.exe
3664	mssecsvc.exe
3664	mssecsvc.exe
3664	mssecsvc.exe
3664	mssecsvc.exe
3664	mssecsvc.exe
3664	mssecsvc.exe
3664	mssecsvc.exe
3664	mssecsvc.exe
3664	mssecsvc.exe
3664	mssecsvc.exe
3664	mssecsvc.exe
3664	mssecsvc.exe
3664	mssecsvc.exe
3664	mssecsvc.exe
3664	mssecsvc.exe
3664	mssecsvc.exe
3664	mssecsvc.exe
3664	mssecsvc.exe
3664	mssecsvc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3664	mssecsvc.exe
Token: SeDebugPrivilege	3480	mssecsvc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 1472	1180	rundll32.exe	82
PID 1180 wrote to memory of 1472	1180	rundll32.exe	82
PID 1180 wrote to memory of 1472	1180	rundll32.exe	82
PID 1472 wrote to memory of 3664	1472	rundll32.exe	83
PID 1472 wrote to memory of 3664	1472	rundll32.exe	83
PID 1472 wrote to memory of 3664	1472	rundll32.exe	83
PID 3664 wrote to memory of 624	3664	mssecsvc.exe	5
PID 3664 wrote to memory of 624	3664	mssecsvc.exe	5
PID 3664 wrote to memory of 624	3664	mssecsvc.exe	5
PID 3664 wrote to memory of 624	3664	mssecsvc.exe	5
PID 3664 wrote to memory of 624	3664	mssecsvc.exe	5
PID 3664 wrote to memory of 624	3664	mssecsvc.exe	5
PID 3664 wrote to memory of 684	3664	mssecsvc.exe	7
PID 3664 wrote to memory of 684	3664	mssecsvc.exe	7
PID 3664 wrote to memory of 684	3664	mssecsvc.exe	7
PID 3664 wrote to memory of 684	3664	mssecsvc.exe	7
PID 3664 wrote to memory of 684	3664	mssecsvc.exe	7
PID 3664 wrote to memory of 684	3664	mssecsvc.exe	7
PID 3664 wrote to memory of 788	3664	mssecsvc.exe	8
PID 3664 wrote to memory of 788	3664	mssecsvc.exe	8
PID 3664 wrote to memory of 788	3664	mssecsvc.exe	8
PID 3664 wrote to memory of 788	3664	mssecsvc.exe	8
PID 3664 wrote to memory of 788	3664	mssecsvc.exe	8
PID 3664 wrote to memory of 788	3664	mssecsvc.exe	8
PID 3664 wrote to memory of 796	3664	mssecsvc.exe	9
PID 3664 wrote to memory of 796	3664	mssecsvc.exe	9
PID 3664 wrote to memory of 796	3664	mssecsvc.exe	9
PID 3664 wrote to memory of 796	3664	mssecsvc.exe	9
PID 3664 wrote to memory of 796	3664	mssecsvc.exe	9
PID 3664 wrote to memory of 796	3664	mssecsvc.exe	9
PID 3664 wrote to memory of 808	3664	mssecsvc.exe	10
PID 3664 wrote to memory of 808	3664	mssecsvc.exe	10
PID 3664 wrote to memory of 808	3664	mssecsvc.exe	10
PID 3664 wrote to memory of 808	3664	mssecsvc.exe	10
PID 3664 wrote to memory of 808	3664	mssecsvc.exe	10
PID 3664 wrote to memory of 808	3664	mssecsvc.exe	10
PID 3664 wrote to memory of 912	3664	mssecsvc.exe	11
PID 3664 wrote to memory of 912	3664	mssecsvc.exe	11
PID 3664 wrote to memory of 912	3664	mssecsvc.exe	11
PID 3664 wrote to memory of 912	3664	mssecsvc.exe	11
PID 3664 wrote to memory of 912	3664	mssecsvc.exe	11
PID 3664 wrote to memory of 912	3664	mssecsvc.exe	11
PID 3664 wrote to memory of 956	3664	mssecsvc.exe	12
PID 3664 wrote to memory of 956	3664	mssecsvc.exe	12
PID 3664 wrote to memory of 956	3664	mssecsvc.exe	12
PID 3664 wrote to memory of 956	3664	mssecsvc.exe	12
PID 3664 wrote to memory of 956	3664	mssecsvc.exe	12
PID 3664 wrote to memory of 956	3664	mssecsvc.exe	12
PID 3664 wrote to memory of 60	3664	mssecsvc.exe	13
PID 3664 wrote to memory of 60	3664	mssecsvc.exe	13
PID 3664 wrote to memory of 60	3664	mssecsvc.exe	13
PID 3664 wrote to memory of 60	3664	mssecsvc.exe	13
PID 3664 wrote to memory of 60	3664	mssecsvc.exe	13
PID 3664 wrote to memory of 60	3664	mssecsvc.exe	13
PID 3664 wrote to memory of 408	3664	mssecsvc.exe	14
PID 3664 wrote to memory of 408	3664	mssecsvc.exe	14
PID 3664 wrote to memory of 408	3664	mssecsvc.exe	14
PID 3664 wrote to memory of 408	3664	mssecsvc.exe	14
PID 3664 wrote to memory of 408	3664	mssecsvc.exe	14
PID 3664 wrote to memory of 408	3664	mssecsvc.exe	14
PID 3664 wrote to memory of 996	3664	mssecsvc.exe	15
PID 3664 wrote to memory of 996	3664	mssecsvc.exe	15
PID 3664 wrote to memory of 996	3664	mssecsvc.exe	15
PID 3664 wrote to memory of 996	3664	mssecsvc.exe	15

