Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    24/05/2024, 10:34 UTC

General

  • Target

    mssecsvc.exe

  • Size

    3.6MB

  • MD5

    41b5ba4bf74e65845fa8c9861ca34508

  • SHA1

    427934d7fa2467bab1abfa5959c8cf6d0ae00ea7

  • SHA256

    95ab184ecc89b9a593c024963650f54fe0a597c3f75d75ff3bf4f33f648c6d13

  • SHA512

    ef55010669b1098df68c511d6863082abcc2ed4af78d933a1fb8dad347893eebc44ade3e41b3fe296a11dd3cf026bdb0d8359dd759569df5d7b37f9294921a48

  • SSDEEP

    98304:yDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2HJ:yDqPe1Cxcxk3ZAEUadzR8yc4HJ

Malware Config

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

  • Contacts a large (3120) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Executes dropped EXE 1 IoCs
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Modifies data under HKEY_USERS 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\mssecsvc.exe
    "C:\Users\Admin\AppData\Local\Temp\mssecsvc.exe"
    1⤵
    • Drops file in Windows directory
    PID:1632
    • C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      2⤵
      • Executes dropped EXE
      PID:2556
  • C:\Users\Admin\AppData\Local\Temp\mssecsvc.exe
    C:\Users\Admin\AppData\Local\Temp\mssecsvc.exe -m security
    1⤵
    • Drops file in System32 directory
    • Modifies data under HKEY_USERS
    PID:3060

Network

  • flag-us
    DNS
    www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
    mssecsvc.exe
    Remote address:
    8.8.8.8:53
    Request
    www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
    IN A
    Response
    www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
    IN A
    104.16.166.228
    www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
    IN A
    104.16.167.228
  • flag-us
    GET
    http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
    mssecsvc.exe
    Remote address:
    104.16.166.228:80
    Request
    GET / HTTP/1.1
    Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Date: Fri, 24 May 2024 10:34:33 GMT
    Content-Type: text/html
    Content-Length: 607
    Connection: close
    Server: cloudflare
    CF-RAY: 888ca244391593db-LHR
  • flag-us
    GET
    http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
    mssecsvc.exe
    Remote address:
    104.16.166.228:80
    Request
    GET / HTTP/1.1
    Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Date: Fri, 24 May 2024 10:34:33 GMT
    Content-Type: text/html
    Content-Length: 607
    Connection: close
    Server: cloudflare
    CF-RAY: 888ca245089776b3-LHR
  • 104.16.166.228:80
    http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
    http
    mssecsvc.exe
    330 B
    990 B
    5
    5

    HTTP Request

    GET http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/

    HTTP Response

    200
  • 104.16.166.228:80
    http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
    http
    mssecsvc.exe
    330 B
    990 B
    5
    5

    HTTP Request

    GET http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/

    HTTP Response

    200
  • 137.228.179.40:445
    mssecsvc.exe
    52 B
    1
  • 10.127.0.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.7.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.9.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.4.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.10.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.1.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.2.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.3.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.5.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.6.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.8.1:445
    mssecsvc.exe
    52 B
    1
  • 97.37.247.3:445
    mssecsvc.exe
    52 B
    1
  • 10.127.11.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.12.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.13.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.14.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.15.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.16.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.20.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.21.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.17.1:445
    mssecsvc.exe
    52 B
    1
  • 103.56.35.63:445
    mssecsvc.exe
    52 B
    1
  • 10.127.18.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.19.1:445
    mssecsvc.exe
    52 B
    1
  • 37.239.132.237:445
    mssecsvc.exe
    52 B
    1
  • 10.127.24.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.23.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.22.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.27.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.25.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.26.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.28.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.29.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.30.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.31.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.32.1:445
    mssecsvc.exe
    52 B
    1
  • 150.201.106.4:445
    mssecsvc.exe
    52 B
    1
  • 10.127.33.1:445
    mssecsvc.exe
    52 B
    1
  • 197.216.200.79:445
    mssecsvc.exe
    52 B
    1
  • 10.127.34.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.36.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.38.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.35.1:445
    mssecsvc.exe
    52 B
    1
  • 61.36.62.250:445
    mssecsvc.exe
    52 B
    1
  • 10.127.42.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.43.1:445
    mssecsvc.exe
    52 B
    1
  • 140.92.6.133:445
    mssecsvc.exe
    52 B
    1
  • 10.127.41.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.37.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.39.1:445
    mssecsvc.exe
    52 B
    1
  • 5.182.241.109:445
    mssecsvc.exe
    52 B
    1
  • 10.127.45.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.40.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.44.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.46.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.47.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.48.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.49.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.50.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.51.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.52.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.53.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.54.1:445
    mssecsvc.exe
    52 B
    1
  • 33.191.60.64:445
    mssecsvc.exe
    52 B
    1
  • 164.205.92.131:445
    mssecsvc.exe
    52 B
    1
  • 91.53.15.62:445
    mssecsvc.exe
    52 B
    1
  • 10.127.55.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.57.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.60.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.56.1:445
    mssecsvc.exe
    52 B
    1
  • 146.60.58.85:445
    mssecsvc.exe
    52 B
    1
  • 10.127.58.1:445
    mssecsvc.exe
    52 B
    1
  • 141.71.174.188:445
    mssecsvc.exe
    52 B
    1
  • 34.69.124.65:445
    mssecsvc.exe
    52 B
    1
  • 10.127.63.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.61.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.64.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.59.1:445
    mssecsvc.exe
    52 B
    1
  • 30.154.73.58:445
    mssecsvc.exe
    52 B
    1
  • 10.127.67.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.62.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.65.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.66.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.68.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.69.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.70.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.71.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.72.1:445
    mssecsvc.exe
    52 B
    1
  • 119.242.163.30:445
    mssecsvc.exe
    52 B
    1
  • 10.127.73.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.74.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.75.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.76.1:445
    mssecsvc.exe
    52 B
    1
  • 153.149.123.5:445
    mssecsvc.exe
    52 B
    1
  • 30.210.16.187:445
    mssecsvc.exe
    52 B
    1
  • 183.234.236.66:445
    mssecsvc.exe
    52 B
    1
  • 10.127.78.1:445
    mssecsvc.exe
    52 B
    1
  • 112.163.26.159:445
    mssecsvc.exe
    52 B
    1
  • 50.95.225.36:445
    mssecsvc.exe
    52 B
    1
  • 10.127.77.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.80.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.79.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.83.1:445
    mssecsvc.exe
    52 B
    1
  • 149.253.13.114:445
    mssecsvc.exe
    52 B
    1
  • 10.127.82.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.85.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.84.1:445
    mssecsvc.exe
    52 B
    1
  • 205.237.178.10:445
    mssecsvc.exe
    52 B
    1
  • 10.127.81.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.86.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.87.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.88.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.89.1:445
    mssecsvc.exe
    52 B
    1
  • 81.157.176.96:445
    mssecsvc.exe
    52 B
    1
  • 10.127.90.1:445
    mssecsvc.exe
    52 B
    1
  • 193.229.115.64:445
    mssecsvc.exe
    52 B
    1
  • 10.127.91.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.92.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.93.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.94.1:445
    mssecsvc.exe
    52 B
    1
  • 85.173.131.200:445
    mssecsvc.exe
    52 B
    1
  • 10.127.95.1:445
    mssecsvc.exe
    52 B
    1
  • 192.86.28.41:445
    mssecsvc.exe
    52 B
    1
  • 10.127.97.1:445
    mssecsvc.exe
    52 B
    1
  • 146.237.19.121:445
    mssecsvc.exe
    52 B
    1
  • 10.127.98.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.96.1:445
    mssecsvc.exe
    52 B
    1
  • 155.24.177.108:445
    mssecsvc.exe
    52 B
    1
  • 181.0.40.107:445
    mssecsvc.exe
    52 B
    1
  • 42.213.151.223:445
    mssecsvc.exe
    52 B
    1
  • 10.127.99.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.100.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.102.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.104.1:445
    mssecsvc.exe
    52 B
    1
  • 139.79.124.2:445
    mssecsvc.exe
    52 B
    1
  • 188.127.14.214:445
    mssecsvc.exe
    52 B
    1
  • 10.127.106.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.101.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.105.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.103.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.107.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.108.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.109.1:445
