Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26/07/2024, 08:58
Static task
static1
Behavioral task
behavioral1
Sample
b171eaf32d9837fdb6c73c59d1216ff0N.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
b171eaf32d9837fdb6c73c59d1216ff0N.dll
Resource
win10v2004-20240709-en
General
-
Target
b171eaf32d9837fdb6c73c59d1216ff0N.dll
-
Size
5.0MB
-
MD5
b171eaf32d9837fdb6c73c59d1216ff0
-
SHA1
3f2920b4c444c98bdd8eb605b60d6f9c172d9bbc
-
SHA256
e1c622e4f4c8f056a735555bdcfc4d784aac7b87cbde08d879109ff0143ef45a
-
SHA512
3ffa21d45b546f54f8a6de2efe72484404ed7b8d566441fa24f9ab63d89c724e2f7b651c6e9f5cb9cc746ae7fc9a93e77ade5f5a905f79927f80fc84072540ca
-
SSDEEP
6144:TE9l9ynRIYVTH5DgSgNajldktM0XXrO2/HJKyrYev3AiiVjAqZfAgbJ3iqMgAyY:T1bLgmlu//dhAvVLJAmd3A
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (2433) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 3 IoCs
pid Process 4932 mssecsvr.exe 3240 mssecsvr.exe 1300 tasksche.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies mssecsvr.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 mssecsvr.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 mssecsvr.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE mssecsvr.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\WINDOWS\tasksche.exe mssecsvr.exe File created C:\WINDOWS\mssecsvr.exe rundll32.exe -
Program crash 2 IoCs
pid pid_target Process procid_target 3508 1300 WerFault.exe 91 1548 1300 WerFault.exe 91 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasksche.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mssecsvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mssecsvr.exe -
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvr.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1904 wrote to memory of 1464 1904 rundll32.exe 84 PID 1904 wrote to memory of 1464 1904 rundll32.exe 84 PID 1904 wrote to memory of 1464 1904 rundll32.exe 84 PID 1464 wrote to memory of 4932 1464 rundll32.exe 85 PID 1464 wrote to memory of 4932 1464 rundll32.exe 85 PID 1464 wrote to memory of 4932 1464 rundll32.exe 85 PID 4932 wrote to memory of 1300 4932 mssecsvr.exe 91 PID 4932 wrote to memory of 1300 4932 mssecsvr.exe 91 PID 4932 wrote to memory of 1300 4932 mssecsvr.exe 91
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b171eaf32d9837fdb6c73c59d1216ff0N.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b171eaf32d9837fdb6c73c59d1216ff0N.dll,#12⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\WINDOWS\mssecsvr.exeC:\WINDOWS\mssecsvr.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1300 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1300 -s 2245⤵
- Program crash
PID:3508
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1300 -s 2605⤵
- Program crash
PID:1548
-
-
-
-
-
C:\WINDOWS\mssecsvr.exeC:\WINDOWS\mssecsvr.exe -m security1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:3240
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1300 -ip 13001⤵PID:2264
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1300 -ip 13001⤵PID:868
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD56a5adbeaa8b5161671874b27b0c00269
SHA1453912ce5e6c9f0bf360c41c1b8adfbd10ec7473
SHA25665f8acd369c6a98f01849f09c9981cc1a03ff8813d72f4da7e5e32d72e4b5237
SHA51242d762ac33f4c22418a17f2093987e329a55ede43049a7262870477c929beca4297134de30050555fc41677118e0db2d2e7a5a2bdf7af0632405b20d4751c9da
-
Filesize
2.0MB
MD5250ff99090260532ff0acf9da52e8602
SHA1f51193260ef8396caf576c432ddaece649928a6b
SHA256faeebe09f45e15faf27a262ef3780feed5b4c3e885cad37742635fd490d74109
SHA512be5fefd2744a2277b6ac1a24899e6112775e0e48fd7d7868032a7984bb84cbafdb9e628682e21650a5521ba1168ca3686079842b83e2a946f41b47e8dae2b475