Overview

overview

10

Static

static

e70d9c40dd...24.exe

windows7_x64

10

e70d9c40dd...24.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e70d9c40dd3433fce51caab8da163820f67028daf9c06df865d8c564d22aa924

  • Size

    294KB

  • Sample

    210513-g2kfjfa8qn

  • MD5

    35f5db065caece60369552162f60541a

  • SHA1

    465a3153f210ab5bba612f96962275c68f356ee4

  • SHA256

    e70d9c40dd3433fce51caab8da163820f67028daf9c06df865d8c564d22aa924

  • SHA512

    11b0dbe770af86619d6db04bf54f52031b901cb75fc4fcaa32c9ee5421f92debff2bef2eb00d02ab039aab88f33c2c20f5ab2620ffedf3d08071a6d2ce2a9f96

Score
10/10
wannacryxmrigminerpersistenceransomwareworm

Malware Config

Targets

    • Target

      e70d9c40dd3433fce51caab8da163820f67028daf9c06df865d8c564d22aa924

    • Size

      294KB

    • MD5

      35f5db065caece60369552162f60541a

    • SHA1

      465a3153f210ab5bba612f96962275c68f356ee4

    • SHA256

      e70d9c40dd3433fce51caab8da163820f67028daf9c06df865d8c564d22aa924

    • SHA512

      11b0dbe770af86619d6db04bf54f52031b901cb75fc4fcaa32c9ee5421f92debff2bef2eb00d02ab039aab88f33c2c20f5ab2620ffedf3d08071a6d2ce2a9f96

    Score
    10/10
    wannacryxmrigminerpersistenceransomwareworm

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks