Analysis

  • max time kernel
    151s
  • max time network
    162s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    23/07/2024, 12:00 UTC

General

  • Target

    678323b12f8ae74c7bf406efced5f476_JaffaCakes118.dll

  • Size

    5.0MB

  • MD5

    678323b12f8ae74c7bf406efced5f476

  • SHA1

    f9ec0e2e5a679934e18d78f7924cce8f1f324b01

  • SHA256

    44533af9de63dd3fac4a9fbba9b6831496b9121eb3ce221145926c3d6b37310e

  • SHA512

    f6f84783d9965318ae82547bea16289ff63910f8181ab223dc9d9dab45f55f6431c7ae9a6ee46621ee7e545db2be99d2db201a4e94d414acee1e115c4786a3ec

  • SSDEEP

    98304:+DqPoBG1aRxcSUDk36SAEdhWxWa9P593R8yAVp2H:+DqPR1Cxcxk3ZAEFadzR8yc4H

Malware Config

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

  • Contacts a large (3193) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Executes dropped EXE 3 IoCs
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies data under HKEY_USERS 24 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\678323b12f8ae74c7bf406efced5f476_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2468
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\678323b12f8ae74c7bf406efced5f476_JaffaCakes118.dll,#1
      2⤵
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:2416
      • C:\WINDOWS\mssecsvc.exe
        C:\WINDOWS\mssecsvc.exe
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        PID:2248
        • C:\WINDOWS\tasksche.exe
          C:\WINDOWS\tasksche.exe /i
          4⤵
          • Executes dropped EXE
          PID:2920
  • C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe -m security
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Modifies data under HKEY_USERS
    PID:2820

Network

  • flag-us
    DNS
    www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
    mssecsvc.exe
    Remote address:
    8.8.8.8:53
    Request
    www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
    IN A
    Response
    www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
    IN A
    104.16.166.228
    www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
    IN A
    104.16.167.228
  • flag-us
    GET
    http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
    mssecsvc.exe
    Remote address:
    104.16.166.228:80
    Request
    GET / HTTP/1.1
    Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Date: Tue, 23 Jul 2024 12:07:33 GMT
    Content-Type: text/html
    Content-Length: 607
    Connection: close
    Server: cloudflare
    CF-RAY: 8a7b8d012d2394d9-LHR
  • flag-us
    GET
    http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
    mssecsvc.exe
    Remote address:
    104.16.166.228:80
    Request
    GET / HTTP/1.1
    Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Date: Tue, 23 Jul 2024 12:07:33 GMT
    Content-Type: text/html
    Content-Length: 607
    Connection: close
    Server: cloudflare
    CF-RAY: 8a7b8d04ffd0069e-LHR
  • 104.16.166.228:80
    http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
    http
    mssecsvc.exe
    330 B
    990 B
    5
    5

    HTTP Request

    GET http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/

    HTTP Response

    200
  • 104.16.166.228:80
    http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
    http
    mssecsvc.exe
    330 B
    990 B
    5
    5

    HTTP Request

    GET http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/

    HTTP Response

    200
  • 162.172.65.150:445
    mssecsvc.exe
    52 B
    1
  • 10.127.0.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.1.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.3.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.2.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.5.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.9.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.4.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.10.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.6.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.11.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.7.1:445
    mssecsvc.exe
    52 B
    1
  • 193.162.242.221:445
    mssecsvc.exe
    52 B
    1
  • 10.127.8.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.12.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.17.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.15.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.14.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.13.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.19.1:445
    mssecsvc.exe
    52 B
    1
  • 153.248.90.71:445
    mssecsvc.exe
    52 B
    40 B
    1
    1
  • 10.127.16.1:445
    mssecsvc.exe
    52 B
    1
  • 71.132.47.206:445
    mssecsvc.exe
    52 B
    1
  • 10.127.24.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.18.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.21.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.20.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.23.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.22.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.27.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.26.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.25.1:445
    mssecsvc.exe
    52 B
    1
  • 75.156.85.32:445
    mssecsvc.exe
    52 B
    1
  • 10.127.28.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.30.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.31.1:445
    mssecsvc.exe
    52 B
    1
  • 21.220.91.63:445
    mssecsvc.exe
    52 B
    1
  • 10.127.29.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.32.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.33.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.38.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.36.1:445
    mssecsvc.exe
    52 B
    1
  • 34.246.177.43:445
    mssecsvc.exe
    52 B
    1
  • 10.127.37.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.39.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.35.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.34.1:445
    mssecsvc.exe
    52 B
    1
  • 116.161.78.67:445
    mssecsvc.exe
    52 B
    1
  • 98.104.241.16:445
    mssecsvc.exe
    52 B
    1
  • 10.127.40.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.42.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.41.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.43.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.48.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.44.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.47.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.50.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.51.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.46.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.49.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.45.1:445
    mssecsvc.exe
    52 B
    1
  • 47.20.239.125:445
    mssecsvc.exe
    52 B
    1
  • 10.127.54.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.53.1:445
    mssecsvc.exe
    52 B
    1
  • 181.112.117.218:445
    mssecsvc.exe
    52 B
    1
  • 164.141.229.108:445
    mssecsvc.exe
    52 B
    1
  • 10.127.55.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.57.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.52.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.59.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.61.1:445
    mssecsvc.exe
    52 B
    1
