Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
15/01/2025, 20:36
250115-zd3tfawjan 1015/01/2025, 20:34
250115-zcjzyavrfl 1015/01/2025, 20:30
250115-zamm2svqhq 1015/01/2025, 18:58
250115-xmgw8atjal 10Analysis
-
max time kernel
37s -
max time network
38s -
platform
windows11-21h2_x64 -
resource
win11-20241007-uk -
resource tags
arch:x64arch:x86image:win11-20241007-uklocale:uk-uaos:windows11-21h2-x64systemwindows -
submitted
15/01/2025, 20:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ad31ca449f285250368196306a8ad77a.dll
Resource
win11-20241007-uk
windows11-21h2-x64
15 signatures
150 seconds
General
-
Target
ad31ca449f285250368196306a8ad77a.dll
-
Size
5.0MB
-
MD5
ad31ca449f285250368196306a8ad77a
-
SHA1
abefa604d54027fac646df910a9ecbc462b01ec2
-
SHA256
962caf150b14b5804de96484e8b911f93fcb26ab11f7e713d3f0c02a211c2577
-
SHA512
57700c858fd9f1b3bea65af6a75fc9770a8b7b98ae195b3d53d62a4d315012ea28cc28a4e2e7dc55e137e5611cf049f0cfe4ffc6110e3bfe22a437cb52af7c15
-
SSDEEP
49152:Sn+qMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9:++qPoBhz1aRxcSUDk36SAEdhvxWa9
Score
10/10
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Wannacry family
-
Executes dropped EXE 3 IoCs
pid Process 3896 mssecsvc.exe 1636 mssecsvc.exe 3516 tasksche.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 mssecsvc.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE mssecsvc.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies mssecsvc.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 mssecsvc.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\WINDOWS\tasksche.exe mssecsvc.exe File created C:\WINDOWS\mssecsvc.exe rundll32.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4252 3516 WerFault.exe 80 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mssecsvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mssecsvc.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvc.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1036 taskmgr.exe Token: SeSystemProfilePrivilege 1036 taskmgr.exe Token: SeCreateGlobalPrivilege 1036 taskmgr.exe Token: 33 1036 taskmgr.exe Token: SeIncBasePriorityPrivilege 1036 taskmgr.exe -
Suspicious use of FindShellTrayWindow 52 IoCs
pid Process 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe -
Suspicious use of SendNotifyMessage 52 IoCs
pid Process 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2084 wrote to memory of 2020 2084 rundll32.exe 77 PID 2084 wrote to memory of 2020 2084 rundll32.exe 77 PID 2084 wrote to memory of 2020 2084 rundll32.exe 77 PID 2020 wrote to memory of 3896 2020 rundll32.exe 78 PID 2020 wrote to memory of 3896 2020 rundll32.exe 78 PID 2020 wrote to memory of 3896 2020 rundll32.exe 78 PID 3896 wrote to memory of 3516 3896 mssecsvc.exe 80 PID 3896 wrote to memory of 3516 3896 mssecsvc.exe 80
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ad31ca449f285250368196306a8ad77a.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ad31ca449f285250368196306a8ad77a.dll,#12⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i4⤵
- Executes dropped EXE
PID:3516 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 85⤵
- Program crash
PID:4252
-
-
-
-
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1636
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3516 -ip 35161⤵PID:3408
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1036
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.6MB
MD51da4aa17d6682e2224513e559e86d658
SHA1435b8d0afb90a66bc63eaf9fdb5b1ce27d56dacd
SHA25663500b6a365a6e688afecdf632ea399b6e80529c17d292f1f1839a1c26dfed3d
SHA512bf6993555e3f9ad33ef275db233e80baf7ddf5f66c288fca2cf9cbc24ad6716df50f987a987d1c6abbd851bcc7cb29263c80fe0e43ae9e9ea4c0f9235224a89f
-
Filesize
2.0MB
MD54cf1595972413914ee36c92584da1c4f
SHA12106ca6dde83ca404ef9b00d998fd8b58628e3fb
SHA256156cae52162f94349ad25c4c2833769b20290aa5e48109479e8dd035b094f8bd
SHA51208c5068f30c09e0941c60521ecbe69f4be537db3adaae47026e903f8466067347fcd522f37e9d56c464d0913f3b008038bba1d0fc83637ba0e176bd24fcedb9b