Overview

overview

10

Static

static

8

483c7fa66d...e6.exe

windows7_x64

10

483c7fa66d...e6.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    483c7fa66d9cf56e48741b7c4516906c78d71a89ef64529266d607ff7e0544e6

  • Size

    5.4MB

  • Sample

    220714-ee5dfafba4

  • MD5

    a755f76611af191caac97da04633b012

  • SHA1

    ee2fba5a45e09e560c67f5107f76cf6e9a36ab53

  • SHA256

    483c7fa66d9cf56e48741b7c4516906c78d71a89ef64529266d607ff7e0544e6

  • SHA512

    b53fee6fb2b1013989e963b67f11924b8498e198b779fcfb49dc2154ca1a61c89f5abb32b91ed1052052a9c40f7ee1c2c58abf6ee1877b712d7b5899f2d97840

Score
10/10
wannacrydiscoveryevasionpersistenceransomwareupxworm

Malware Config

Targets

    • Target

      483c7fa66d9cf56e48741b7c4516906c78d71a89ef64529266d607ff7e0544e6

    • Size

      5.4MB

    • MD5

      a755f76611af191caac97da04633b012

    • SHA1

      ee2fba5a45e09e560c67f5107f76cf6e9a36ab53

    • SHA256

      483c7fa66d9cf56e48741b7c4516906c78d71a89ef64529266d607ff7e0544e6

    • SHA512

      b53fee6fb2b1013989e963b67f11924b8498e198b779fcfb49dc2154ca1a61c89f5abb32b91ed1052052a9c40f7ee1c2c58abf6ee1877b712d7b5899f2d97840

    Score
    10/10
    wannacrydiscoveryevasionpersistenceransomwareupxworm

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Sets file execution options in registry

      persistence

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Stops running service(s)

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Modifies file permissions

      discovery

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Command-Line Interface

1
T1059

Persistence

Registry Run Keys / Startup Folder

1
T1060

Hidden Files and Directories

2
T1158

Modify Existing Service

1
T1031

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Modify Registry

1
T1112

Hidden Files and Directories

2
T1158

Impair Defenses

1
T1562

File Permissions Modification

1
T1222

Credential Access

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

3
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

1
T1489

Tasks