Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    16/12/2024, 19:28 UTC

General

  • Target

    96dd34bd8af12ac28cb598988f67351ca47502d1b4a16c98066baa2191eb77afN.dll

  • Size

    5.0MB

  • MD5

    3dfde3406cf80d5438a3b33f73228530

  • SHA1

    4e410acd074c2d35e9e90212e72c2a1610e32851

  • SHA256

    96dd34bd8af12ac28cb598988f67351ca47502d1b4a16c98066baa2191eb77af

  • SHA512

    cc140074faab7a6c1e5e6a441278852f5c0aded1ca406b9832516d12291ec7acbd87ff797eb36f30070704bcbdaff1a9d9241854095a86ecf0f8cf0dbdc04118

  • SSDEEP

    98304:+DqPoBhz1aRxcSUDk36SAEdhb3R8yAVp2H:+DqPe1Cxcxk3ZAEHR8yc4H

Malware Config

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

  • Wannacry family
  • Contacts a large (2474) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Executes dropped EXE 3 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 24 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\96dd34bd8af12ac28cb598988f67351ca47502d1b4a16c98066baa2191eb77afN.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2172
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\96dd34bd8af12ac28cb598988f67351ca47502d1b4a16c98066baa2191eb77afN.dll,#1
      2⤵
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2212
      • C:\WINDOWS\mssecsvc.exe
        C:\WINDOWS\mssecsvc.exe
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:2104
        • C:\WINDOWS\tasksche.exe
          C:\WINDOWS\tasksche.exe /i
          4⤵
          • Executes dropped EXE
          PID:2740
  • C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe -m security
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    PID:864

Network

  • flag-us
    DNS
    www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
    mssecsvc.exe
    Remote address:
    8.8.8.8:53
    Request
    www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
    IN A
    Response
    www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
    IN A
    104.16.166.228
    www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
    IN A
    104.16.167.228
  • flag-us
    GET
    http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
    mssecsvc.exe
    Remote address:
    104.16.166.228:80
    Request
    GET / HTTP/1.1
    Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Date: Mon, 16 Dec 2024 19:28:36 GMT
    Content-Type: text/html
    Content-Length: 607
    Connection: close
    Server: cloudflare
    CF-RAY: 8f3113d69a4c9496-LHR
  • flag-us
    GET
    http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
    mssecsvc.exe
    Remote address:
    104.16.166.228:80
    Request
    GET / HTTP/1.1
    Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Date: Mon, 16 Dec 2024 19:28:37 GMT
    Content-Type: text/html
    Content-Length: 607
    Connection: close
    Server: cloudflare
    CF-RAY: 8f3113d838666402-LHR
  • 104.16.166.228:80
    http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
    http
    mssecsvc.exe
    330 B
    990 B
    5
    5

    HTTP Request

    GET http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/

    HTTP Response

    200
  • 104.16.166.228:80
    http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
    http
    mssecsvc.exe
    330 B
    990 B
    5
    5

    HTTP Request

    GET http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/

    HTTP Response

    200
  • 133.117.153.219:445
    mssecsvc.exe
    52 B
    1
  • 10.127.0.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.1.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.2.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.3.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.4.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.5.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.6.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.7.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.8.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.9.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.10.1:445
    mssecsvc.exe
    52 B
    1
  • 121.73.254.195:445
    mssecsvc.exe
    52 B
    1
  • 10.127.14.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.16.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.18.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.12.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.11.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.15.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.17.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.13.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.21.1:445
    mssecsvc.exe
    52 B
    1
  • 59.137.80.152:445
    mssecsvc.exe
    52 B
    1
  • 121.159.99.49:445
    mssecsvc.exe
    52 B
    1
  • 10.127.19.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.20.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.22.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.23.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.24.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.25.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.26.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.27.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.28.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.29.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.30.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.32.1:445
    mssecsvc.exe
    52 B
    1
  • 145.9.10.138:445
    mssecsvc.exe
    52 B
    1
  • 115.82.36.146:445
    mssecsvc.exe
    52 B
    1
  • 10.127.31.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.35.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.40.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.41.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.33.1:445
    mssecsvc.exe
    52 B
    1
  • 72.56.29.174:445
    mssecsvc.exe
    52 B
    1
  • 10.127.34.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.38.1:445
    mssecsvc.exe
    52 B
    1
  • 23.121.209.89:445
    mssecsvc.exe
    52 B
    1
  • 10.127.37.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.36.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.39.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.42.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.43.1:445
    mssecsvc.exe
    52 B
    1
  • 178.210.17.227:445
    mssecsvc.exe
    52 B
    1
  • 10.127.44.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.45.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.46.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.47.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.48.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.52.1:445
    mssecsvc.exe
    52 B
    1
  • 170.209.113.11:445
    mssecsvc.exe
    52 B
    1
  • 10.127.51.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.50.1:445
    mssecsvc.exe
    52 B
    1
  • 162.103.89.80:445
    mssecsvc.exe
    52 B
    1
  • 10.127.53.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.49.1:445
    mssecsvc.exe
    52 B
    1
  • 63.234.214.127:445
    mssecsvc.exe
    52 B
    1
  • 10.127.54.1:445
    mssecsvc.exe
    52 B
    1
  • 23.59.87.50:445
    mssecsvc.exe
    52 B
    1
  • 10.127.58.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.59.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.61.1:445
    mssecsvc.exe
    52 B
    1
  • 105.40.168.115:445
    mssecsvc.exe
    52 B
    1
  • 10.127.55.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.56.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.57.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.60.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.62.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.63.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.64.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.65.1:445
    mssecsvc.exe
    52 B
    1
  • 132.168.78.173:445
    mssecsvc.exe
    52 B
    1
  • 217.48.204.224:445
    mssecsvc.exe
    52 B
    1
  • 10.127.66.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.67.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.68.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.70.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.71.1:445
    mssecsvc.exe
    52 B
    1
  • 40.196.239.225:445
    mssecsvc.exe
    52 B
    1
  • 10.127.69.1:445
    mssecsvc.exe
    52 B
    1
  • 119.68.168.219:445
    mssecsvc.exe
    52 B
    1
  • 10.127.74.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.72.1:445
    mssecsvc.exe
    52 B
    1
  • 150.250.119.103:445
    mssecsvc.exe
    52 B
    1
  • 10.127.75.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.73.1:445
    mssecsvc.exe
    52 B
    1
  • 128.94.105.153:445
    mssecsvc.exe
    52 B
    1
  • 10.127.79.1:445
    mssecsvc.exe
    52 B
    1
  • 23.88.222.190:445
    mssecsvc.exe
    52 B
    1
  • 10.127.76.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.77.1:445
    mssecsvc.exe
    52 B
    1
  • 192.252.144.244:445
    mssecsvc.exe
    52 B
    1
  • 10.127.78.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.80.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.81.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.82.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.83.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.84.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.85.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.86.1:445
    mssecsvc.exe
    52 B
    1
  • 70.229.200.231:445
    mssecsvc.exe
    52 B
    1
  • 10.127.87.1:445
    mssecsvc.exe
    52 B
    1
  • 102.195.21.3:445
    mssecsvc.exe
    52 B
    1
  • 10.127.88.1:445
    mssecsvc.exe
    52 B
    1
  • 104.242.128.84:445
    mssecsvc.exe
    52 B
    1
  • 10.127.89.1:445
    mssecsvc.exe
    52 B
    1
  • 88.193.156.199:445
    mssecsvc.exe
    104 B
    80 B
    2
    2
  • 10.127.92.1:445
    mssecsvc.exe
    52 B
    1
  • 131.73.91.82:445
    mssecsvc.exe
    52 B
    1
  • 10.127.90.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.94.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.91.1:445
    mssecsvc.exe
    52 B
    1
  • 204.102.44.140:445
    mssecsvc.exe
    52 B
    1
  • 10.127.98.1:445
    mssecsvc.exe
    52 B
    1
  • 25.118.48.231:445
    mssecsvc.exe
    52 B
    1
  • 10.127.95.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.93.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.97.1:445
    mssecsvc.exe
    52 B
    1
  • 74.39.51.165:445
    mssecsvc.exe
    52 B
    1
  • 148.90.74.122:445
    mssecsvc.exe
    52 B
    1
  • 10.127.96.1:445
    mssecsvc.exe
    52 B
    1
  • 22.192.102.185:445
    mssecsvc.exe
    52 B
    1
  • 10.127.104.1:445
    mssecsvc.exe
    52 B
    1
  • 26.60.184.206:445
    mssecsvc.exe
    52 B
    1
  • 10.127.99.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.100.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.101.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.102.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.103.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.105.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.106.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.107.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.108.1:445
    mssecsvc.exe
    52 B
    1
  • 58.26.86.109:445
    mssecsvc.exe
    52 B
    1
  • 10.127.109.1:445
    mssecsvc.exe
    52 B
    1
  • 89.233.194.154:445
    mssecsvc.exe
    52 B
    1
  • 76.176.52.46:445
    mssecsvc.exe
    52 B
    1
  • 36.21.144.45:445
    mssecsvc.exe
    52 B
    1
  • 10.127.110.1:445
    mssecsvc.exe
    52 B
    1
  • 9.244.0.217:445
    mssecsvc.exe
    52 B
    1
  • 10.127.113.1:445
    mssecsvc.exe
    52 B
    1
  • 73.181.88.231:445
    mssecsvc.exe
    52 B
    1
  • 10.127.112.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.111.1:445
    mssecsvc.exe
    52 B
    1
  • 33.69.212.236:445
    mssecsvc.exe
    52 B
    1
  • 10.127.115.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.118.1:445
    mssecsvc.exe
    52 B
    1
  • 4.40.174.20:445
    mssecsvc.exe
    52 B
    1
  • 157.27.26.7:445
    mssecsvc.exe
    52 B
    1
  • 10.127.116.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.114.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.120.1:445
    mssecsvc.exe
    52 B
    1
  • 190.32.99.243:445
    mssecsvc.exe
    104 B
    80 B
    2
    2
  • 130.194.57.87:445
    mssecsvc.exe
    52 B
    1
  • 10.127.121.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.117.1:445
    mssecsvc.exe
    52 B
    1
  • 149.183.79.253:445
    mssecsvc.exe
    52 B
    1
  • 10.127.119.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.122.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.123.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.124.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.125.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.126.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.127.1:445
    mssecsvc.exe
    52 B
    1
  • 86.156.5.6:445
    mssecsvc.exe
    52 B
    1
  • 125.139.147.225:445
    mssecsvc.exe
    52 B
    1
  • 10.127.130.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.131.1:445
    mssecsvc.exe
    52 B
    1
  • 148.85.52.145:445
    mssecsvc.exe
    52 B
    1
  • 10.127.132.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.128.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.129.1:445
    mssecsvc.exe
    52 B
    1
  • 30.70.53.132:445
    mssecsvc.exe
    52 B
    1
  • 54.251.174.124:445
    mssecsvc.exe
    52 B
    1
  • 162.75.35.57:445
    mssecsvc.exe
    52 B
    1
  • 124.208.173.17:445
    mssecsvc.exe
    52 B
    1
  • 10.127.133.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.134.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.136.1:445
    mssecsvc.exe
    52 B
    1
  • 184.37.76.145:445
    mssecsvc.exe
    52 B
    1
  • 10.127.137.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.135.1:445
    mssecsvc.exe
    52 B
    1
  • 180.199.104.6:445
    mssecsvc.exe
    52 B
    1
  • 10.127.140.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.138.1:445
    mssecsvc.exe
    52 B
    1
  • 145.135.20.129:445
    mssecsvc.exe
    52 B
    1
  • 107.195.98.204:445
    mssecsvc.exe
    52 B
    1
  • 13.84.41.157:445
    mssecsvc.exe
    52 B
    1
  • 10.127.139.1:445
    mssecsvc.exe
    52 B
    1
  • 90.243.183.177:445
    mssecsvc.exe
    52 B
    1
  • 66.221.47.3:445
    mssecsvc.exe
    52 B
    1
  • 10.127.141.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.142.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.143.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.144.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.145.1:445
    mssecsvc.exe
    52 B
    1
  • 64.128.30.142:445
    mssecsvc.exe
    52 B
    1
  • 10.127.148.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.152.1:445
    mssecsvc.exe
    52 B
    1
  • 6.176.22.226:445
    mssecsvc.exe
    52 B
    1
  • 56.148.191.243:445
    mssecsvc.exe
    52 B
    1
  • 10.127.149.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.150.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.153.1:445
    mssecsvc.exe
    52 B
    1
  • 120.217.63.240:445
    mssecsvc.exe
    52 B
    1
  • 88.43.130.62:445
    mssecsvc.exe
    52 B
    1
  • 95.77.115.174:445
    mssecsvc.exe
    52 B
    1
  • 10.127.146.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.154.1:445
    mssecsvc.exe
    52 B
    1
  • 185.25.82.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.151.1:445
