Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    21-09-2024 10:18

General

  • Target

    ef94900545e4a455081c70c5e780fecc_JaffaCakes118.dll

  • Size

    5.0MB

  • MD5

    ef94900545e4a455081c70c5e780fecc

  • SHA1

    5767fc1c43a42a3e020c26d4ba76cb33827f782d

  • SHA256

    154f4f786c332668051cf43aa48639129316f418a8576842cf2841984555cf72

  • SHA512

    fa6d27b66206dc57d2b38a544442536159f2b37186a5ee1e7f7517295acbad26c8b1e172689caff28bf16ca3473627c322bcc264b79d03438c2d275dfa72f896

  • SSDEEP

    98304:+DqPoBhz1aRxcSUD/Nj9msGxWa9P593R8yAVp2H:+DqPe1CxcxN9msZadzR8yc4H

Malware Config

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

  • Contacts a large (3336) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Executes dropped EXE 3 IoCs
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 24 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\ef94900545e4a455081c70c5e780fecc_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2640
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\ef94900545e4a455081c70c5e780fecc_JaffaCakes118.dll,#1
      2⤵
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2084
      • C:\WINDOWS\mssecsvc.exe
        C:\WINDOWS\mssecsvc.exe
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:2656
        • C:\WINDOWS\tasksche.exe
          C:\WINDOWS\tasksche.exe /i
          4⤵
          • Executes dropped EXE
          PID:2896
  • C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe -m security
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    PID:2652

Network

  • flag-us
    DNS
    www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
    mssecsvc.exe
    Remote address:
    8.8.8.8:53
    Request
    www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
    IN A
    Response
    www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
    IN A
    104.16.166.228
    www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
    IN A
    104.16.167.228
  • flag-us
    GET
    http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
    mssecsvc.exe
    Remote address:
    104.16.166.228:80
    Request
    GET / HTTP/1.1
    Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Date: Sat, 21 Sep 2024 10:18:44 GMT
    Content-Type: text/html
    Content-Length: 607
    Connection: close
    Server: cloudflare
    CF-RAY: 8c695019fa17952c-LHR
  • flag-us
    GET
    http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
    mssecsvc.exe
    Remote address:
    104.16.166.228:80
    Request
    GET / HTTP/1.1
    Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Date: Sat, 21 Sep 2024 10:18:44 GMT
    Content-Type: text/html
    Content-Length: 607
    Connection: close
    Server: cloudflare
    CF-RAY: 8c69501b5b48368e-LHR
  • 104.16.166.228:80
    http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
    http
    mssecsvc.exe
    422 B
    1.0kB
    7
    6

    HTTP Request

    GET http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/

    HTTP Response

    200
  • 104.16.166.228:80
    http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
    http
    mssecsvc.exe
    330 B
    990 B
    5
    5

    HTTP Request

    GET http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/

    HTTP Response

    200
  • 54.83.86.84:445
    mssecsvc.exe
    52 B
    1
  • 10.127.0.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.1.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.2.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.3.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.4.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.5.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.6.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.7.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.8.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.9.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.10.1:445
    mssecsvc.exe
    52 B
    1
  • 9.100.31.247:445
    mssecsvc.exe
    52 B
    1
  • 10.127.11.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.12.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.13.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.15.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.14.1:445
    mssecsvc.exe
    52 B
    1
  • 156.158.175.51:445
    mssecsvc.exe
    52 B
    1
  • 10.127.18.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.19.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.16.1:445
    mssecsvc.exe
    52 B
    1
  • 72.247.18.14:445
    mssecsvc.exe
    52 B
    1
  • 10.127.17.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.20.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.21.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.22.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.23.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.24.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.25.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.26.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.27.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.28.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.29.1:445
    mssecsvc.exe
    52 B
    1
  • 173.190.166.210:445
    mssecsvc.exe
    52 B
    1
  • 116.176.243.77:445
    mssecsvc.exe
    52 B
    1
  • 10.127.30.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.31.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.33.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.32.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.36.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.34.1:445
    mssecsvc.exe
    52 B
    1
  • 26.162.80.185:445
    mssecsvc.exe
    52 B
    1
  • 10.127.39.1:445
    mssecsvc.exe
    52 B
    1
  • 128.48.105.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.37.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.41.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.35.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.38.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.40.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.42.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.43.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.44.1:445
    mssecsvc.exe
    52 B
    1
  • 202.149.173.41:445
    mssecsvc.exe
    52 B
    1
  • 10.127.45.1:445
    mssecsvc.exe
    52 B
    1
  • 181.208.31.221:445
    mssecsvc.exe
    52 B
    1
  • 10.127.48.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.53.1:445
    mssecsvc.exe
    52 B
    1
  • 155.124.178.77:445
    mssecsvc.exe
    52 B
    1
  • 10.127.51.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.47.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.46.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.50.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.49.1:445
    mssecsvc.exe
    52 B
    1
  • 211.147.84.249:445
    mssecsvc.exe
    52 B
    1
  • 10.127.52.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.54.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.57.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.59.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.61.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.58.1:445
    mssecsvc.exe
    52 B
    1
  • 30.59.238.62:445
    mssecsvc.exe
    52 B
    1
  • 10.127.56.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.55.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.60.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.62.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.63.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.64.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.65.1:445
    mssecsvc.exe
    52 B
    1
  • 222.218.233.170:445
    mssecsvc.exe
    52 B
    1
  • 10.127.66.1:445
    mssecsvc.exe
    52 B
    1
  • 168.190.188.96:445
    mssecsvc.exe
    52 B
    1
  • 10.127.67.1:445
    mssecsvc.exe
    52 B
    1
  • 160.4.218.159:445
    mssecsvc.exe
    52 B
    1
  • 10.127.72.1:445
    mssecsvc.exe
    52 B
    1
  • 45.197.79.131:445
    mssecsvc.exe
    52 B
    1
  • 10.127.68.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.70.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.69.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.71.1:445
    mssecsvc.exe
    52 B
    1
  • 85.168.93.229:445
    mssecsvc.exe
    52 B
    1
  • 10.127.76.1:445
    mssecsvc.exe
    52 B
    1
  • 189.71.231.171:445
    mssecsvc.exe
    52 B
    1
  • 10.127.75.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.73.1:445
    mssecsvc.exe
    52 B
    1
  • 75.3.140.215:445
    mssecsvc.exe
    52 B
    1
  • 10.127.78.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.74.1:445
    mssecsvc.exe
    52 B
    1
  • 32.108.117.184:445
    mssecsvc.exe
    52 B
    1
  • 10.127.80.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.77.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.79.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.81.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.82.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.83.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.84.1:445
    mssecsvc.exe
    52 B
    1
  • 100.141.39.80:445
    mssecsvc.exe
    52 B
    1
  • 10.127.85.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.86.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.87.1:445
    mssecsvc.exe
    52 B
    1
  • 7.53.185.109:445
    mssecsvc.exe
    52 B
    1
  • 180.207.5.119:445
    mssecsvc.exe
    52 B
    1
  • 10.127.88.1:445
    mssecsvc.exe
    52 B
    1
  • 67.234.164.225:445
    mssecsvc.exe
    52 B
    1
  • 208.22.222.57:445
    mssecsvc.exe
    52 B
    1
  • 10.127.91.1:445
    mssecsvc.exe
    52 B
    1
  • 167.229.227.113:445
    mssecsvc.exe
    52 B
    1
  • 10.127.89.1:445
    mssecsvc.exe
    52 B
    1
  • 90.130.233.129:445
    mssecsvc.exe
    52 B
    1
  • 10.127.97.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.95.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.94.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.98.1:445
    mssecsvc.exe
    52 B
    1
  • 136.226.144.178:445
    mssecsvc.exe
    52 B
    1
  • 10.127.90.1:445
    mssecsvc.exe
    52 B
    1
  • 104.145.189.94:445
    mssecsvc.exe
    52 B
    1
  • 10.127.96.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.92.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.99.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.93.1:445
    mssecsvc.exe
    52 B
    1
  • 44.238.43.156:445
    mssecsvc.exe
    52 B
    1
  • 22.83.59.47:445
    mssecsvc.exe
    52 B
    1
  • 10.127.100.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.101.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.102.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.103.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.104.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.105.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.106.1:445
    mssecsvc.exe
    52 B
    1
  • 121.181.146.208:445
    mssecsvc.exe
    52 B
    1
  • 7.44.162.229:445
    mssecsvc.exe
    52 B
    1
  • 10.127.108.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.107.1:445
    mssecsvc.exe
    52 B
    1
  • 201.198.112.0:445
    mssecsvc.exe
    52 B
    1
  • 32.244.164.128:445
    mssecsvc.exe
    52 B
    1