    mssecsvc.exe
    52 B
    1
  • 57.247.244.158:445
    mssecsvc.exe
    52 B
    1
  • 10.127.110.1:445
    mssecsvc.exe
    52 B
    1
  • 41.10.95.116:445
    mssecsvc.exe
    52 B
    1
  • 10.127.111.1:445
    mssecsvc.exe
    52 B
    1
  • 12.66.135.8:445
    mssecsvc.exe
    52 B
    1
  • 10.127.112.1:445
    mssecsvc.exe
    52 B
    1
  • 141.123.7.52:445
    mssecsvc.exe
    52 B
    1
  • 10.127.113.1:445
    mssecsvc.exe
    52 B
    1
  • 95.19.165.202:445
    mssecsvc.exe
    52 B
    1
  • 10.127.114.1:445
    mssecsvc.exe
    52 B
    1
  • 114.2.55.15:445
    mssecsvc.exe
    52 B
    1
  • 10.127.120.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.115.1:445
    mssecsvc.exe
    52 B
    1
  • 27.19.146.116:445
    mssecsvc.exe
    52 B
    1
  • 10.127.116.1:445
    mssecsvc.exe
    52 B
    1
  • 36.9.127.129:445
    mssecsvc.exe
    52 B
    1
  • 10.127.118.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.121.1:445
    mssecsvc.exe
    52 B
    1
  • 41.207.248.30:445
    mssecsvc.exe
    52 B
    1
  • 10.127.117.1:445
    mssecsvc.exe
    52 B
    1
  • 177.134.208.28:445
    mssecsvc.exe
    52 B
    1
  • 220.61.182.60:445
    mssecsvc.exe
    52 B
    1
  • 10.127.119.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.122.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.127.1:445
    mssecsvc.exe
    52 B
    1
  • 72.46.238.218:445
    mssecsvc.exe
    52 B
    1
  • 10.127.123.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.125.1:445
    mssecsvc.exe
    52 B
    1
  • 173.180.170.143:445
    mssecsvc.exe
    52 B
    1
  • 10.127.124.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.126.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.128.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.129.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.130.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.131.1:445
    mssecsvc.exe
    52 B
    1
  • 30.26.33.133:445
    mssecsvc.exe
    52 B
    1
  • 168.252.7.181:445
    mssecsvc.exe
    52 B
    1
  • 10.127.132.1:445
    mssecsvc.exe
    52 B
    1
  • 154.101.115.5:445
    mssecsvc.exe
    52 B
    1
  • 197.188.237.39:445
    mssecsvc.exe
    52 B
    1
  • 115.174.231.193:445
    mssecsvc.exe
    52 B
    1
  • 50.79.83.59:445
    mssecsvc.exe
    52 B
    1
  • 10.127.140.1:445
    mssecsvc.exe
    52 B
    1
  • 133.38.210.231:445
    mssecsvc.exe
    52 B
    1
  • 10.127.135.1:445
    mssecsvc.exe
    52 B
    1
  • 53.129.239.130:445
    mssecsvc.exe
    52 B
    1
  • 10.127.133.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.141.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.138.1:445
    mssecsvc.exe
    52 B
    1
  • 187.147.207.25:445
    mssecsvc.exe
    52 B
    1
  • 10.127.134.1:445
    mssecsvc.exe
    52 B
    1
  • 167.127.107.88:445
    mssecsvc.exe
    52 B
    1
  • 10.127.137.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.136.1:445
    mssecsvc.exe
    52 B
    1
  • 194.20.51.80:445
    mssecsvc.exe
    52 B
    1
  • 138.160.135.55:445
    mssecsvc.exe
    52 B
    1
  • 109.42.24.4:445
    mssecsvc.exe
    52 B
    1
  • 10.127.139.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.148.1:445
    mssecsvc.exe
    52 B
    1
  • 138.198.79.251:445
    mssecsvc.exe
    52 B
    1
  • 10.127.145.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.149.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.142.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.143.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.144.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.146.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.147.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.150.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.151.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.152.1:445
    mssecsvc.exe
    52 B
    1
  • 170.60.62.75:445
    mssecsvc.exe
    52 B
    1
  • 10.127.153.1:445
    mssecsvc.exe
    52 B
    1
  • 206.163.190.16:445
