Overview

overview

10

Static

static

8

97777b89ea...76.exe

windows7_x64

10

97777b89ea...76.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576

  • Size

    845KB

  • Sample

    220625-gceq4sacg3

  • MD5

    584c2211a059c4018d2eddf8f669d63d

  • SHA1

    87f2c620b3b9374bc7dd1c4cb296bc4fdcd5da25

  • SHA256

    97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576

  • SHA512

    828f6c3a7fb7a8e339ce0a0d4a520132c7ded616b52f0598f7c2ec62dc20f648ad28e43c9a4edf9789f1824ed954f47d7d39d2bde6e02453411e6406d6a79086

Score
10/10
wannacryxmrigdiscoveryevasionminerransomwareupxworm

Malware Config

Targets

    • Target

      97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576

    • Size

      845KB

    • MD5

      584c2211a059c4018d2eddf8f669d63d

    • SHA1

      87f2c620b3b9374bc7dd1c4cb296bc4fdcd5da25

    • SHA256

      97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576

    • SHA512

      828f6c3a7fb7a8e339ce0a0d4a520132c7ded616b52f0598f7c2ec62dc20f648ad28e43c9a4edf9789f1824ed954f47d7d39d2bde6e02453411e6406d6a79086

    Score
    10/10
    wannacrydiscoveryevasionransomwareupxwormxmrigminer

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner Payload

      miner

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Stops running service(s)

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Modifies file permissions

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks