ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa | Triage

Resubmissions

18-10-2019 15:52

191018-8typv9j9fn 0

09-08-2019 12:22

190809-4hmrwf3nzs 0

Sharing

General

Target

ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
Size

3.4MB
Sample

190809-4hmrwf3nzs
MD5

84c82835a5d21bbcf75a61706d8ab549
SHA1

5ff465afaabcbf0150d1a3ab2c2e74f3a4426467
SHA256

ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
SHA512

90723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244

Score

N/A

Malware Config

Targets

- Target
  
  ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
- Size
  
  3.4MB
- MD5
  
  84c82835a5d21bbcf75a61706d8ab549
- SHA1
  
  5ff465afaabcbf0150d1a3ab2c2e74f3a4426467
- SHA256
  
  ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
- SHA512
  
  90723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244
Score

N/A
- wannacry family
  family
- Executes dropped EXE
- Modifies file permissions
- Sets file to hidden
- Drops startup file
- Loads dropped DLL
- Adds Run entry to start application
- Modifies service
task1 task2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Execution through API

Execution through Module Load

Persistence

Hidden Files and Directories

Hooking

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Access Token Manipulation

Hooking

Process Injection

Defense Evasion

Access Token Manipulation

File Deletion

File and Directory Permissions Modification

Hidden Files and Directories

Modify Registry

Process Injection

Credential Access

Hooking

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

task1

task2