Overview

overview

10

Static

static

new.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    new.exe

  • Size

    9.8MB

  • Sample

    220403-1aqv5shfdl

  • MD5

    0db40745253ee7a55c924099dd796f9f

  • SHA1

    2aa4a07c80df288b651504e0683abe20e4510404

  • SHA256

    e18ce32660f224ed447568de1b163f1b393491c577480cc207b99829ccf9b8db

  • SHA512

    2880b749263c284d2e94154ec044ca5c5851ec52e62fc940cde893c28699e7c07c655db91ae3f94b71f3eabf47eeb8a262a7042222bfbc0c51167a99e6a96588

Score
10/10
wannacrydiscoveryevasionransomwareupxworm

Malware Config

Targets

    • Target

      new.exe

    • Size

      9.8MB

    • MD5

      0db40745253ee7a55c924099dd796f9f

    • SHA1

      2aa4a07c80df288b651504e0683abe20e4510404

    • SHA256

      e18ce32660f224ed447568de1b163f1b393491c577480cc207b99829ccf9b8db

    • SHA512

      2880b749263c284d2e94154ec044ca5c5851ec52e62fc940cde893c28699e7c07c655db91ae3f94b71f3eabf47eeb8a262a7042222bfbc0c51167a99e6a96588

    Score
    10/10
    wannacrydiscoveryevasionransomwareupxworm

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • Executes dropped EXE

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Stops running service(s)

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Modifies file permissions

      discovery
    behavioral1

MITRE ATT&CK Enterprise v6

Tasks