    mssecsvc.exe
    52 B
    1
  • 144.50.180.117:445
    mssecsvc.exe
    52 B
    1
  • 81.158.185.31:445
    mssecsvc.exe
    52 B
    1
  • 10.127.154.1:445
    mssecsvc.exe
    52 B
    1
  • 114.76.101.225:445
    mssecsvc.exe
    52 B
    1
  • 216.9.13.126:445
    mssecsvc.exe
    52 B
    1
  • 10.127.155.1:445
    mssecsvc.exe
    52 B
    1
  • 58.249.223.236:445
    mssecsvc.exe
    52 B
    1
  • 220.59.212.72:445
    mssecsvc.exe
    52 B
    1
  • 96.224.236.137:445
    mssecsvc.exe
    52 B
    1
  • 10.127.160.1:445
    mssecsvc.exe
    52 B
    1
  • 2.76.92.4:445
    mssecsvc.exe
    52 B
    1
  • 10.127.163.1:445
    mssecsvc.exe
    52 B
    1
  • 117.133.43.67:445
    mssecsvc.exe
    52 B
    1
  • 10.127.156.1:445
    mssecsvc.exe
    52 B
    1
  • 90.119.29.48:445
    mssecsvc.exe
    52 B
    1
  • 10.127.161.1:445
    mssecsvc.exe
    52 B
    1
  • 30.96.183.65:445
    mssecsvc.exe
    52 B
    1
  • 10.127.158.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.157.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.162.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.159.1:445
    mssecsvc.exe
    52 B
    1
  • 77.131.53.77:445
    mssecsvc.exe
    52 B
    1
  • 118.62.136.236:445
    mssecsvc.exe
    52 B
    1
  • 10.127.165.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.164.1:445
    mssecsvc.exe
    52 B
    1
  • 183.22.148.75:445
    mssecsvc.exe
    52 B
    1
  • 10.127.166.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.167.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.168.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.169.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.170.1:445
    mssecsvc.exe
    52 B
    1
  • 219.50.128.235:445
    mssecsvc.exe
    52 B
    1
  • 10.127.171.1:445
    mssecsvc.exe
    52 B
    1
  • 36.72.209.245:445
    mssecsvc.exe
    104 B
    80 B
    2
    2
  • 10.127.172.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.173.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.174.1:445
    mssecsvc.exe
    52 B
    1
  • 186.20.82.162:445
    mssecsvc.exe
    52 B
    1
  • 210.204.184.97:445
    mssecsvc.exe
    52 B
    1
  • 10.127.175.1:445
    mssecsvc.exe
    52 B
    1
  • 172.227.102.110:445
    mssecsvc.exe
    52 B
    1
  • 64.115.50.172:445
    mssecsvc.exe
    52 B
    1
  • 54.47.200.182:445
    mssecsvc.exe
    52 B
    1
  • 164.33.27.229:445
    mssecsvc.exe
    52 B
    1
  • 111.121.63.172:445
    mssecsvc.exe
    52 B
    1
  • 66.243.90.156:445
    mssecsvc.exe
    52 B
    1
  • 10.127.176.1:445
    mssecsvc.exe
    52 B
    1
  • 46.141.38.105:445
    mssecsvc.exe
    52 B
    1
  • 5.178.116.39:445
    mssecsvc.exe
    52 B
    1
  • 10.127.177.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.184.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.180.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.182.1:445
    mssecsvc.exe
    52 B
    1
  • 118.185.243.191:445
    mssecsvc.exe
    52 B
    1
  • 10.127.181.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.179.1:445
    mssecsvc.exe
    52 B
    1
  • 220.91.161.242:445
    mssecsvc.exe
    52 B
    1
  • 92.209.215.218:445
    mssecsvc.exe
    52 B
    1
  • 10.127.186.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.178.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.187.1:445
    mssecsvc.exe
    52 B
    1
  • 190.189.238.103:445
    mssecsvc.exe
    52 B
    1
  • 62.208.191.56:445
    mssecsvc.exe
    52 B
    1
  • 10.127.183.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.185.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.188.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.189.1:445
    mssecsvc.exe
    52 B
    1
  • 143.158.151.16:445
    mssecsvc.exe
    52 B
    1
  • 137.78.225.240:445
    mssecsvc.exe
    52 B
    1
  • 10.127.190.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.191.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.192.1:445
    mssecsvc.exe
    52 B
    1