  • 10.127.109.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.110.1:445
    mssecsvc.exe
    52 B
    1
  • 136.78.81.122:445
    mssecsvc.exe
    52 B
    1
  • 176.147.214.87:445
    mssecsvc.exe
    52 B
    1
  • 10.127.111.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.115.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.114.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.112.1:445
    mssecsvc.exe
    52 B
    1
  • 82.38.152.202:445
    mssecsvc.exe
    52 B
    1
  • 112.2.75.17:445
    mssecsvc.exe
    52 B
    1
  • 10.127.120.1:445
    mssecsvc.exe
    52 B
    1
  • 145.223.139.59:445
    mssecsvc.exe
    52 B
    1
  • 10.127.117.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.119.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.116.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.118.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.113.1:445
    mssecsvc.exe
    52 B
    1
  • 48.111.103.83:445
    mssecsvc.exe
    52 B
    1
  • 148.163.91.253:445
    mssecsvc.exe
    52 B
    1
  • 216.79.134.64:445
    mssecsvc.exe
    52 B
    1
  • 10.127.121.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.122.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.123.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.124.1:445
    mssecsvc.exe
    52 B
    1
  • 42.179.196.114:445
    mssecsvc.exe
    52 B
    1
  • 10.127.126.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.125.1:445
    mssecsvc.exe
    52 B
    1
  • 162.212.34.97:445
    mssecsvc.exe
    52 B
    1
  • 194.138.64.52:445
    mssecsvc.exe
    52 B
    1
  • 19.155.247.134:445
    mssecsvc.exe
    52 B
    1
  • 10.127.129.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.127.1:445
    mssecsvc.exe
    52 B
    1
  • 158.219.137.122:445
    mssecsvc.exe
    52 B
    1
  • 175.54.207.182:445
    mssecsvc.exe
    52 B
    1
  • 10.127.128.1:445
    mssecsvc.exe
    52 B
    1
  • 105.52.25.205:445
    mssecsvc.exe
    52 B
    1
  • 10.127.130.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.131.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.132.1:445
    mssecsvc.exe
    52 B
    1
  • 200.24.184.186:445
    mssecsvc.exe
    52 B
    1
  • 10.127.136.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.133.1:445
    mssecsvc.exe
    52 B
    1
  • 130.49.145.68:445
    mssecsvc.exe
    52 B
    1
  • 19.230.53.228:445
    mssecsvc.exe
    52 B
    1
  • 10.127.134.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.135.1:445
    mssecsvc.exe
    52 B
    1
  • 133.143.94.179:445
    mssecsvc.exe
    52 B
    1
  • 108.85.251.234:445
    mssecsvc.exe
    52 B
    1
  • 10.127.138.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.142.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.137.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.141.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.140.1:445
    mssecsvc.exe
    52 B
    1
  • 135.244.61.177:445
    mssecsvc.exe
    52 B
    1
  • 68.119.77.167:445
    mssecsvc.exe
    52 B
    1
  • 10.127.139.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.143.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.144.1:445
    mssecsvc.exe
    52 B
    1
  • 194.251.169.223:445
    mssecsvc.exe
    52 B
    1
  • 82.69.22.177:445
    mssecsvc.exe
    52 B
    1
  • 13.78.253.8:445
    mssecsvc.exe
    52 B
    1
  • 88.106.26.102:445
    mssecsvc.exe
    52 B
    1
  • 10.127.147.1:445
    mssecsvc.exe
    52 B
    1
  • 27.68.99.104:445
    mssecsvc.exe
    52 B
    1
  • 61.110.134.182:445
    mssecsvc.exe
    52 B
    1
  • 10.127.150.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.145.1:445
    mssecsvc.exe
    52 B
    1
  • 141.11.156.251:445
    mssecsvc.exe
    52 B
    1
  • 12.226.82.254:445
    mssecsvc.exe
    52 B
    1
  • 10.127.151.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.154.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.148.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.149.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.152.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.153.1:445
    mssecsvc.exe
    52 B
    1
  • 152.152.148.101:445
    mssecsvc.exe
    52 B
    1
  • 10.127.155.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.146.1:445
    mssecsvc.exe
    52 B
    1
  • 59.122.116.218:445
    mssecsvc.exe
    52 B
    1
  • 97.237.177.111:445
    mssecsvc.exe
    52 B
    1
  • 10.127.157.1:445
    mssecsvc.exe
    52 B
    1
  • 149.19.47.253:445
    mssecsvc.exe
    52 B
    1
  • 129.215.104.107:445
    mssecsvc.exe
    52 B
    1
  • 10.127.158.1:445
    mssecsvc.exe
    52 B
    1
  • 10.183.223.133:445
    mssecsvc.exe
    52 B
    1
  • 10.127.156.1:445
    mssecsvc.exe
    52 B
    1
  • 49.166.37.228:445
    mssecsvc.exe
    52 B
    1
  • 10.127.159.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.160.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.161.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.162.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.163.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.164.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.165.1:445
    mssecsvc.exe
    52 B
    1
  • 202.114.62.59:445
    mssecsvc.exe
    52 B
    1
  • 136.49.91.106:445
    mssecsvc.exe
    52 B
    1
  • 154.78.129.119:445
    mssecsvc.exe
    52 B
    1
  • 31.211.26.240:445
    mssecsvc.exe
    52 B
    1
  • 10.127.166.1:445
    mssecsvc.exe
    52 B
    1
  • 7.0.159.119:445
    mssecsvc.exe
    52 B
    1
  • 23.89.160.17:445
    mssecsvc.exe
    52 B
    1
  • 222.150.208.73:445
    mssecsvc.exe
    52 B
    1
  • 10.127.172.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.168.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.171.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.169.1:445
    mssecsvc.exe
    52 B
    1
  • 64.52.161.201:445
    mssecsvc.exe
    52 B
    1
  • 1.55.117.143:445
    mssecsvc.exe
    52 B
    1
  • 10.127.167.1:445
    mssecsvc.exe
    52 B
    1
  • 45.20.106.213:445
    mssecsvc.exe
    52 B
    1
  • 10.127.173.1:445
    mssecsvc.exe
    52 B
    1
  • 163.143.36.171:445
    mssecsvc.exe
    52 B
    1
  • 10.127.174.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.170.1:445
    mssecsvc.exe
    52 B
    1
  • 158.170.147.95:445
    mssecsvc.exe
    52 B
    1
  • 10.127.175.1:445
    mssecsvc.exe
    52 B
    1
  • 125.6.147.106:445
    mssecsvc.exe
    52 B
    1
  • 43.128.190.141:445
    mssecsvc.exe
    52 B
    1
  • 18.146.24.221:445
    mssecsvc.exe
    52 B
    1
  • 10.127.176.1:445
    mssecsvc.exe
    52 B
    1
  • 86.61.192.152:445
    mssecsvc.exe
    52 B
    1
  • 10.127.177.1:445
    mssecsvc.exe
    52 B
    1
  • 194.213.120.240:445
    mssecsvc.exe
    52 B
    1
  • 10.127.178.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.179.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.180.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.181.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.182.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.183.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.184.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.185.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.186.1:445
    mssecsvc.exe
    52 B
    1
  • 149.65.103.151:445
    mssecsvc.exe
    52 B
    1
  • 184.88.130.219:445
    mssecsvc.exe
    52 B
    1
  • 201.96.80.1:445
    mssecsvc.exe
    52 B
    1
  • 82.115.71.57:445
    mssecsvc.exe
    52 B
    1
  • 10.127.187.1:445
    mssecsvc.exe
    52 B
    1
  • 218.74.239.32:445
    mssecsvc.exe
    52 B
    1
  • 161.107.88.174:445
    mssecsvc.exe
    52 B
    1
  • 41.66.189.202:445
    mssecsvc.exe
    52 B
    1
  • 10.127.189.1:445
    mssecsvc.exe
    52 B
    1
  • 96.59.34.100:445
    mssecsvc.exe
    52 B
    1
  • 10.127.192.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.190.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.191.1:445
    mssecsvc.exe
    52 B
    1
  • 108.57.77.48:445
    mssecsvc.exe
    52 B
    1
  • 138.66.101.116:445
    mssecsvc.exe
    52 B
    1