  • 101.247.111.105:445
    mssecsvc.exe
    52 B
    1
  • 10.127.56.1:445
    mssecsvc.exe
    52 B
    1
  • 146.151.216.196:445
    mssecsvc.exe
    52 B
    1
  • 10.127.58.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.62.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.64.1:445
    mssecsvc.exe
    52 B
    1
  • 214.21.7.5:445
    mssecsvc.exe
    52 B
    1
  • 10.127.60.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.67.1:445
    mssecsvc.exe
    52 B
    1
  • 72.22.130.85:445
    mssecsvc.exe
    52 B
    1
  • 10.127.66.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.63.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.65.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.71.1:445
    mssecsvc.exe
    52 B
    1
  • 18.15.171.157:445
    mssecsvc.exe
    52 B
    1
  • 71.64.148.9:445
    mssecsvc.exe
    52 B
    1
  • 10.127.68.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.72.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.75.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.69.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.74.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.70.1:445
    mssecsvc.exe
    52 B
    1
  • 204.46.132.15:445
    mssecsvc.exe
    52 B
    1
  • 10.127.73.1:445
    mssecsvc.exe
    52 B
    1
  • 92.60.26.48:445
    mssecsvc.exe
    52 B
    1
  • 10.127.76.1:445
    mssecsvc.exe
    52 B
    1
  • 25.177.121.119:445
    mssecsvc.exe
    52 B
    1
  • 10.127.77.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.79.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.84.1:445
    mssecsvc.exe
    52 B
    1
  • 93.84.125.126:445
    mssecsvc.exe
    52 B
    1
  • 10.127.81.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.78.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.83.1:445
    mssecsvc.exe
    52 B
    1
  • 5.22.221.236:445
    mssecsvc.exe
    52 B
    1
  • 208.131.31.55:445
    mssecsvc.exe
    52 B
    1
  • 10.127.80.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.89.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.82.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.85.1:445
    mssecsvc.exe
    52 B
    1
  • 169.193.181.207:445
    mssecsvc.exe
    52 B
    1
  • 10.127.86.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.90.1:445
    mssecsvc.exe
    52 B
    1
  • 91.218.193.184:445
    mssecsvc.exe
    52 B
    1
  • 10.127.91.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.92.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.93.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.87.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.88.1:445
    mssecsvc.exe
    52 B
    1
  • 87.72.226.110:445
    mssecsvc.exe
    52 B
    1
  • 10.127.94.1:445
    mssecsvc.exe
    52 B
    1
  • 220.77.243.216:445
    mssecsvc.exe
    52 B
    1
  • 10.127.98.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.95.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.97.1:445
    mssecsvc.exe
    52 B
    1
  • 7.204.163.228:445
    mssecsvc.exe
    52 B
    1
  • 10.127.96.1:445
    mssecsvc.exe
    52 B
    1
  • 52.65.41.10:445
    mssecsvc.exe
    52 B
    1
  • 209.2.220.146:445
    mssecsvc.exe
    52 B
    1
  • 30.24.157.92:445
    mssecsvc.exe
    52 B
    1
  • 10.127.101.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.100.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.99.1:445
    mssecsvc.exe
    52 B
    1
  • 124.209.163.26:445
    mssecsvc.exe
    52 B
    1
  • 10.127.104.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.102.1:445
    mssecsvc.exe
    52 B
    1
  • 50.202.52.165:445
    mssecsvc.exe
    104 B
    80 B
    2
    2
  • 10.127.103.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.105.1:445
    mssecsvc.exe
    52 B
    1
  • 22.210.184.231:445
    mssecsvc.exe
    52 B
    1
  • 10.127.110.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.107.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.106.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.111.1:445
    mssecsvc.exe
    52 B
    1
  • 128.228.173.107:445
    mssecsvc.exe
    52 B
    1
  • 10.46.161.74:445
    mssecsvc.exe
    52 B
    1
  • 10.127.109.1:445
    mssecsvc.exe
    52 B
    1
  • 177.3.152.61:445
    mssecsvc.exe
    52 B
    1
  • 10.127.108.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.113.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.112.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.114.1:445
    mssecsvc.exe
    52 B
    1
  • 145.106.54.7:445
    mssecsvc.exe
    52 B
    1
  • 10.127.115.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.117.1:445
    mssecsvc.exe
    52 B
    1
  • 43.217.228.158:445
    mssecsvc.exe
    52 B
    1
  • 10.127.120.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.116.1:445
    mssecsvc.exe
    52 B
    1
  • 124.173.112.73:445
    mssecsvc.exe
    52 B
    1
  • 10.127.118.1:445
    mssecsvc.exe
    52 B
    1
  • 85.73.222.95:445
    mssecsvc.exe
    52 B
    1
  • 10.127.121.1:445
    mssecsvc.exe
    52 B
    1
  • 82.166.232.230:445
    mssecsvc.exe
    104 B
    80 B
    2
    2
  • 8.66.142.238:445
    mssecsvc.exe
    52 B
    1
  • 10.127.122.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.119.1:445
    mssecsvc.exe
    52 B
    1
  • 10.202.6.162:445
    mssecsvc.exe
    52 B
    1
  • 10.127.124.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.125.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.123.1:445
    mssecsvc.exe
    52 B
    1
  • 115.142.155.64:445
    mssecsvc.exe
    52 B
    1
  • 10.127.129.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.128.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.126.1:445
    mssecsvc.exe
    52 B
    1
  • 174.172.17.157:445
    mssecsvc.exe
    52 B
    1
  • 10.127.127.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.131.1:445
    mssecsvc.exe
    52 B
    1
  • 169.99.6.16:445
    mssecsvc.exe
    52 B
    1
  • 45.185.3.32:445
    mssecsvc.exe
    52 B
    1
  • 10.127.130.1:445
    mssecsvc.exe
    52 B
    1
  • 90.101.22.129:445
    mssecsvc.exe
    52 B
    1
  • 83.128.113.197:445
    mssecsvc.exe
    52 B
    1
  • 172.103.21.215:445
    mssecsvc.exe
    52 B
    1
  • 10.127.132.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.133.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.136.1:445
    mssecsvc.exe
    52 B
    1
  • 58.144.102.76:445
    mssecsvc.exe
    52 B
    1
  • 10.127.134.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.137.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.139.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.140.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.135.1:445
    mssecsvc.exe
    52 B
    1
  • 168.55.133.90:445
    mssecsvc.exe
    52 B
    1
  • 37.192.143.3:445
    mssecsvc.exe
    52 B
    1
  • 10.127.142.1:445
    mssecsvc.exe
    52 B
    1
  • 66.66.22.88:445
    mssecsvc.exe
    52 B
    1
  • 60.61.63.205:445
    mssecsvc.exe
    52 B
    1
  • 10.127.138.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.141.1:445
    mssecsvc.exe
    52 B
    1
  • 78.236.112.248:445
    mssecsvc.exe
    52 B
    1
  • 155.140.27.2:445
    mssecsvc.exe
    52 B
    1
  • 10.127.143.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.145.1:445
    mssecsvc.exe
    52 B
    1
  • 57.102.100.143:445
    mssecsvc.exe
    52 B
    1
  • 10.127.146.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.144.1:445
    mssecsvc.exe
    52 B
    1
  • 111.171.49.210:445
    mssecsvc.exe
    52 B
    1
  • 10.127.150.1:445
    mssecsvc.exe
    52 B
    1
  • 148.210.243.199:445
    mssecsvc.exe
    52 B
    1
  • 28.61.251.170:445
    mssecsvc.exe
    52 B
    1
  • 10.127.147.1:445
    mssecsvc.exe
    52 B
    1
  • 1.152.202.91:445
    mssecsvc.exe
    52 B
    1
  • 52.243.235.220:445
    mssecsvc.exe
    52 B
    1
  • 10.127.149.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.153.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.155.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.148.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.151.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.152.1:445