  • 201.181.40.191:445
    mssecsvc.exe
    52 B
    1
  • 49.161.14.157:445
    mssecsvc.exe
    52 B
    1
  • 10.127.194.1:445
    mssecsvc.exe
    52 B
    1
  • 36.87.233.106:445
    mssecsvc.exe
    52 B
    1
  • 99.114.9.180:445
    mssecsvc.exe
    52 B
    1
  • 10.127.193.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.197.1:445
    mssecsvc.exe
    52 B
    1
  • 53.12.100.52:445
    mssecsvc.exe
    52 B
    1
  • 104.147.141.164:445
    mssecsvc.exe
    52 B
    1
  • 10.127.195.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.196.1:445
    mssecsvc.exe
    52 B
    1
  • 132.13.68.179:445
    mssecsvc.exe
    52 B
    1
  • 208.164.36.106:445
    mssecsvc.exe
    52 B
    1
  • 172.51.178.53:445
    mssecsvc.exe
    52 B
    1
  • 125.208.97.234:445
    mssecsvc.exe
    52 B
    1
  • 171.84.223.88:445
    mssecsvc.exe
    52 B
    1
  • 10.127.199.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.198.1:445
    mssecsvc.exe
    52 B
    1
  • 202.191.76.189:445
    mssecsvc.exe
    52 B
    1
  • 10.127.204.1:445
    mssecsvc.exe
    52 B
    1
  • 93.89.32.26:445
    mssecsvc.exe
    52 B
    1
  • 10.127.201.1:445
    mssecsvc.exe
    52 B
    1
  • 77.172.134.246:445
    mssecsvc.exe
    52 B
    1
  • 186.225.233.39:445
    mssecsvc.exe
    52 B
    1
  • 10.127.200.1:445
    mssecsvc.exe
    52 B
    1
  • 29.131.144.193:445
    mssecsvc.exe
    52 B
    1
  • 10.127.208.1:445
    mssecsvc.exe
    52 B
    1
  • 54.143.50.116:445
    mssecsvc.exe
    52 B
    1
  • 10.127.207.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.202.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.203.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.205.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.206.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.209.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.210.1:445
    mssecsvc.exe
    52 B
    1
  • 18.219.182.52:445
    mssecsvc.exe
    52 B
    1
  • 10.127.211.1:445
    mssecsvc.exe
    52 B
    1
  • 73.47.131.113:445
    mssecsvc.exe
    52 B
    1
  • 147.247.81.165:445
    mssecsvc.exe
    52 B
    1
  • 30.48.83.75:445
    mssecsvc.exe
    52 B
    1
  • 19.108.30.251:445
    mssecsvc.exe
    52 B
    1
  • 10.127.212.1:445
    mssecsvc.exe
    52 B
    1
  • 176.24.107.238:445
    mssecsvc.exe
    52 B
    1
  • 81.71.79.13:445
    mssecsvc.exe
    52 B
    1
  • 41.121.98.54:445
    mssecsvc.exe
    52 B
    1
  • 123.228.148.49:445
    mssecsvc.exe
    52 B
    1
  • 10.127.215.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.217.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.214.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.219.1:445
    mssecsvc.exe
    52 B
    1
  • 172.147.165.207:445
    mssecsvc.exe
    52 B
    1
  • 130.44.207.211:445
    mssecsvc.exe
    52 B
    1
  • 10.127.220.1:445
    mssecsvc.exe
    52 B
    1
  • 82.27.247.254:445
    mssecsvc.exe
    52 B
    1
  • 10.127.218.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.213.1:445
    mssecsvc.exe
    52 B
    1
  • 94.122.213.64:445
    mssecsvc.exe
    144 B
    92 B
    3
    2
  • 146.44.145.181:445
    mssecsvc.exe
    52 B
    1
  • 94.122.213.1:445
    mssecsvc.exe
    144 B
    92 B
    3
    2
  • 141.149.113.253:445
    mssecsvc.exe
    52 B
    1
  • 10.127.221.1:445
    mssecsvc.exe
    52 B
    1
  • 94.122.213.1:445
    smb
    mssecsvc.exe
    1.2kB
    52 B
    11
    1
  • 10.127.216.1:445
    mssecsvc.exe
    52 B
    1
  • 199.27.171.241:445
    mssecsvc.exe
    52 B
    1
  • 111.163.20.155:445
    mssecsvc.exe
    52 B
    1
  • 10.127.222.1:445
    mssecsvc.exe
    52 B
    1
  • 47.12.79.28:445
    mssecsvc.exe
    52 B
    1
  • 186.65.233.5:445
    mssecsvc.exe
    52 B
    1
  • 10.127.229.1:445
    mssecsvc.exe
    52 B
    1
  • 49.225.135.55:445
    mssecsvc.exe
    52 B
    1
  • 82.53.169.36:445
    mssecsvc.exe
    52 B
    1
  • 10.127.227.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.223.1:445
    mssecsvc.exe
    52 B