  • 10.127.197.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.194.1:445
    mssecsvc.exe
    52 B
    1
  • 145.118.1.139:445
    mssecsvc.exe
    52 B
    1
  • 10.127.188.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.193.1:445
    mssecsvc.exe
    52 B
    1
  • 198.146.2.170:445
    mssecsvc.exe
    52 B
    1
  • 10.127.198.1:445
    mssecsvc.exe
    52 B
    1
  • 134.149.27.98:445
    mssecsvc.exe
    52 B
    1
  • 10.127.195.1:445
    mssecsvc.exe
    52 B
    1
  • 69.47.218.75:445
    mssecsvc.exe
    52 B
    1
  • 10.127.196.1:445
    mssecsvc.exe
    52 B
    1
  • 203.72.43.149:445
    mssecsvc.exe
    52 B
    1
  • 54.174.203.41:445
    mssecsvc.exe
    52 B
    1
  • 10.127.199.1:445
    mssecsvc.exe
    52 B
    1
  • 60.160.223.244:445
    mssecsvc.exe
    52 B
    1
  • 4.22.160.84:445
    mssecsvc.exe
    52 B
    1
  • 10.127.203.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.200.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.201.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.202.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.204.1:445
    mssecsvc.exe
    52 B
    1
  • 7.54.76.41:445
    mssecsvc.exe
    52 B
    1
  • 134.17.224.124:445
    mssecsvc.exe
    52 B
    1
  • 157.96.132.103:445
    mssecsvc.exe
    52 B
    1
  • 163.52.56.185:445
    mssecsvc.exe
    52 B
    1
  • 10.127.208.1:445
    mssecsvc.exe
    52 B
    1
  • 10.92.212.19:445
    mssecsvc.exe
    52 B
    1
  • 10.127.209.1:445
    mssecsvc.exe
    52 B
    1
  • 63.167.220.129:445
    mssecsvc.exe
    52 B
    1
  • 154.165.149.144:445
    mssecsvc.exe
    52 B
    1
  • 45.242.74.26:445
    mssecsvc.exe
    52 B
    1
  • 10.127.206.1:445
    mssecsvc.exe
    52 B
    1
  • 4.108.32.76:445
    mssecsvc.exe
    52 B
    1
  • 10.127.205.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.210.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.211.1:445
    mssecsvc.exe
    52 B
    1
  • 157.213.150.233:445
    mssecsvc.exe
    52 B
    1
  • 10.127.207.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.212.1:445
    mssecsvc.exe
    52 B
    1
  • 220.10.200.227:445
    mssecsvc.exe
    52 B
    1
  • 10.127.213.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.214.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.215.1:445
    mssecsvc.exe
    52 B
    1
  • 113.154.66.217:445
    mssecsvc.exe
    52 B
    1
  • 10.127.216.1:445
    mssecsvc.exe
    52 B
    1
  • 83.107.90.94:445
    mssecsvc.exe
    52 B
    1
  • 10.127.217.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.218.1:445
    mssecsvc.exe
    52 B
    1
  • 51.129.74.219:445
    mssecsvc.exe
    52 B
    1
  • 10.127.219.1:445
    mssecsvc.exe
    52 B
    1
  • 2.136.45.28:445
    mssecsvc.exe
    52 B
    1
  • 10.127.220.1:445
    mssecsvc.exe
    52 B
    1
  • 41.141.27.239:445
    mssecsvc.exe
    52 B
    1
  • 160.81.201.16:445
    mssecsvc.exe
    52 B
    1
  • 197.175.251.173:445
    mssecsvc.exe
    52 B
    1
  • 44.58.161.137:445
    mssecsvc.exe
    52 B
    1
  • 108.221.59.201:445
    mssecsvc.exe
    52 B
    1
  • 10.127.221.1:445
    mssecsvc.exe
    52 B
    1
  • 199.147.238.0:445
    mssecsvc.exe
    52 B
    1
  • 10.127.222.1:445
    mssecsvc.exe
    52 B
    1
  • 152.71.241.242:445
    mssecsvc.exe
    52 B
    1
  • 172.3.156.173:445
    mssecsvc.exe
    52 B
    1
  • 149.141.136.134:445
    mssecsvc.exe
    52 B
    1
  • 60.248.194.42:445
    mssecsvc.exe
    52 B
    1
  • 69.39.149.25:445
    mssecsvc.exe
    52 B
    1
  • 10.127.227.1:445
    mssecsvc.exe
    52 B
    1
  • 1.61.208.2:445
    mssecsvc.exe
    52 B
    1
  • 61.98.206.74:445
    mssecsvc.exe
    52 B
    1
  • 10.127.228.1:445
    mssecsvc.exe
    52 B
    1
  • 71.77.80.125:445
    mssecsvc.exe
    52 B
    1
  • 10.127.229.1:445
    mssecsvc.exe
    52 B
    1
  • 217.156.115.185:445
    mssecsvc.exe
    52 B
    1
  • 16.69.0.141:445
    mssecsvc.exe
    52 B
    1
  • 10.127.231.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.223.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.226.1:445
