Overview

overview

10

Static

static

8

f933f20a90...ir.exe

windows7_x64

10

f933f20a90...ir.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f933f20a904f7d2a2a127a1fb509f9a9.exe.vir

  • Size

    292KB

  • Sample

    211223-vbnvaacbdm

  • MD5

    f933f20a904f7d2a2a127a1fb509f9a9

  • SHA1

    86a8f94d43f484bf949ea428cbb98df1a72ce7e6

  • SHA256

    7ee0185acfc329af306c048d970c8dc841a08969778e1eb9f34dfd4e755749a1

  • SHA512

    de35e37ab10dac9cd25e4e8308e4928720eb89e9f70c4b42f3a33bce966e3ef2871d40afab8f029aa0bb41da9627b4014844060fc00c17a17828f829b0971b8d

Score
10/10
wannacrydiscoveryevasionminerpersistenceransomwareupxworm

Malware Config

Targets

    • Target

      f933f20a904f7d2a2a127a1fb509f9a9.exe.vir

    • Size

      292KB

    • MD5

      f933f20a904f7d2a2a127a1fb509f9a9

    • SHA1

      86a8f94d43f484bf949ea428cbb98df1a72ce7e6

    • SHA256

      7ee0185acfc329af306c048d970c8dc841a08969778e1eb9f34dfd4e755749a1

    • SHA512

      de35e37ab10dac9cd25e4e8308e4928720eb89e9f70c4b42f3a33bce966e3ef2871d40afab8f029aa0bb41da9627b4014844060fc00c17a17828f829b0971b8d

    Score
    10/10
    wannacrydiscoveryevasionminerpersistenceransomwarewormupx

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • Clears Windows event logs

      evasionransomware

    • Detected Stratum cryptominer command

      Looks to be attempting to contact Stratum mining pool.

      miner

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Sets file execution options in registry

      persistence

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Stops running service(s)

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Deletes itself

    • Loads dropped DLL

    • Modifies file permissions

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Hidden Files and Directories

2
T1158

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

Indicator Removal on Host

1
T1070

Modify Registry

1
T1112

Hidden Files and Directories

2
T1158

Impair Defenses

1
T1562

File Permissions Modification

1
T1222

Credential Access

Discovery

System Information Discovery

1
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

1
T1489

Tasks