    1
  • 209.169.74.134:445
    mssecsvc.exe
    52 B
    1
  • 10.127.224.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.225.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.226.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.228.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.230.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.231.1:445
    mssecsvc.exe
    52 B
    1
  • 39.219.148.63:445
    mssecsvc.exe
    52 B
    1
  • 11.241.192.249:445
    mssecsvc.exe
    52 B
    1
  • 111.103.24.95:445
    mssecsvc.exe
    52 B
    1
  • 10.127.233.1:445
    mssecsvc.exe
    52 B
    1
  • 96.36.88.121:445
    mssecsvc.exe
    52 B
    1
  • 10.127.232.1:445
    mssecsvc.exe
    52 B
    1
  • 25.208.50.234:445
    mssecsvc.exe
    52 B
    1
  • 42.107.231.220:445
    mssecsvc.exe
    52 B
    1
  • 83.96.125.144:445
    mssecsvc.exe
    52 B
    1
  • 72.140.203.235:445
    mssecsvc.exe
    52 B
    1
  • 10.127.237.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.236.1:445
    mssecsvc.exe
    52 B
    1
  • 180.179.74.84:445
    mssecsvc.exe
    52 B
    1
  • 179.112.231.198:445
    mssecsvc.exe
    52 B
    1
  • 10.127.234.1:445
    mssecsvc.exe
    52 B
    1
  • 115.233.57.84:445
    mssecsvc.exe
    52 B
    1
  • 202.222.22.70:445
    mssecsvc.exe
    52 B
    1
  • 37.40.49.166:445
    mssecsvc.exe
    52 B
    1
  • 181.30.228.37:445
    mssecsvc.exe
    52 B
    1
  • 10.127.242.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.235.1:445
    mssecsvc.exe
    52 B
    1
  • 25.2.239.62:445
    mssecsvc.exe
    52 B
    1
  • 10.127.238.1:445
    mssecsvc.exe
    52 B
    1
  • 142.167.62.85:445
    mssecsvc.exe
    52 B
    1
  • 10.127.239.1:445
    mssecsvc.exe
    52 B
    1
  • 116.224.211.34:445
    mssecsvc.exe
    52 B
    1
  • 10.127.243.1:445
    mssecsvc.exe
    52 B
    1
  • 68.226.199.200:445
    mssecsvc.exe
    52 B
    1
  • 10.127.241.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.240.1:445
    mssecsvc.exe
    52 B
    1
  • 88.222.178.50:445
    mssecsvc.exe
    52 B
    1
  • 28.194.17.16:445
    mssecsvc.exe
    52 B
    1
  • 10.127.248.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.250.1:445
    mssecsvc.exe
    52 B
    1
  • 191.147.7.36:445
    mssecsvc.exe
    52 B
    1
  • 10.127.247.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.244.1:445
    mssecsvc.exe
    52 B
    1
  • 170.238.246.14:445
    mssecsvc.exe
    52 B
    1
  • 10.127.245.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.246.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.249.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.251.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.252.1:445
    mssecsvc.exe
    52 B
    1
  • 111.87.248.215:445
    mssecsvc.exe
    104 B
    80 B
    2
    2
  • 7.75.187.80:445
    mssecsvc.exe
    52 B
    1
  • 27.249.64.235:445
    mssecsvc.exe
    52 B
    1
  • 47.157.143.193:445
    mssecsvc.exe
    52 B
    1
  • 197.238.151.14:445
    mssecsvc.exe
    52 B
    1
  • 55.146.104.239:445
    mssecsvc.exe
    52 B
    1
  • 143.30.10.253:445
    mssecsvc.exe
    52 B
    1
  • 174.50.201.171:445
    mssecsvc.exe
    52 B
    1
  • 10.127.253.1:445
    mssecsvc.exe
    52 B
    1
  • 168.101.227.193:445
    mssecsvc.exe
    52 B
    1
  • 15.166.18.65:445
    mssecsvc.exe
    52 B
    1
  • 102.230.247.67:445
    mssecsvc.exe
    52 B
    1
  • 10.127.254.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.255.1:445
    mssecsvc.exe
    52 B
    1
  • 173.70.176.48:445
    mssecsvc.exe
    52 B
    1
  • 67.103.193.43:445
    mssecsvc.exe
    52 B
    1
  • 190.170.194.9:445
    mssecsvc.exe
    52 B
    1
  • 10.127.5.2:445
    mssecsvc.exe
    52 B
    1
  • 10.127.2.2:445
    mssecsvc.exe
    52 B
    1
  • 61.90.82.90:445
    mssecsvc.exe
    52 B
    1
  • 10.127.1.2:445
    mssecsvc.exe
    52 B
    1
  • 63.33.195.164:445
    mssecsvc.exe
    52 B
    1
  • 10.127.3.2:445
    mssecsvc.exe
    52 B
    1
  • 174.94.230.3:445