    mssecsvc.exe
    52 B
    1
  • 190.48.47.198:445
    mssecsvc.exe
    52 B
    1
  • 10.127.157.1:445
    mssecsvc.exe
    52 B
    1
  • 21.75.111.228:445
    mssecsvc.exe
    52 B
    1
  • 4.69.3.100:445
    mssecsvc.exe
    52 B
    1
  • 10.127.158.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.156.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.147.1:445
    mssecsvc.exe
    52 B
    1
  • 31.88.254.173:445
    mssecsvc.exe
    52 B
    1
  • 148.64.137.40:445
    mssecsvc.exe
    52 B
    1
  • 10.127.162.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.160.1:445
    mssecsvc.exe
    52 B
    1
  • 185.169.173.162:445
    mssecsvc.exe
    52 B
    1
  • 10.127.155.1:445
    mssecsvc.exe
    52 B
    1
  • 159.13.52.146:445
    mssecsvc.exe
    52 B
    1
  • 10.127.164.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.159.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.161.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.163.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.165.1:445
    mssecsvc.exe
    52 B
    1
  • 12.247.16.175:445
    mssecsvc.exe
    52 B
    1
  • 100.83.12.0:445
    mssecsvc.exe
    52 B
    1
  • 182.134.6.45:445
    mssecsvc.exe
    52 B
    1
  • 10.127.167.1:445
    mssecsvc.exe
    52 B
    1
  • 198.114.80.29:445
    mssecsvc.exe
    52 B
    1
  • 10.127.168.1:445
    mssecsvc.exe
    52 B
    1
  • 42.43.138.8:445
    mssecsvc.exe
    52 B
    1
  • 10.127.172.1:445
    mssecsvc.exe
    52 B
    1
  • 68.158.72.237:445
    mssecsvc.exe
    52 B
    1
  • 10.127.166.1:445
    mssecsvc.exe
    52 B
    1
  • 69.111.179.115:445
    mssecsvc.exe
    52 B
    1
  • 201.250.80.26:445
    mssecsvc.exe
    52 B
    1
  • 102.245.254.148:445
    mssecsvc.exe
    52 B
    1
  • 141.200.85.136:445
    mssecsvc.exe
    52 B
    1
  • 31.71.60.14:445
    mssecsvc.exe
    52 B
    1
  • 62.172.187.148:445
    mssecsvc.exe
    52 B
    1
  • 209.56.30.211:445
    mssecsvc.exe
    52 B
    1
  • 10.127.170.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.174.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.176.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.171.1:445
    mssecsvc.exe
    52 B
    1
  • 92.235.190.68:445
    mssecsvc.exe
    52 B
    1
  • 105.208.200.108:445
    mssecsvc.exe
    52 B
    1
  • 10.127.179.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.178.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.175.1:445
    mssecsvc.exe
    52 B
    1
  • 124.142.124.60:445
    mssecsvc.exe
    52 B
    1
  • 8.173.140.204:445
    mssecsvc.exe
    52 B
    1
  • 10.127.169.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.185.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.177.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.173.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.180.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.181.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.182.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.183.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.184.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.186.1:445
    mssecsvc.exe
    52 B
    1
  • 205.19.41.121:445
    mssecsvc.exe
    52 B
    1
  • 2.64.157.252:445
    mssecsvc.exe
    52 B
    1
  • 188.215.163.140:445
    mssecsvc.exe
    52 B
    1
  • 66.83.103.104:445
    mssecsvc.exe
    52 B
    1
  • 34.133.11.140:445
    mssecsvc.exe
    52 B
    1
  • 10.127.187.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.189.1:445
    mssecsvc.exe
    52 B
    1
  • 108.84.130.151:445
    mssecsvc.exe
    52 B
    1
  • 10.127.188.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.190.1:445
    mssecsvc.exe
    52 B
    1
  • 30.203.58.40:445
    mssecsvc.exe
    52 B
    1
  • 176.126.202.115:445
    mssecsvc.exe
    52 B
    1
  • 10.127.192.1:445
    mssecsvc.exe
    52 B
    1
  • 99.172.132.205:445
    mssecsvc.exe
    52 B
    1
  • 110.149.41.195:445
    mssecsvc.exe
    52 B
    1
  • 10.127.193.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.191.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.195.1:445
