Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
15/01/2025, 15:49
Static task
static1
Behavioral task
behavioral1
Sample
7c7262d9e49a40a52d0040942810456c.dll
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
7c7262d9e49a40a52d0040942810456c.dll
Resource
win10v2004-20241007-en
General
-
Target
7c7262d9e49a40a52d0040942810456c.dll
-
Size
5.0MB
-
MD5
7c7262d9e49a40a52d0040942810456c
-
SHA1
11f1d0fc532dd8ac926e4ecbae734a484bccb54c
-
SHA256
fb2ddd079c9ea48c32edc702707a2e117e076a09196deec14f3eb9bb7492d619
-
SHA512
36ecf7c53affcbf2aaf4bd6455ad230c3f1271ab2f82036c8b557144f85724e1f8921a3e658c8076c980fcbce5224d093b7a5960d6d6671218da8e5167f877f2
-
SSDEEP
49152:RnpENbcBVQej/1INRx+TSqTdX1HkQo6SAgqG:1p+oBhz1aRxcSUDk36SAgH
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Wannacry family
-
Contacts a large (3312) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 3 IoCs
pid Process 2020 mssecsvr.exe 3344 mssecsvr.exe 3332 tasksche.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies mssecsvr.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 mssecsvr.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 mssecsvr.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE mssecsvr.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\eee.exe tasksche.exe File created C:\WINDOWS\mssecsvr.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvr.exe File created C:\Windows\__tmp_rar_sfx_access_check_240631531 tasksche.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mssecsvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mssecsvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasksche.exe -
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion mssecsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvr.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4032 wrote to memory of 4544 4032 rundll32.exe 82 PID 4032 wrote to memory of 4544 4032 rundll32.exe 82 PID 4032 wrote to memory of 4544 4032 rundll32.exe 82 PID 4544 wrote to memory of 2020 4544 rundll32.exe 83 PID 4544 wrote to memory of 2020 4544 rundll32.exe 83 PID 4544 wrote to memory of 2020 4544 rundll32.exe 83 PID 2020 wrote to memory of 3332 2020 mssecsvr.exe 85 PID 2020 wrote to memory of 3332 2020 mssecsvr.exe 85 PID 2020 wrote to memory of 3332 2020 mssecsvr.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7c7262d9e49a40a52d0040942810456c.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7c7262d9e49a40a52d0040942810456c.dll,#12⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\WINDOWS\mssecsvr.exeC:\WINDOWS\mssecsvr.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i4⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3332
-
-
-
-
C:\WINDOWS\mssecsvr.exeC:\WINDOWS\mssecsvr.exe -m security1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:3344
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD5a0a9d89096902bd94346342034c5101b
SHA10c4684c974a521cc2df6c9d654782142ca111cc3
SHA256b2964fc76f83f1d7ac04a95995e2e04c4126a3026d09961232ff605144b8f175
SHA51297bafcf6d0e1682fddc0723ffa7beba51bc241420ce06275c78e5427bad779426db1295c33e3f498d93d9fc5a9f45f290386e228a77db4ae8958e3f86b4c657c
-
Filesize
2.0MB
MD597fe88aae55e849dce84bb3a105633d0
SHA18b70f9988f52b48e6c5997820215793ac31ade8f
SHA2565374f0ace1103f63611d466af63c662a32f38f978358084aa763b39dccd83d2b
SHA5125edf54319fbdf72783327de3e6702d2daf2ecc2997a9677939135e806bdaad1ea60c9d08dc8341b427832d704f1d232e66c159e11ebd63ef846bb966ccaa1127