    mssecsvc.exe
    52 B
    1
  • 10.127.0.2:445
    mssecsvc.exe
    52 B
    1
  • 10.127.4.2:445
    mssecsvc.exe
    52 B
    1
  • 10.127.7.2:445
    mssecsvc.exe
    52 B
    1
  • 109.159.182.18:445
    mssecsvc.exe
    52 B
    1
  • 155.93.10.75:445
    mssecsvc.exe
    52 B
    1
  • 10.127.9.2:445
    mssecsvc.exe
    52 B
    1
  • 33.55.202.97:445
    mssecsvc.exe
    52 B
    1
  • 69.191.103.40:445
    mssecsvc.exe
    52 B
    1
  • 10.127.12.2:445
    mssecsvc.exe
    52 B
    1
  • 129.183.205.162:445
    mssecsvc.exe
    52 B
    1
  • 181.16.52.39:445
    mssecsvc.exe
    52 B
    1
  • 10.127.6.2:445
    mssecsvc.exe
    52 B
    1
  • 10.127.8.2:445
    mssecsvc.exe
    52 B
    1
  • 10.127.10.2:445
    mssecsvc.exe
    52 B
    1
  • 10.127.11.2:445
    mssecsvc.exe
    52 B
    1
  • 10.127.13.2:445
    mssecsvc.exe
    52 B
    1
  • 10.127.14.2:445
    mssecsvc.exe
    52 B
    1
  • 83.64.28.186:445
    mssecsvc.exe
    52 B
    1
  • 10.127.15.2:445
    mssecsvc.exe
    52 B
    1
  • 181.250.190.192:445
    mssecsvc.exe
    52 B
    1
  • 10.127.17.2:445
    mssecsvc.exe
    52 B
    1
  • 160.115.222.93:445
    mssecsvc.exe
    52 B
    1
  • 215.171.34.51:445
    mssecsvc.exe
    52 B
    1
  • 176.136.212.193:445
    mssecsvc.exe
    52 B
    1
  • 12.87.130.52:445
    mssecsvc.exe
    52 B
    1
  • 48.180.249.31:445
    mssecsvc.exe
    52 B
    1
  • 223.249.59.254:445
    mssecsvc.exe
    52 B
    1
  • 10.127.20.2:445
    mssecsvc.exe
    52 B
    1
  • 59.81.16.91:445
    mssecsvc.exe
    52 B
    1
  • 96.81.38.103:445
    mssecsvc.exe
    52 B
    1
  • 10.127.16.2:445
    mssecsvc.exe
    52 B
    1
  • 150.87.8.153:445
    mssecsvc.exe
    52 B
    1
  • 10.127.19.2:445
    mssecsvc.exe
    52 B
    1
  • 59.143.18.50:445
    mssecsvc.exe
    52 B
    1
  • 10.127.18.2:445
    mssecsvc.exe
    52 B
    1
  • 50.36.238.50:445
    mssecsvc.exe
    52 B
    1
  • 15.244.33.225:445
    mssecsvc.exe
    52 B
    1
  • 97.115.230.65:445
    mssecsvc.exe
    52 B
    1
  • 165.27.39.192:445
    mssecsvc.exe
    52 B
    1
  • 75.153.25.59:445
    mssecsvc.exe
    52 B
    1
  • 121.249.245.62:445
    mssecsvc.exe
    52 B
    1
  • 10.127.29.2:445
    mssecsvc.exe
    52 B
    1
  • 46.77.70.184:445
    mssecsvc.exe
    104 B
    80 B
    2
    2
  • 94.34.190.73:445
    mssecsvc.exe
    52 B
    1
  • 105.53.203.244:445
    mssecsvc.exe
    52 B
    1
  • 143.114.31.54:445
    mssecsvc.exe
    52 B
    1
  • 204.35.223.5:445
    mssecsvc.exe
    52 B
    1
  • 10.127.24.2:445
    mssecsvc.exe
    52 B
    1
  • 10.127.27.2:445
    mssecsvc.exe
    52 B
    1
  • 103.82.230.219:445
    mssecsvc.exe
    52 B
    1
  • 10.127.31.2:445
    mssecsvc.exe
    52 B
    1
  • 10.127.26.2:445
    mssecsvc.exe
    52 B
    1
  • 151.61.203.118:445
    mssecsvc.exe
    52 B
    1
  • 10.127.25.2:445
    mssecsvc.exe
    52 B
    1
  • 10.127.23.2:445
    mssecsvc.exe
    52 B
    1
  • 10.127.21.2:445
    mssecsvc.exe
    52 B
    1
  • 10.127.22.2:445
    mssecsvc.exe
    52 B
    1
  • 10.127.28.2:445
    mssecsvc.exe
    52 B
    1
  • 10.127.30.2:445
    mssecsvc.exe
    52 B
    1
  • 10.127.32.2:445
    mssecsvc.exe
    52 B
    1
  • 10.127.33.2:445
    mssecsvc.exe
    52 B
    1
  • 8.8.8.8:53
    www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
    dns
    mssecsvc.exe
    95 B
    127 B
    1
    1

    DNS Request

    www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com

    DNS Response

    104.16.166.228
    104.16.167.228

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\tasksche.exe

    Filesize

    3.4MB

    MD5

    c906087fbfe90924bc4f903e527e52e8

    SHA1

    0ce9bd4724cae1edc5141e6c8074ad5fcaf9fc6a

    SHA256

    802d815d1cd9e4193cf586124622bde16ecb5d7127a1c0aa9a13d1e3e46f564a

    SHA512

    c479f547bf5e79cfab2985173f200583047e7f47ac565b248ccae802d2e4633cb410a7c502d4923fa6f34d6ca9bd77f898d3ef001a1a42c8939aff861a35457b

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.