wannacry | 13db461f36f81669fb27d074f45e02bf945a5ea5e0c8d028c3e960abde88b727

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 04:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6d669729126ad6976dc3b61ffe0177df_JaffaCakes118.dll
Size 5.0MB
Sample240524-flea9sec33
SHA256 13db461f36f81669fb27d074f45e02bf945a5ea5e0c8d028c3e960abde88b727
MD5 6d669729126ad6976dc3b61ffe0177df
SHA1 92ddc59fdc1f8205f712eb7f650d788ab277b874
SHA512 8d687314a2309056a07b032d9e60f2220f0a7fd510c18929d87fb6e77c2e466a34a987cb84cb1dcf9a4aeb80dd18c3d97481a033d7ae6b38112401cf945c833b
SSDEEP 98304:PDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2H:PDqPe1Cxcxk3ZAEUadzR8yc4H
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

wannacry discovery evasion ransomware worm

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	mssecsvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	mssecsvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	mssecsvc.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\WINDOWS\mssecsvc.exe = "C:\\WINDOWS\\mssecsvc.exe:*:enabled:@shell32.dll,-1"	mssecsvc.exe

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3316) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 2 IoCs

pid	Process
1388	mssecsvc.exe
3840	mssecsvc.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2184	1388	WerFault.exe	84

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1388	mssecsvc.exe
1388	mssecsvc.exe
3840	mssecsvc.exe
3840	mssecsvc.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
1388	mssecsvc.exe
1388	mssecsvc.exe
1388	mssecsvc.exe
1388	mssecsvc.exe
1388	mssecsvc.exe
1388	mssecsvc.exe
1388	mssecsvc.exe
1388	mssecsvc.exe
1388	mssecsvc.exe
1388	mssecsvc.exe
1388	mssecsvc.exe
1388	mssecsvc.exe
1388	mssecsvc.exe
1388	mssecsvc.exe
1388	mssecsvc.exe
1388	mssecsvc.exe
1388	mssecsvc.exe
1388	mssecsvc.exe
1388	mssecsvc.exe
1388	mssecsvc.exe
1388	mssecsvc.exe
1388	mssecsvc.exe
1388	mssecsvc.exe
1388	mssecsvc.exe
1388	mssecsvc.exe
1388	mssecsvc.exe
1388	mssecsvc.exe
1388	mssecsvc.exe
1388	mssecsvc.exe
1388	mssecsvc.exe
1388	mssecsvc.exe
1388	mssecsvc.exe
1388	mssecsvc.exe
1388	mssecsvc.exe
1388	mssecsvc.exe
1388	mssecsvc.exe
1388	mssecsvc.exe
1388	mssecsvc.exe
1388	mssecsvc.exe
1388	mssecsvc.exe
1388	mssecsvc.exe
1388	mssecsvc.exe
1388	mssecsvc.exe
1388	mssecsvc.exe
1388	mssecsvc.exe
1388	mssecsvc.exe
1388	mssecsvc.exe
1388	mssecsvc.exe
1388	mssecsvc.exe
1388	mssecsvc.exe
1388	mssecsvc.exe
1388	mssecsvc.exe
1388	mssecsvc.exe
1388	mssecsvc.exe
1388	mssecsvc.exe
1388	mssecsvc.exe
1388	mssecsvc.exe
1388	mssecsvc.exe
1388	mssecsvc.exe
1388	mssecsvc.exe
1388	mssecsvc.exe
1388	mssecsvc.exe
1388	mssecsvc.exe
1388	mssecsvc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1388	mssecsvc.exe
Token: SeDebugPrivilege	3840	mssecsvc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 1904	2884	rundll32.exe	83
PID 2884 wrote to memory of 1904	2884	rundll32.exe	83
PID 2884 wrote to memory of 1904	2884	rundll32.exe	83
PID 1904 wrote to memory of 1388	1904	rundll32.exe	84
PID 1904 wrote to memory of 1388	1904	rundll32.exe	84
PID 1904 wrote to memory of 1388	1904	rundll32.exe	84
PID 1388 wrote to memory of 620	1388	mssecsvc.exe	5
PID 1388 wrote to memory of 620	1388	mssecsvc.exe	5
PID 1388 wrote to memory of 620	1388	mssecsvc.exe	5
PID 1388 wrote to memory of 620	1388	mssecsvc.exe	5
PID 1388 wrote to memory of 620	1388	mssecsvc.exe	5
PID 1388 wrote to memory of 620	1388	mssecsvc.exe	5
PID 1388 wrote to memory of 672	1388	mssecsvc.exe	7
PID 1388 wrote to memory of 672	1388	mssecsvc.exe	7
PID 1388 wrote to memory of 672	1388	mssecsvc.exe	7
PID 1388 wrote to memory of 672	1388	mssecsvc.exe	7
PID 1388 wrote to memory of 672	1388	mssecsvc.exe	7
PID 1388 wrote to memory of 672	1388	mssecsvc.exe	7
PID 1388 wrote to memory of 780	1388	mssecsvc.exe	8
PID 1388 wrote to memory of 780	1388	mssecsvc.exe	8
PID 1388 wrote to memory of 780	1388	mssecsvc.exe	8
PID 1388 wrote to memory of 780	1388	mssecsvc.exe	8
PID 1388 wrote to memory of 780	1388	mssecsvc.exe	8
PID 1388 wrote to memory of 780	1388	mssecsvc.exe	8
PID 1388 wrote to memory of 784	1388	mssecsvc.exe	9
PID 1388 wrote to memory of 784	1388	mssecsvc.exe	9
PID 1388 wrote to memory of 784	1388	mssecsvc.exe	9
PID 1388 wrote to memory of 784	1388	mssecsvc.exe	9
PID 1388 wrote to memory of 784	1388	mssecsvc.exe	9
PID 1388 wrote to memory of 784	1388	mssecsvc.exe	9
PID 1388 wrote to memory of 800	1388	mssecsvc.exe	10
PID 1388 wrote to memory of 800	1388	mssecsvc.exe	10
PID 1388 wrote to memory of 800	1388	mssecsvc.exe	10
PID 1388 wrote to memory of 800	1388	mssecsvc.exe	10
PID 1388 wrote to memory of 800	1388	mssecsvc.exe	10
PID 1388 wrote to memory of 800	1388	mssecsvc.exe	10
PID 1388 wrote to memory of 908	1388	mssecsvc.exe	11
PID 1388 wrote to memory of 908	1388	mssecsvc.exe	11
PID 1388 wrote to memory of 908	1388	mssecsvc.exe	11
PID 1388 wrote to memory of 908	1388	mssecsvc.exe	11
PID 1388 wrote to memory of 908	1388	mssecsvc.exe	11
PID 1388 wrote to memory of 908	1388	mssecsvc.exe	11
PID 1388 wrote to memory of 956	1388	mssecsvc.exe	12
PID 1388 wrote to memory of 956	1388	mssecsvc.exe	12
PID 1388 wrote to memory of 956	1388	mssecsvc.exe	12
PID 1388 wrote to memory of 956	1388	mssecsvc.exe	12
PID 1388 wrote to memory of 956	1388	mssecsvc.exe	12
PID 1388 wrote to memory of 956	1388	mssecsvc.exe	12
PID 1388 wrote to memory of 392	1388	mssecsvc.exe	13
PID 1388 wrote to memory of 392	1388	mssecsvc.exe	13
PID 1388 wrote to memory of 392	1388	mssecsvc.exe	13
PID 1388 wrote to memory of 392	1388	mssecsvc.exe	13
PID 1388 wrote to memory of 392	1388	mssecsvc.exe	13
PID 1388 wrote to memory of 392	1388	mssecsvc.exe	13
PID 1388 wrote to memory of 416	1388	mssecsvc.exe	14
PID 1388 wrote to memory of 416	1388	mssecsvc.exe	14
PID 1388 wrote to memory of 416	1388	mssecsvc.exe	14
PID 1388 wrote to memory of 416	1388	mssecsvc.exe	14
PID 1388 wrote to memory of 416	1388	mssecsvc.exe	14
PID 1388 wrote to memory of 416	1388	mssecsvc.exe	14
PID 1388 wrote to memory of 400	1388	mssecsvc.exe	15
PID 1388 wrote to memory of 400	1388	mssecsvc.exe	15
PID 1388 wrote to memory of 400	1388	mssecsvc.exe	15
PID 1388 wrote to memory of 400	1388	mssecsvc.exe	15

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:620
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:780
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:392

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:672

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:800
- C:\Windows\system32\wbem\unsecapp.exe
  C:\Windows\system32\wbem\unsecapp.exe -Embedding
  2⤵
  PID:3192
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3892
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:4028
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4092
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:3444
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3556
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:2488
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:5064
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:4844
- C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
  2⤵
  PID:1612
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
  2⤵
  PID:4388
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:1844
- C:\Windows\system32\BackgroundTaskHost.exe
  "C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider
  2⤵
  PID:2624
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:216

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:416

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:400

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1048

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1156

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1164

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1172
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2836

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1248

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1436
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1448

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1500

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1684

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1700

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1768

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1808

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1852

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:2028

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1204

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2064

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2160

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2216

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2328

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2828

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2872

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:2936

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3468

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3528
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6d669729126ad6976dc3b61ffe0177df_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2884
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\6d669729126ad6976dc3b61ffe0177df_JaffaCakes118.dll,#1
    3⤵
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:1904
  - - C:\WINDOWS\mssecsvc.exe
      C:\WINDOWS\mssecsvc.exe
      4⤵
      Modifies firewall policy service
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1388
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1388 -s 1424
        5⤵
        Program crash
        
        PID:2184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3696

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:2720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:1496

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:4248

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:3668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4072

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1388 -ip 1388
1⤵
PID:3316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 91fbaaa9857dab4f587f5228390bd930e54356fe2239031a7ee7479366ddd1e8
MD5 f0a386220d554fd7b0a45f7c07ed7cd1
SHA1 c2bc9687fb9e846ef5219f063a7886b0cef3e849
SHA512 1f9510467b47a7c66f9b8d12dd2cf529b58b6c2f8989790d14921047edddee54f793476f7104689484fc02c907028958d326dcc938c1642d24880cda5a32dc1e
SSDEEP 98304:uDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2H:uDqPe1Cxcxk3ZAEUadzR8yc4H
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1388-4-0x0000000000400000-0x0000000000A73000-memory.dmp

Download

memory/1388-5-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Download

memory/1388-7-0x0000000077AF3000-0x0000000077AF4000-memory.dmp

Download

memory/1388-6-0x0000000077AF2000-0x0000000077AF3000-memory.dmp

Download

memory/1388-8-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Download

memory/1388-10-0x000000007FE30000-0x000000007FE3C000-memory.dmp

Download

memory/1388-11-0x000000007FE30000-0x000000007FE3C000-memory.dmp

Download

memory/1388-13-0x000000007FE30000-0x000000007FE3C000-memory.dmp

Download

memory/1388-15-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Download

memory/1388-17-0x0000000000400000-0x0000000000A73000-memory.dmp

Download