    mssecsvc.exe
    52 B
    1
  • 52.240.87.61:445
    mssecsvc.exe
    52 B
    1
  • 23.234.29.240:445
    mssecsvc.exe
    52 B
    1
  • 10.127.157.1:445
    mssecsvc.exe
    52 B
    1
  • 34.100.174.120:445
    mssecsvc.exe
    52 B
    1
  • 10.127.154.1:445
    mssecsvc.exe
    52 B
    1
  • 182.135.48.9:445
    mssecsvc.exe
    52 B
    1
  • 10.127.156.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.158.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.159.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.160.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.161.1:445
    mssecsvc.exe
    52 B
    1
  • 29.13.177.228:445
    mssecsvc.exe
    52 B
    1
  • 10.127.162.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.163.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.164.1:445
    mssecsvc.exe
    52 B
    1
  • 47.18.222.90:445
    mssecsvc.exe
    52 B
    1
  • 181.217.67.100:445
    mssecsvc.exe
    52 B
    1
  • 10.127.165.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.166.1:445
    mssecsvc.exe
    52 B
    1
  • 22.191.150.6:445
    mssecsvc.exe
    52 B
    1
  • 2.212.77.58:445
    mssecsvc.exe
    52 B
    1
  • 10.127.167.1:445
    mssecsvc.exe
    52 B
    1
  • 178.124.223.166:445
    mssecsvc.exe
    52 B
    1
  • 203.244.16.186:445
    mssecsvc.exe
    52 B
    1
  • 10.127.168.1:445
    mssecsvc.exe
    52 B
    1
  • 74.91.182.93:445
    mssecsvc.exe
    52 B
    1
  • 10.127.170.1:445
    mssecsvc.exe
    52 B
    1
  • 147.122.189.169:445
    mssecsvc.exe
    52 B
    1
  • 162.231.204.35:445
    mssecsvc.exe
    52 B
    1
  • 35.59.154.153:445
    mssecsvc.exe
    52 B
    1
  • 10.127.175.1:445
    mssecsvc.exe
    52 B
    1
  • 201.13.3.143:445
    mssecsvc.exe
    52 B
    1
  • 10.127.172.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.169.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.173.1:445
    mssecsvc.exe
    52 B
    1
  • 125.143.132.230:445
    mssecsvc.exe
    52 B
    1
  • 14.108.28.0:445
    mssecsvc.exe
    52 B
    1
  • 10.127.171.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.177.1:445
    mssecsvc.exe
    52 B
    1
  • 50.118.50.104:445
    mssecsvc.exe
    52 B
    1
  • 54.218.73.25:445
    mssecsvc.exe
    52 B
    1
  • 10.127.174.1:445
    mssecsvc.exe
    52 B
    1
  • 218.156.53.114:445
    mssecsvc.exe
    52 B
    1
  • 188.43.218.219:445
    mssecsvc.exe
    52 B
    1
  • 10.127.176.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.178.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.179.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.180.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.181.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.182.1:445
    mssecsvc.exe
    52 B
    1
  • 2.180.90.226:445
    mssecsvc.exe
    52 B
    1
  • 10.127.183.1:445
    mssecsvc.exe
    52 B
    1
  • 62.198.170.66:445
    mssecsvc.exe
    52 B
    1
  • 10.127.184.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.185.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.186.1:445
    mssecsvc.exe
    52 B
    1
  • 208.229.65.226:445
    mssecsvc.exe
    52 B
    1
  • 107.246.48.126:445
    mssecsvc.exe
    52 B
    1
  • 10.127.187.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.188.1:445
    mssecsvc.exe
    52 B
    1
  • 111.79.253.57:445
    mssecsvc.exe
    52 B
    1
  • 28.245.121.215:445
    mssecsvc.exe
    52 B
    1
  • 181.207.137.149:445
    mssecsvc.exe
    52 B
    1
  • 57.147.167.53:445
    mssecsvc.exe
    52 B
    1
  • 92.128.69.150:445
    mssecsvc.exe
    52 B
    1
  • 160.155.38.171:445
    mssecsvc.exe
    52 B
    1
  • 10.127.190.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.191.1:445
    mssecsvc.exe
    52 B
    1
  • 124.219.118.141:445
    mssecsvc.exe
    52 B
    1
  • 10.127.189.1:445
    mssecsvc.exe
    52 B
    1
  • 115.247.171.249:445
    mssecsvc.exe
    52 B
    1
  • 206.191.102.121:445
    mssecsvc.exe
    52 B
    1
  • 105.241.85.215:445
    mssecsvc.exe
    52 B
    1