    mssecsvc.exe
    52 B
    1
  • 150.196.206.8:445
    mssecsvc.exe
    52 B
    1
  • 10.127.196.1:445
    mssecsvc.exe
    52 B
    1
  • 184.126.78.184:445
    mssecsvc.exe
    52 B
    1
  • 10.127.198.1:445
    mssecsvc.exe
    52 B
    1
  • 30.138.14.69:445
    mssecsvc.exe
    52 B
    1
  • 10.127.194.1:445
    mssecsvc.exe
    52 B
    1
  • 211.18.187.8:445
    mssecsvc.exe
    52 B
    1
  • 203.91.83.15:445
    mssecsvc.exe
    52 B
    1
  • 139.140.117.79:445
    mssecsvc.exe
    52 B
    1
  • 146.1.102.187:445
    mssecsvc.exe
    52 B
    1
  • 10.127.197.1:445
    mssecsvc.exe
    52 B
    1
  • 105.59.137.28:445
    mssecsvc.exe
    52 B
    1
  • 10.127.199.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.200.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.201.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.202.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.203.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.204.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.205.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.206.1:445
    mssecsvc.exe
    52 B
    1
  • 55.145.130.51:445
    mssecsvc.exe
    52 B
    1
  • 190.222.52.122:445
    mssecsvc.exe
    52 B
    1
  • 10.127.209.1:445
    mssecsvc.exe
    52 B
    1
  • 102.2.79.207:445
    mssecsvc.exe
    52 B
    1
  • 135.28.207.190:445
    mssecsvc.exe
    52 B
    1
  • 172.136.197.120:445
    mssecsvc.exe
    52 B
    1
  • 145.226.160.92:445
    mssecsvc.exe
    98 B
    40 B
    2
    1
  • 143.138.65.250:445
    mssecsvc.exe
    52 B
    1
  • 180.99.200.60:445
    mssecsvc.exe
    52 B
    1
  • 10.127.207.1:445
    mssecsvc.exe
    52 B
    1
  • 166.92.174.158:445
    mssecsvc.exe
    52 B
    1
  • 10.127.210.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.208.1:445
    mssecsvc.exe
    52 B
    1
  • 155.233.150.11:445
    mssecsvc.exe
    52 B
    1
  • 10.127.213.1:445
    mssecsvc.exe
    52 B
    1
  • 71.208.100.188:445
    mssecsvc.exe
    52 B
    1
  • 10.127.211.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.212.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.214.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.215.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.216.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.217.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.218.1:445
    mssecsvc.exe
    52 B
    1
  • 193.183.129.219:445
    mssecsvc.exe
    52 B
    1
  • 10.181.196.180:445
    mssecsvc.exe
    52 B
    1
  • 10.127.219.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.220.1:445
    mssecsvc.exe
    52 B
    1
  • 189.179.136.69:445
    mssecsvc.exe
    52 B
    1
  • 172.154.166.54:445
    mssecsvc.exe
    52 B
    1
  • 106.193.120.185:445
    mssecsvc.exe
    52 B
    1
  • 84.73.171.14:445
    mssecsvc.exe
    52 B
    1
  • 19.212.48.76:445
    mssecsvc.exe
    52 B
    1
  • 61.215.124.154:445
    mssecsvc.exe
    52 B
    1
  • 10.127.221.1:445
    mssecsvc.exe
    52 B
    1
  • 177.225.16.123:445
    mssecsvc.exe
    52 B
    1
  • 10.127.222.1:445
    mssecsvc.exe
    52 B
    1
  • 159.148.115.203:445
    mssecsvc.exe
    52 B
    1
  • 10.127.223.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.224.1:445
    mssecsvc.exe
    52 B
    1
  • 135.67.136.133:445
    mssecsvc.exe
    52 B
    1
  • 89.163.31.136:445
    mssecsvc.exe
    52 B
    1
  • 10.127.227.1:445
    mssecsvc.exe
    52 B
    1
  • 215.57.209.194:445
    mssecsvc.exe
    52 B
    1
  • 132.143.160.171:445
    mssecsvc.exe
    52 B
    1
  • 10.127.230.1:445
    mssecsvc.exe
    52 B
    1
  • 147.205.254.252:445
    mssecsvc.exe
    52 B
    1
  • 146.182.24.184:445
    mssecsvc.exe
    52 B
    1
  • 174.247.151.5:445
    mssecsvc.exe
    52 B
    1
  • 10.127.231.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.226.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.228.1:445
    mssecsvc.exe
    52 B
    1
  • 141.8.221.246:445
    mssecsvc.exe
    52 B
    1
  • 180.158.161.86:445
    mssecsvc.exe
    52 B
    1
  • 10.127.225.1:445
    mssecsvc.exe
    52 B
    1
  • 172.60.70.202:445
    mssecsvc.exe
    52 B
    1
  • 181.117.23.71:445
    mssecsvc.exe
    52 B
    1
  • 49.197.246.171:445
    mssecsvc.exe
    52 B
    1
  • 10.127.229.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.232.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.233.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.234.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.235.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.236.1:445
    mssecsvc.exe
    52 B
    1
  • 134.21.174.200:445
    mssecsvc.exe
    52 B
    1
  • 10.127.237.1:445
    mssecsvc.exe
    52 B
    1
  • 200.168.4.126:445
    mssecsvc.exe
    52 B
    1
  • 10.127.238.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.239.1:445
    mssecsvc.exe
    52 B
    1
  • 88.71.142.87:445
    mssecsvc.exe
    52 B
    1
  • 10.127.240.1:445
    mssecsvc.exe
    52 B
    1
  • 44.176.130.28:445
    mssecsvc.exe
    52 B
    1
  • 49.177.87.44:445
    mssecsvc.exe
    52 B
    1
  • 10.127.241.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.242.1:445
    mssecsvc.exe
    52 B
    1
  • 214.247.252.147:445
    mssecsvc.exe
    52 B
    1
  • 100.182.73.230:445
    mssecsvc.exe
    52 B
    1
  • 80.39.158.134:445
    mssecsvc.exe
    52 B
    1
  • 2.10.60.92:445
    mssecsvc.exe
    52 B
    1
  • 32.43.122.215:445
    mssecsvc.exe
    52 B
    1
  • 101.197.161.113:445
    mssecsvc.exe
    52 B
    1
  • 10.127.243.1:445
    mssecsvc.exe
    52 B
    1
  • 185.228.19.144:445
    mssecsvc.exe
    52 B
    1
  • 170.173.7.83:445
    mssecsvc.exe
    52 B
    1
  • 193.165.45.117:445
    mssecsvc.exe
    52 B
    1
  • 205.164.181.225:445
    mssecsvc.exe
    104 B
    80 B
    2
    2
  • 10.127.245.1:445
    mssecsvc.exe
    52 B
    1
  • 15.15.81.202:445
    mssecsvc.exe
    52 B
    1
  • 101.165.195.73:445
    mssecsvc.exe
    52 B
    1
  • 107.102.44.91:445
    mssecsvc.exe
    52 B
    1
  • 10.127.246.1:445
    mssecsvc.exe
    52 B
    1
  • 29.243.207.243:445
    mssecsvc.exe
    52 B
    1
  • 204.130.248.203:445
    mssecsvc.exe
    52 B
    1
  • 10.127.244.1:445
    mssecsvc.exe
    52 B
    1
  • 73.78.228.100:445
    mssecsvc.exe
    52 B
    1
  • 10.127.247.1:445
    mssecsvc.exe
    52 B
    1
  • 43.79.24.194:445
    mssecsvc.exe
    52 B
    1
  • 10.127.248.1:445
    mssecsvc.exe
    52 B
    1
  • 74.97.41.134:445
    mssecsvc.exe
    52 B
    1
  • 220.78.236.249:445
    mssecsvc.exe
    52 B
    1
  • 10.127.249.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.250.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.251.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.252.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.253.1:445
    mssecsvc.exe
    52 B
    1
  • 10.127.254.1:445
    mssecsvc.exe
    52 B
    1
  • 96.201.208.7:445
    mssecsvc.exe
    52 B
    1
  • 10.127.255.1:445
    mssecsvc.exe
    52 B
    1
  • 86.39.211.13:445
    mssecsvc.exe
    52 B
    1
  • 10.127.0.2:445
    mssecsvc.exe
    52 B
    1
  • 10.127.1.2:445
    mssecsvc.exe
    52 B
    1
  • 162.71.211.75:445
    mssecsvc.exe
    52 B
    1
  • 10.127.2.2:445
    mssecsvc.exe
    52 B
    1
  • 83.243.86.92:445
    mssecsvc.exe
    52 B
    1
  • 10.127.3.2:445
    mssecsvc.exe
    52 B
    1
  • 45.227.105.245:445
    mssecsvc.exe
    52 B
    1
  • 10.127.4.2:445
    mssecsvc.exe
    52 B
    1
  • 10.127.5.2:445
    mssecsvc.exe
    52 B
    1
  • 4.202.246.242:445
    mssecsvc.exe
    52 B
    1
  • 10.127.6.2:445
    mssecsvc.exe
    52 B
    1
  • 69.109.162.123:445
    mssecsvc.exe
    52 B
    1
  • 171.182.187.103:445
    mssecsvc.exe
    52 B
    1
  • 10.127.7.2:445
    mssecsvc.exe
    52 B
    1
  • 10.127.8.2:445
    mssecsvc.exe
    52 B
    1
  • 1.239.139.9:445
    mssecsvc.exe
    52 B
    1
  • 114.251.114.13:445
    mssecsvc.exe
    52 B
    1
  • 112.181.179.174:445
    mssecsvc.exe
    52 B
    1
  • 196.92.217.115:445
    mssecsvc.exe
    52 B
    1
  • 152.93.193.79:445
