Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
11-07-2024 23:33
Static task
static1
Behavioral task
behavioral1
Sample
ff95f0d81247ca01a46e54ccbe1154e9f5cfbb3e854bc6460882d9ecce2abc83.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
ff95f0d81247ca01a46e54ccbe1154e9f5cfbb3e854bc6460882d9ecce2abc83.dll
Resource
win10v2004-20240709-en
General
-
Target
ff95f0d81247ca01a46e54ccbe1154e9f5cfbb3e854bc6460882d9ecce2abc83.dll
-
Size
5.0MB
-
MD5
16067c78a3393c4604b7a2ad4e908a90
-
SHA1
47c0864838a0e172249ed4dc2947fa24435b34c9
-
SHA256
ff95f0d81247ca01a46e54ccbe1154e9f5cfbb3e854bc6460882d9ecce2abc83
-
SHA512
fab51fea0f7a2763f5605a8982eb19f5490a2ac0120161cbd3a6a34348f3b63bb2b635c72c994d8cbf9465b55dd5c199f32dd5946f360dbb80a4a41cc254ac4a
-
SSDEEP
49152:RnpENbcBVQe01INRx+TSqTdX1HkQo6SAARdhnv:1p+oBh01aRxcSUDk36SAEdhv
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (2087) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 3 IoCs
Processes:
mssecsvr.exemssecsvr.exetasksche.exepid process 1888 mssecsvr.exe 2008 mssecsvr.exe 2588 tasksche.exe -
Drops file in System32 directory 1 IoCs
Processes:
mssecsvr.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvr.exe -
Drops file in Windows directory 4 IoCs
Processes:
tasksche.exerundll32.exemssecsvr.exedescription ioc process File created C:\Windows\eee.exe tasksche.exe File created C:\WINDOWS\mssecsvr.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvr.exe File created C:\Windows\__tmp_rar_sfx_access_check_259507429 tasksche.exe -
Modifies data under HKEY_USERS 24 IoCs
Processes:
mssecsvr.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A140DFF4-0D65-4A78-924B-EA1FC2CC0227} mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A140DFF4-0D65-4A78-924B-EA1FC2CC0227}\WpadDecisionReason = "1" mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-1d-1f-08-b6-c6\WpadDecisionTime = b0d5c0d7ead3da01 mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A140DFF4-0D65-4A78-924B-EA1FC2CC0227}\fe-1d-1f-08-b6-c6 mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-1d-1f-08-b6-c6 mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-1d-1f-08-b6-c6\WpadDecisionReason = "1" mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A140DFF4-0D65-4A78-924B-EA1FC2CC0227}\WpadDecisionTime = b0d5c0d7ead3da01 mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A140DFF4-0D65-4A78-924B-EA1FC2CC0227}\WpadDecision = "0" mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A140DFF4-0D65-4A78-924B-EA1FC2CC0227}\WpadNetworkName = "Network 3" mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-1d-1f-08-b6-c6\WpadDecision = "0" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mssecsvr.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f007e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
tasksche.exepid process 2588 tasksche.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
rundll32.exerundll32.exemssecsvr.exedescription pid process target process PID 2424 wrote to memory of 2484 2424 rundll32.exe rundll32.exe PID 2424 wrote to memory of 2484 2424 rundll32.exe rundll32.exe PID 2424 wrote to memory of 2484 2424 rundll32.exe rundll32.exe PID 2424 wrote to memory of 2484 2424 rundll32.exe rundll32.exe PID 2424 wrote to memory of 2484 2424 rundll32.exe rundll32.exe PID 2424 wrote to memory of 2484 2424 rundll32.exe rundll32.exe PID 2424 wrote to memory of 2484 2424 rundll32.exe rundll32.exe PID 2484 wrote to memory of 1888 2484 rundll32.exe mssecsvr.exe PID 2484 wrote to memory of 1888 2484 rundll32.exe mssecsvr.exe PID 2484 wrote to memory of 1888 2484 rundll32.exe mssecsvr.exe PID 2484 wrote to memory of 1888 2484 rundll32.exe mssecsvr.exe PID 1888 wrote to memory of 2588 1888 mssecsvr.exe tasksche.exe PID 1888 wrote to memory of 2588 1888 mssecsvr.exe tasksche.exe PID 1888 wrote to memory of 2588 1888 mssecsvr.exe tasksche.exe PID 1888 wrote to memory of 2588 1888 mssecsvr.exe tasksche.exe PID 1888 wrote to memory of 2588 1888 mssecsvr.exe tasksche.exe PID 1888 wrote to memory of 2588 1888 mssecsvr.exe tasksche.exe PID 1888 wrote to memory of 2588 1888 mssecsvr.exe tasksche.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ff95f0d81247ca01a46e54ccbe1154e9f5cfbb3e854bc6460882d9ecce2abc83.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ff95f0d81247ca01a46e54ccbe1154e9f5cfbb3e854bc6460882d9ecce2abc83.dll,#12⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\WINDOWS\mssecsvr.exeC:\WINDOWS\mssecsvr.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i4⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
PID:2588
-
C:\WINDOWS\mssecsvr.exeC:\WINDOWS\mssecsvr.exe -m security1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2008
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
MD590b4050408a6daf42b0fe666b2f1b41b
SHA18b2d64befe94ab1c692b3d9218764560bfd7ad05
SHA25699a622faf7fa1f73c8c2df50589cfb917fdb093e7336675e8d2e51b449d3e7e9
SHA5122f8113a333be1e4c57e99b223ad6f8d9609e97ae4be5a1f155714d3a65f0c0c6dc6e51a9f4bf3237492c751e9ff0f36fce391e0661c70781f234e618c993674b
-
Filesize
2.2MB
MD553db41c9b29c1ef8242d21dc33b9f81b
SHA1999fbe2d2ba609e5f3dc4a244a4737654336addb
SHA256249d0c7a79ee1b2bc0170d43b6eb24f87b045d617a87a563ec0f474d88b8f122
SHA512e070356d033ec0409a13bdea060e2c7e449f9d40ef54df0d76bf050d2a6d013a2de615b057e24a6a11112df6921ab43f03ab56281f9919b5cdc1ea3cc8aba8d8