    mssecsvc.exe
    52 B
    1
  • 16.178.248.164:445
    mssecsvc.exe
    52 B
    1
  • 154.30.46.240:445
    mssecsvc.exe
    52 B
    1
  • 10.127.224.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.225.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.230.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.232.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.233.1:445
    mssecsvc.exe
    52 B
    1
  • 99.124.244.180:445
    mssecsvc.exe
    52 B
    1
  • 10.127.234.1:445
    mssecsvc.exe
    52 B
    1
  • 206.232.174.53:445
    mssecsvc.exe
    52 B
    1
  • 10.127.235.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.236.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.237.1:445
    mssecsvc.exe
    52 B
    1
  • 124.215.181.157:445
    mssecsvc.exe
    52 B
    1
  • 87.123.245.136:445
    mssecsvc.exe
    52 B
    1
  • 10.127.238.1:445
    mssecsvc.exe
    52 B
    1
  • 169.133.164.13:445
    mssecsvc.exe
    52 B
    1
  • 10.127.239.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.240.1:445
    mssecsvc.exe
    52 B
    1
  • 77.88.230.211:445
    mssecsvc.exe
    52 B
    1
  • 10.127.241.1:445
    mssecsvc.exe
    52 B
    1
  • 186.221.135.151:445
    mssecsvc.exe
    52 B
    1
  • 10.127.242.1:445
    mssecsvc.exe
    52 B
    1
  • 126.37.215.63:445
    mssecsvc.exe
    52 B
    1
  • 158.113.111.92:445
    mssecsvc.exe
    52 B
    1
  • 66.6.127.96:445
    mssecsvc.exe
    52 B
    1
  • 219.108.115.63:445
    mssecsvc.exe
    52 B
    1
  • 222.183.226.126:445
    mssecsvc.exe
    52 B
    1
  • 10.127.243.1:445
    mssecsvc.exe
    52 B
    1
  • 11.147.49.187:445
    mssecsvc.exe
    52 B
    1
  • 20.87.40.55:445
    mssecsvc.exe
    52 B
    1
  • 147.179.15.128:445
    mssecsvc.exe
    52 B
    1
  • 10.127.245.1:445
    mssecsvc.exe
    52 B
    1
  • 38.13.207.116:445
    mssecsvc.exe
    52 B
    1
  • 53.104.112.203:445
    mssecsvc.exe
    52 B
    1
  • 138.9.141.142:445
    mssecsvc.exe
    52 B
    1
  • 10.127.247.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.249.1:445
    mssecsvc.exe
    52 B
    1
  • 129.138.24.215:445
    mssecsvc.exe
    52 B
    1
  • 10.127.244.1:445
    mssecsvc.exe
    52 B
    1
  • 128.108.173.33:445
    mssecsvc.exe
    52 B
    1
  • 10.127.251.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.252.1:445
    mssecsvc.exe
    52 B
    1
  • 30.187.252.194:445
    mssecsvc.exe
    52 B
    1
  • 10.127.246.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.250.1:445
    mssecsvc.exe
    52 B
    1
  • 193.192.137.83:445
    mssecsvc.exe
    52 B
    1
  • 116.139.83.129:445
    mssecsvc.exe
    52 B
    1
  • 122.57.189.239:445
    mssecsvc.exe
    52 B
    1
  • 10.127.248.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.253.1:445
    mssecsvc.exe
    52 B
    1
  • 2.40.245.141:445
    mssecsvc.exe
    52 B
    1
  • 10.127.254.1:445
    mssecsvc.exe
    52 B
    1
  • 27.106.200.87:445
    mssecsvc.exe
    52 B
    1
  • 10.127.255.1:445
    mssecsvc.exe
    52 B
    1
  • 102.129.8.197:445
    mssecsvc.exe
    52 B
    1
  • 54.128.184.192:445
    mssecsvc.exe
    52 B
    1
  • 10.127.0.2:445
    mssecsvc.exe
    52 B
    1
  • 142.232.167.76:445
    mssecsvc.exe
    52 B
    1
  • 10.127.1.2:445
    mssecsvc.exe
    52 B
    1
  • 10.127.2.2:445
    mssecsvc.exe
    52 B
    1
  • 18.229.158.220:445
    mssecsvc.exe
    52 B
    1
  • 10.127.3.2:445
    mssecsvc.exe
    52 B
    1
  • 92.53.69.99:445
    mssecsvc.exe
    52 B
    1
  • 10.127.4.2:445
    mssecsvc.exe
    52 B
    1
  • 153.19.104.235:445
    mssecsvc.exe
    52 B
    1
  • 10.127.5.2:445
    mssecsvc.exe
    52 B
    1
  • 10.127.6.2:445
    mssecsvc.exe
    52 B
    1
  • 189.71.165.0:445
    mssecsvc.exe
    52 B
    1
  • 10.127.7.2:445
    mssecsvc.exe
    52 B
    1
  • 58.171.137.201:445
    mssecsvc.exe
    52 B
    1
  • 10.127.8.2:445
    mssecsvc.exe
    52 B
    1
  • 78.77.185.90:445
    mssecsvc.exe
    52 B
    1
  • 223.239.129.176:445
    mssecsvc.exe
    52 B
    1
  • 173.240.216.25:445