  • 10.127.193.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.195.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.198.1:445
    mssecsvc.exe
    52 B
    1
  • 200.39.122.169:445
    mssecsvc.exe
    52 B
    1
  • 10.127.196.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.199.1:445
    mssecsvc.exe
    52 B
    1
  • 194.139.218.113:445
    mssecsvc.exe
    52 B
    1
  • 10.127.192.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.194.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.197.1:445
    mssecsvc.exe
    52 B
    1
  • 204.116.241.29:445
    mssecsvc.exe
    52 B
    1
  • 16.84.66.109:445
    mssecsvc.exe
    52 B
    1
  • 10.127.200.1:445
    mssecsvc.exe
    52 B
    1
  • 8.11.47.88:445
    mssecsvc.exe
    52 B
    1
  • 10.127.201.1:445
    mssecsvc.exe
    52 B
    1
  • 21.9.69.206:445
    mssecsvc.exe
    52 B
    1
  • 49.188.216.219:445
    mssecsvc.exe
    52 B
    1
  • 10.127.202.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.203.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.204.1:445
    mssecsvc.exe
    52 B
    1
  • 120.98.191.228:445
    mssecsvc.exe
    52 B
    1
  • 83.68.84.239:445
    mssecsvc.exe
    52 B
    1
  • 60.120.131.227:445
    mssecsvc.exe
    104 B
    80 B
    2
    2
  • 56.154.163.52:445
    mssecsvc.exe
    52 B
    1
  • 10.127.205.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.207.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.206.1:445
    mssecsvc.exe
    52 B
    1
  • 192.221.49.120:445
    mssecsvc.exe
    52 B
    1
  • 219.68.144.197:445
    mssecsvc.exe
    52 B
    1
  • 10.127.210.1:445
    mssecsvc.exe
    52 B
    1
  • 174.50.65.52:445
    mssecsvc.exe
    52 B
    1
  • 183.57.196.9:445
    mssecsvc.exe
    52 B
    1
  • 96.144.95.117:445
    mssecsvc.exe
    52 B
    1
  • 10.127.211.1:445
    mssecsvc.exe
    52 B
    1
  • 201.164.97.98:445
    mssecsvc.exe
    52 B
    1
  • 10.127.208.1:445
    mssecsvc.exe
    52 B
    1
  • 97.191.5.64:445
    mssecsvc.exe
    52 B
    1
  • 10.127.209.1:445
    mssecsvc.exe
    52 B
    1
  • 216.145.102.37:445
    mssecsvc.exe
    104 B
    80 B
    2
    2
  • 69.114.79.20:445
    mssecsvc.exe
    52 B
    1
  • 10.127.213.1:445
    mssecsvc.exe
    52 B
    1
  • 119.3.100.249:445
    mssecsvc.exe
    52 B
    1
  • 77.99.112.201:445
    mssecsvc.exe
    52 B
    1
  • 10.127.216.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.219.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.215.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.214.1:445
    mssecsvc.exe
    52 B
    1
  • 83.198.30.251:445
    mssecsvc.exe
    52 B
    1
  • 10.127.212.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.217.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.218.1:445
    mssecsvc.exe
    52 B
    1
  • 97.108.12.105:445
    mssecsvc.exe
    52 B
    1
  • 3.47.189.126:445
    mssecsvc.exe
    52 B
    1
  • 10.127.220.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.221.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.222.1:445
    mssecsvc.exe
    52 B
    1
  • 94.122.179.71:445
    mssecsvc.exe
    52 B
    1
  • 19.17.168.85:445
    mssecsvc.exe
    52 B
    1
  • 22.89.228.64:445
    mssecsvc.exe
    52 B
    1
  • 10.127.223.1:445
    mssecsvc.exe
    52 B
    1
  • 49.178.163.176:445
    mssecsvc.exe
    52 B
    1
  • 153.123.93.238:445
    mssecsvc.exe
    52 B
    1
  • 10.127.224.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.225.1:445
    mssecsvc.exe
    52 B
    1
  • 179.186.195.205:445
    mssecsvc.exe
    52 B
    1
  • 100.23.10.152:445
    mssecsvc.exe
    52 B
    1
  • 159.42.169.97:445
    mssecsvc.exe
    52 B
    1
  • 212.136.51.173:445
    mssecsvc.exe
    52 B
    1
  • 10.127.231.1:445
    mssecsvc.exe
    52 B
    1
  • 160.222.186.30:445
    mssecsvc.exe
    52 B
    1
  • 129.1.240.50:445
    mssecsvc.exe
    52 B
    1
  • 145.2.200.144:445
    mssecsvc.exe
    52 B
    1
  • 177.227.211.254:445
    mssecsvc.exe
    52 B
    1
  • 10.127.226.1:445
    mssecsvc.exe
    52 B
    1
