General
-
Target
eceb2f25bac4cbca1da5f4e390124912cd91f541ad1ccada2ae2b46f4aceb414
-
Size
3.5MB
-
Sample
210921-kceynagha2
-
MD5
087f42dd5c17b7c42723dfc150a8da42
-
SHA1
013010ff0e5c25c48b2a4e7ed1340738a0dd8995
-
SHA256
eceb2f25bac4cbca1da5f4e390124912cd91f541ad1ccada2ae2b46f4aceb414
-
SHA512
0c01500ddb57bafc84c33dbbc9b2d6f16b945acd5533ea0484017291794d2d4b069f5eae14b3bb412f95849e4ab960d9685b05cb657f5c81076c9daa65d74203
Static task
static1
Behavioral task
behavioral1
Sample
eceb2f25bac4cbca1da5f4e390124912cd91f541ad1ccada2ae2b46f4aceb414.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
eceb2f25bac4cbca1da5f4e390124912cd91f541ad1ccada2ae2b46f4aceb414.exe
Resource
win10-en-20210920
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\@Please_Read_Me@.txt
wannacry
12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw
Extracted
C:\Users\Admin\AppData\Local\Temp\@Please_Read_Me@.txt
wannacry
115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn
Targets
-
-
Target
eceb2f25bac4cbca1da5f4e390124912cd91f541ad1ccada2ae2b46f4aceb414
-
Size
3.5MB
-
MD5
087f42dd5c17b7c42723dfc150a8da42
-
SHA1
013010ff0e5c25c48b2a4e7ed1340738a0dd8995
-
SHA256
eceb2f25bac4cbca1da5f4e390124912cd91f541ad1ccada2ae2b46f4aceb414
-
SHA512
0c01500ddb57bafc84c33dbbc9b2d6f16b945acd5533ea0484017291794d2d4b069f5eae14b3bb412f95849e4ab960d9685b05cb657f5c81076c9daa65d74203
-
Executes dropped EXE
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Loads dropped DLL
-
Modifies file permissions
-
Adds Run key to start application
-
Sets desktop wallpaper using registry
-