    mssecsvc.exe
    52 B
    1
  • 110.44.35.237:445
    mssecsvc.exe
    52 B
    1
  • 19.178.164.253:445
    mssecsvc.exe
    52 B
    1
  • 145.216.231.213:445
    mssecsvc.exe
    52 B
    1
  • 10.127.9.2:445
    mssecsvc.exe
    52 B
    1
  • 146.145.205.141:445
    mssecsvc.exe
    52 B
    1
  • 71.162.160.31:445
    mssecsvc.exe
    52 B
    1
  • 10.127.11.2:445
    mssecsvc.exe
    52 B
    1
  • 18.137.160.57:445
    mssecsvc.exe
    52 B
    1
  • 54.72.78.130:445
    mssecsvc.exe
    52 B
    1
  • 109.63.95.174:445
    mssecsvc.exe
    52 B
    1
  • 160.78.146.171:445
    mssecsvc.exe
    52 B
    1
  • 10.127.13.2:445
    mssecsvc.exe
    52 B
    1
  • 10.127.12.2:445
    mssecsvc.exe
    52 B
    1
  • 65.229.108.145:445
    mssecsvc.exe
    52 B
    1
  • 203.76.12.241:445
    mssecsvc.exe
    52 B
    1
  • 10.127.18.2:445
    mssecsvc.exe
    52 B
    1
  • 175.7.247.218:445
    mssecsvc.exe
    52 B
    1
  • 10.127.15.2:445
    mssecsvc.exe
    52 B
    1
  • 10.127.10.2:445
    mssecsvc.exe
    52 B
    1
  • 10.127.14.2:445
    mssecsvc.exe
    52 B
    1
  • 10.127.16.2:445
    mssecsvc.exe
    52 B
    1
  • 10.127.17.2:445
    mssecsvc.exe
    52 B
    1
  • 10.127.19.2:445
    mssecsvc.exe
    52 B
    1
  • 187.89.72.245:445
    mssecsvc.exe
    52 B
    1
  • 222.111.241.64:445
    mssecsvc.exe
    52 B
    1
  • 40.177.204.83:445
    mssecsvc.exe
    52 B
    1
  • 12.188.242.132:445
    mssecsvc.exe
    52 B
    1
  • 116.3.63.63:445
    mssecsvc.exe
    52 B
    1
  • 10.127.20.2:445
    mssecsvc.exe
    52 B
    1
  • 135.172.15.218:445
    mssecsvc.exe
    52 B
    1
  • 10.127.21.2:445
    mssecsvc.exe
    52 B
    1
  • 220.53.157.241:445
    mssecsvc.exe
    52 B
    1
  • 208.188.113.69:445
    mssecsvc.exe
    52 B
    1
  • 10.127.22.2:445
    mssecsvc.exe
    52 B
    1
  • 5.147.223.121:445
    mssecsvc.exe
    52 B
    1
  • 10.127.23.2:445
    mssecsvc.exe
    52 B
    1
  • 10.127.24.2:445
    mssecsvc.exe
    52 B
    1
  • 213.70.67.101:445
    mssecsvc.exe
    52 B
    1
  • 10.127.25.2:445
    mssecsvc.exe
    52 B
    1
  • 113.56.251.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.26.2:445
    mssecsvc.exe
    52 B
    1
  • 68.170.109.199:445
    mssecsvc.exe
    52 B
    1
  • 10.127.27.2:445
    mssecsvc.exe
    52 B
    1
  • 23.4.11.171:445
    mssecsvc.exe
    52 B
    1
  • 109.207.242.66:445
    mssecsvc.exe
    52 B
    1
  • 178.37.66.142:445
    mssecsvc.exe
    52 B
    1
  • 10.127.28.2:445
    mssecsvc.exe
    52 B
    1
  • 155.21.34.171:445
    mssecsvc.exe
    52 B
    1
  • 159.103.188.243:445
    mssecsvc.exe
    52 B
    1
  • 10.127.30.2:445
    mssecsvc.exe
    52 B
    1
  • 223.23.221.145:445
    mssecsvc.exe
    52 B
    1
  • 93.43.109.225:445
    mssecsvc.exe
    104 B
    80 B
    2
    2
  • 134.254.172.189:445
    mssecsvc.exe
    52 B
    1
  • 114.156.249.62:445
    mssecsvc.exe
    52 B
    1
  • 8.8.8.8:53
    www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
    dns
    mssecsvc.exe
    95 B
    127 B
    1
    1

    DNS Request

    www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com

    DNS Response

    104.16.166.228
    104.16.167.228

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\mssecsvc.exe

    Filesize

    3.6MB

    MD5

    a2813ecbc617827612128847085db806

    SHA1

    643e4cb025b8fb6b6e7d8d3bed44294ccdc09e13

    SHA256

    260739932a53cc3ea15c458c545f2b09ef7880379ef111c5626f58f72df8b364

    SHA512

    02e907596f07e863226f1b4f657ec782f617dd41bf88ae995d64630108b2f855ac65b7f57a122bd736ecffb4537d324de74f48bd047a3933dc43f6e6375f29a8

  • C:\Windows\tasksche.exe

    Filesize

    3.4MB

    MD5

    9a23902978100b37fc7e286c43dde290

    SHA1

    77484b1b1680088f530f056eee2f1c287cd0dc2f

    SHA256

    eb57e1a987cfd6f90c6f23fa5d44f6f83c104370e5cef61f630ad4a3135b6571

    SHA512

    a6efe7798214fad1878c6ec5ea4dd9f6a145fa356dbcd807968f4755c933eb2d35c7e14e03e360c98dc9e2ee0ecacb58de2131d282a67bf6e252a7f13a4e4ee5

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.