  • 209.59.100.54:445
    mssecsvc.exe
    104 B
    80 B
    2
    2
  • 10.127.233.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.229.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.230.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.227.1:445
    mssecsvc.exe
    52 B
    1
  • 19.222.141.118:445
    mssecsvc.exe
    52 B
    1
  • 10.127.235.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.228.1:445
    mssecsvc.exe
    52 B
    1
  • 192.221.115.7:445
    mssecsvc.exe
    52 B
    1
  • 10.127.234.1:445
    mssecsvc.exe
    52 B
    1
  • 169.147.5.50:445
    mssecsvc.exe
    52 B
    1
  • 10.127.232.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.237.1:445
    mssecsvc.exe
    52 B
    1
  • 13.73.252.9:445
    mssecsvc.exe
    52 B
    1
  • 104.153.155.10:445
    mssecsvc.exe
    52 B
    1
  • 123.173.0.228:445
    mssecsvc.exe
    52 B
    1
  • 58.21.23.0:445
    mssecsvc.exe
    52 B
    1
  • 173.127.5.92:445
    mssecsvc.exe
    52 B
    1
  • 10.127.236.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.238.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.239.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.240.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.241.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.242.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.243.1:445
    mssecsvc.exe
    52 B
    1
  • 58.169.71.176:445
    mssecsvc.exe
    52 B
    1
  • 122.178.141.47:445
    mssecsvc.exe
    52 B
    1
  • 10.127.244.1:445
    mssecsvc.exe
    52 B
    1
  • 219.154.202.198:445
    mssecsvc.exe
    52 B
    1
  • 210.160.225.183:445
    mssecsvc.exe
    52 B
    1
  • 10.127.245.1:445
    mssecsvc.exe
    52 B
    1
  • 44.137.69.7:445
    mssecsvc.exe
    52 B
    1
  • 199.32.24.75:445
    mssecsvc.exe
    52 B
    1
  • 10.127.246.1:445
    mssecsvc.exe
    52 B
    1
  • 133.180.17.222:445
    mssecsvc.exe
    52 B
    1
  • 91.157.88.72:445
    mssecsvc.exe
    52 B
    1
  • 211.179.12.155:445
    mssecsvc.exe
    52 B
    1
  • 15.32.191.197:445
    mssecsvc.exe
    52 B
    1
  • 10.127.247.1:445
    mssecsvc.exe
    52 B
    1
  • 140.71.25.54:445
    mssecsvc.exe
    52 B
    1
  • 101.230.241.194:445
    mssecsvc.exe
    52 B
    1
  • 38.186.133.74:445
    mssecsvc.exe
    52 B
    1
  • 10.127.248.1:445
    mssecsvc.exe
    52 B
    1
  • 33.155.193.135:445
    mssecsvc.exe
    52 B
    1
  • 182.204.37.219:445
    mssecsvc.exe
    52 B
    1
  • 22.120.92.187:445
    mssecsvc.exe
    52 B
    1
  • 10.127.250.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.252.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.0.2:445
    mssecsvc.exe
    52 B
    1
  • 10.127.249.1:445
    mssecsvc.exe
    52 B
    1
  • 9.133.182.145:445
    mssecsvc.exe
    52 B
    1
  • 10.127.254.1:445
    mssecsvc.exe
    52 B
    1
  • 144.162.17.138:445
    mssecsvc.exe
    52 B
    1
  • 22.188.172.95:445
    mssecsvc.exe
    52 B
    1
  • 10.127.251.1:445
    mssecsvc.exe
    52 B
    1
  • 45.4.63.229:445
    mssecsvc.exe
    52 B
    1
  • 194.135.30.23:445
    mssecsvc.exe
    104 B
    80 B
    2
    2
  • 10.127.2.2:445
    mssecsvc.exe
    52 B
    1
  • 10.127.253.1:445
    mssecsvc.exe
    52 B
    1
  • 166.80.23.125:445
    mssecsvc.exe
    52 B
    1
  • 130.155.134.26:445
    mssecsvc.exe
    52 B
    1
  • 10.127.255.1:445
    mssecsvc.exe
    52 B
    1
  • 65.115.43.146:445
    mssecsvc.exe
    52 B
    1
  • 10.127.3.2:445
    mssecsvc.exe
    52 B
    1
  • 10.127.1.2:445
    mssecsvc.exe
    52 B
    1
  • 10.127.4.2:445
    mssecsvc.exe
    52 B
    1
  • 10.127.5.2:445
    mssecsvc.exe
    52 B
    1
  • 10.127.6.2:445
    mssecsvc.exe
    52 B
    1
  • 192.132.117.7:445
    mssecsvc.exe
    52 B
    1
  • 10.127.7.2:445
    mssecsvc.exe
    52 B
    1
  • 38.226.7.209:445
    mssecsvc.exe
    52 B
    1
  • 10.127.8.2:445
    mssecsvc.exe
    52 B
    1
  • 220.177.110.66:445
    mssecsvc.exe
    52 B
    1
  • 10.127.9.2:445
    mssecsvc.exe
    52 B
    1
  • 216.16.83.124:445
    mssecsvc.exe
    52 B