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:624
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:796
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:60

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:684

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:808
- C:\Windows\system32\wbem\unsecapp.exe
  C:\Windows\system32\wbem\unsecapp.exe -Embedding
  2⤵
  PID:3060
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3776
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3872
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3936
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:4016
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3832
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:4804
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3968
- C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
  2⤵
  PID:4744
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:1308
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
  2⤵
  PID:648
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:3268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:996

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1028

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1144

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1152
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2080
- C:\Windows\system32\MusNotification.exe
  C:\Windows\system32\MusNotification.exe
  2⤵
  PID:4316

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1160

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1216

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1436
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2872

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1640

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1744

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1764

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1776

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1984

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2016

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2044

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2052

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2128

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2192

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2220

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2684

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2704

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2748

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2996

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3324

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3436
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\58dc734f0486efb9ff6b6b6066e114e0_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1180
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\58dc734f0486efb9ff6b6b6066e114e0_JaffaCakes118.dll,#1
    3⤵
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:1472
  - - C:\WINDOWS\mssecsvc.exe
      C:\WINDOWS\mssecsvc.exe
      4⤵
      Modifies firewall policy service
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3664
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3664 -s 1424
        5⤵
        Program crash
        
        PID:5028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3576

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4908

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:1272

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:2720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:3740

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2336

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3664 -ip 3664
1⤵
PID:3772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 b976c3866b0bd6a49e90f5e7bde19dce37de70b9d7ff30af70c1edc5c4f9cab2
MD5 2fbf26ed3af5c021d1699169e90b05c6
SHA1 9c21ce1392139e15be4aa526ac62a2bef07154ca
SHA512 043886ae20bd234d7b3da3b1561f07cf4ea3de2715be565416a67bb0d3e3a8c772e9d0671f08a62fece8fab5c1de250795b8e8ef0d52ed7c2ac6e9b80666cb70
SSDEEP 98304:dDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2H:dDqPe1Cxcxk3ZAEUadzR8yc4H
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3480-23-0x0000000000400000-0x0000000000A72000-memory.dmp

Download

memory/3480-11-0x0000000000400000-0x0000000000A72000-memory.dmp

Download

memory/3664-9-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Download

memory/3664-7-0x0000000077793000-0x0000000077794000-memory.dmp

Download

memory/3664-8-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Download

memory/3664-6-0x0000000077792000-0x0000000077793000-memory.dmp

Download

memory/3664-5-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Download

memory/3664-12-0x000000007FE30000-0x000000007FE3C000-memory.dmp

Download

memory/3664-14-0x000000007FE30000-0x000000007FE3C000-memory.dmp

Download

memory/3664-13-0x000000007FE30000-0x000000007FE3C000-memory.dmp

Download

memory/3664-19-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Download

memory/3664-16-0x000000007FE30000-0x000000007FE3C000-memory.dmp

Download

memory/3664-22-0x0000000000400000-0x0000000000A72000-memory.dmp

Download

memory/3664-4-0x0000000000400000-0x0000000000A72000-memory.dmp

Download