    mssecsvc.exe
    52 B
    1
  • 185.188.121.163:445
    mssecsvc.exe
    52 B
    1
  • 75.183.1.56:445
    mssecsvc.exe
    52 B
    1
  • 67.190.212.213:445
    mssecsvc.exe
    52 B
    1
  • 10.127.10.2:445
    mssecsvc.exe
    52 B
    1
  • 10.127.9.2:445
    mssecsvc.exe
    52 B
    1
  • 15.171.178.173:445
    mssecsvc.exe
    52 B
    1
  • 144.24.145.175:445
    mssecsvc.exe
    52 B
    1
  • 10.127.12.2:445
    mssecsvc.exe
    52 B
    1
  • 53.153.138.110:445
    mssecsvc.exe
    52 B
    1
  • 220.250.198.246:445
    mssecsvc.exe
    52 B
    1
  • 133.166.132.49:445
    mssecsvc.exe
    52 B
    1
  • 10.127.11.2:445
    mssecsvc.exe
    52 B
    1
  • 67.154.214.22:445
    mssecsvc.exe
    52 B
    1
  • 104.117.119.182:445
    mssecsvc.exe
    52 B
    1
  • 10.127.14.2:445
    mssecsvc.exe
    52 B
    1
  • 159.204.67.35:445
    mssecsvc.exe
    52 B
    1
  • 10.127.15.2:445
    mssecsvc.exe
    52 B
    1
  • 219.40.176.224:445
    mssecsvc.exe
    52 B
    1
  • 10.127.19.2:445
    mssecsvc.exe
    52 B
    1
  • 10.127.17.2:445
    mssecsvc.exe
    52 B
    1
  • 10.127.13.2:445
    mssecsvc.exe
    52 B
    1
  • 10.127.16.2:445
    mssecsvc.exe
    52 B
    1
  • 10.127.18.2:445
    mssecsvc.exe
    52 B
    1
  • 130.190.25.112:445
    mssecsvc.exe
    52 B
    1
  • 18.244.202.236:445
    mssecsvc.exe
    52 B
    1
  • 194.211.50.175:445
    mssecsvc.exe
    52 B
    1
  • 136.57.81.45:445
    mssecsvc.exe
    52 B
    1
  • 10.127.20.2:445
    mssecsvc.exe
    52 B
    1
  • 5.44.201.182:445
    mssecsvc.exe
    104 B
    80 B
    2
    2
  • 10.127.21.2:445
    mssecsvc.exe
    52 B
    1
  • 132.147.142.156:445
    mssecsvc.exe
    52 B
    1
  • 10.127.22.2:445
    mssecsvc.exe
    52 B
    1
  • 10.127.23.2:445
    mssecsvc.exe
    52 B
    1
  • 189.153.93.50:445
    mssecsvc.exe
    52 B
    1
  • 10.127.24.2:445
    mssecsvc.exe
    52 B
    1
  • 38.70.2.81:445
    mssecsvc.exe
    104 B
    80 B
    2
    2
  • 10.127.25.2:445
    mssecsvc.exe
    52 B
    1
  • 93.250.17.47:445
    mssecsvc.exe
    52 B
    1
  • 10.127.26.2:445
    mssecsvc.exe
    52 B
    1
  • 10.127.27.2:445
    mssecsvc.exe
    52 B
    1
  • 48.39.85.214:445
    mssecsvc.exe
    52 B
    1
  • 10.127.28.2:445
    mssecsvc.exe
    52 B
    1
  • 189.171.150.2:445
    mssecsvc.exe
    52 B
    1
  • 103.226.253.217:445
    mssecsvc.exe
    52 B
    1
  • 10.127.29.2:445
    mssecsvc.exe
    52 B
    1
  • 10.127.30.2:445
    mssecsvc.exe
    52 B
    1
  • 70.215.5.37:445
    mssecsvc.exe
    52 B
    1
  • 171.34.252.162:445
    mssecsvc.exe
    52 B
    1
  • 221.223.19.98:445
    mssecsvc.exe
    52 B
    1
  • 157.228.161.67:445
    mssecsvc.exe
    52 B
    1
  • 52.118.145.245:445
    mssecsvc.exe
    52 B
    1
  • 6.212.11.99:445
    mssecsvc.exe
    52 B
    1
  • 112.49.237.106:445
    mssecsvc.exe
    52 B
    1
  • 46.16.62.127:445
    mssecsvc.exe
    52 B
    1
  • 8.8.8.8:53
    www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
    dns
    mssecsvc.exe
    95 B
    127 B
    1
    1

    DNS Request

    www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com

    DNS Response

    104.16.166.228
    104.16.167.228

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\mssecsvc.exe

    Filesize

    3.6MB

    MD5

    c5b49436268a53d155790910af661336

    SHA1

    bb83a3f8ad419c92f3333f9126ba4d0dd0310151

    SHA256

    296c008a3ac825cd3e614a175bfabb4cd1081028c7b12e0c1c1039054cb865c2

    SHA512

    6a510d6363a94dc3403e0aae8a5a7a54d726e3d267480a33233d1546b84754e6d7835d606d520126784b1cc2509e9bfcde577e2604d142313bfb43a77ab03973

  • C:\Windows\tasksche.exe

    Filesize

    3.4MB

    MD5

    e45fa34e9e5a2f915b20f9551ac6f115

    SHA1

    c6a3ed6ef55d4892bbde29eb0c33272e6862f0c8

    SHA256

    3b807f3cb23c49f9da3352ed0187eb948a6ccf5a9b83c8fab2d1d0ffb9b3e9fd

    SHA512

    01d3b4c23c2a3852968e630871719ec4b9a072d2ba66d259df7b50fb0f6e9f3266967a2fed530f159b3dc55abd89de1650dffe6971365539a7bc8c940209978c

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.