    1
  • 34.38.150.157:445
    mssecsvc.exe
    52 B
    1
  • 10.127.10.2:445
    mssecsvc.exe
    52 B
    1
  • 46.129.89.160:445
    mssecsvc.exe
    52 B
    1
  • 10.127.11.2:445
    mssecsvc.exe
    52 B
    1
  • 18.63.185.102:445
    mssecsvc.exe
    52 B
    1
  • 131.28.216.100:445
    mssecsvc.exe
    52 B
    1
  • 217.171.43.251:445
    mssecsvc.exe
    52 B
    1
  • 193.224.49.42:445
    mssecsvc.exe
    52 B
    1
  • 47.134.220.92:445
    mssecsvc.exe
    52 B
    1
  • 204.192.25.72:445
    mssecsvc.exe
    52 B
    1
  • 220.114.5.92:445
    mssecsvc.exe
    52 B
    1
  • 163.239.51.223:445
    mssecsvc.exe
    52 B
    1
  • 10.127.14.2:445
    mssecsvc.exe
    52 B
    1
  • 134.9.106.49:445
    mssecsvc.exe
    52 B
    1
  • 201.13.34.181:445
    mssecsvc.exe
    52 B
    1
  • 10.127.13.2:445
    mssecsvc.exe
    52 B
    1
  • 194.134.193.122:445
    mssecsvc.exe
    52 B
    1
  • 10.127.16.2:445
    mssecsvc.exe
    52 B
    1
  • 128.167.252.142:445
    mssecsvc.exe
    52 B
    1
  • 47.50.139.2:445
    mssecsvc.exe
    52 B
    1
  • 10.127.12.2:445
    mssecsvc.exe
    52 B
    1
  • 10.127.18.2:445
    mssecsvc.exe
    52 B
    1
  • 201.162.227.82:445
    mssecsvc.exe
    52 B
    1
  • 10.127.20.2:445
    mssecsvc.exe
    52 B
    1
  • 10.127.17.2:445
    mssecsvc.exe
    52 B
    1
  • 164.5.151.192:445
    mssecsvc.exe
    52 B
    1
  • 10.127.15.2:445
    mssecsvc.exe
    52 B
    1
  • 10.127.22.2:445
    mssecsvc.exe
    52 B
    1
  • 14.97.61.145:445
    mssecsvc.exe
    52 B
    1
  • 10.127.19.2:445
    mssecsvc.exe
    52 B
    1
  • 111.56.233.158:445
    mssecsvc.exe
    52 B
    1
  • 10.127.21.2:445
    mssecsvc.exe
    52 B
    1
  • 213.231.76.216:445
    mssecsvc.exe
    52 B
    1
  • 40.124.64.119:445
    mssecsvc.exe
    52 B
    1
  • 199.93.219.229:445
    mssecsvc.exe
    52 B
    1
  • 10.127.24.2:445
    mssecsvc.exe
    52 B
    1
  • 10.127.23.2:445
    mssecsvc.exe
    52 B
    1
  • 10.127.25.2:445
    mssecsvc.exe
    52 B
    1
  • 102.100.148.61:445
    mssecsvc.exe
    52 B
    1
  • 85.145.204.203:445
    mssecsvc.exe
    52 B
    1
  • 10.127.26.2:445
    mssecsvc.exe
    52 B
    1
  • 100.83.134.91:445
    mssecsvc.exe
    52 B
    1
  • 10.127.27.2:445
    mssecsvc.exe
    52 B
    1
  • 10.127.28.2:445
    mssecsvc.exe
    52 B
    1
  • 221.184.67.229:445
    mssecsvc.exe
    52 B
    1
  • 10.127.29.2:445
    mssecsvc.exe
    52 B
    1
  • 217.182.242.32:445
    mssecsvc.exe
    52 B
    1
  • 10.127.30.2:445
    mssecsvc.exe
    52 B
    1
  • 216.37.191.144:445
    mssecsvc.exe
    52 B
    1
  • 10.127.31.2:445
    mssecsvc.exe
    52 B
    1
  • 190.193.250.211:445
    mssecsvc.exe
    52 B
    1
  • 123.222.184.225:445
    mssecsvc.exe
    52 B
    1
  • 109.146.82.235:445
    mssecsvc.exe
    52 B
    1
  • 85.121.197.55:445
    mssecsvc.exe
    52 B
    1
  • 173.44.217.209:445
    mssecsvc.exe
    52 B
    1
  • 8.8.8.8:53
    www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
    dns
    mssecsvc.exe
    95 B
    127 B
    1
    1

    DNS Request

    www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com

    DNS Response

    104.16.166.228
    104.16.167.228

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\mssecsvc.exe

    Filesize

    3.6MB

    MD5

    13ef6033987c39be76b70837347cec3b

    SHA1

    63287b86bcd9486b67beae844742bae5ae17399e

    SHA256

    cf810ce50adb1fa79ad76b2bc0d572d11e5896c2b8ca430d286b06d0e7ca379d

    SHA512

    8cc06baca364ae9e2923938440ab3ffaa3c968b4fd56f9ef000a3177fdf31adbba30f23b9e28bd149181b47ef4c310ac3c49623ac023bb9d479d05905f2abf18

  • C:\Windows\tasksche.exe

    Filesize

    3.4MB

    MD5

    c3c3cf66c0bf945b6033c6a94f78b2c9

    SHA1

    c8371fd0b5a9107eda3cdadd08673c17e02e3ea9

    SHA256

    4276baeb09c9eeecc34530311b806442cba2a9c7d7f2ad2aca3aba1fe8435465

    SHA512

    5082353dbb52bfad84fb20211b0ca209a6f6bae95d76919378d699049bf9f593188ad0c82fc790725a6b85aa007b158ca9ae4f4b307e34ac7182bed8a14424d9

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.