Analysis
-
max time kernel
43s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01-10-2022 12:08
Static task
static1
Behavioral task
behavioral1
Sample
7aebbcd75ea79673da63fee5f95805aa0ca8ef2ce8761faec09d1d0183a3adfc.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
7aebbcd75ea79673da63fee5f95805aa0ca8ef2ce8761faec09d1d0183a3adfc.exe
Resource
win10v2004-20220901-en
General
-
Target
7aebbcd75ea79673da63fee5f95805aa0ca8ef2ce8761faec09d1d0183a3adfc.exe
-
Size
244KB
-
MD5
4ae2a9a090d594271dc2b28b52fa41ad
-
SHA1
55c3f9bc95f7d8b2324fb7cf142f78a92c2b5cee
-
SHA256
7aebbcd75ea79673da63fee5f95805aa0ca8ef2ce8761faec09d1d0183a3adfc
-
SHA512
91f16406096d43a857ff4e61e0532dd16c723d65bd7437005eefaa2f4b677f808d480ccbeb2bb1266e41bac4373ff4d242153d8c6eb4926448ead2cfb36f571b
-
SSDEEP
3072:xmrhd5U1eigWcR+uiUg6p4FLlG4tlLpz+mmCkHFZjoHEo3y:xEd5+IZiZhLlG4NimmCe
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
7aebbcd75ea79673da63fee5f95805aa0ca8ef2ce8761faec09d1d0183a3adfc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@WanaDecryptor@.bmp" 7aebbcd75ea79673da63fee5f95805aa0ca8ef2ce8761faec09d1d0183a3adfc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Pictures\\My Wallpaper.jpg" 7aebbcd75ea79673da63fee5f95805aa0ca8ef2ce8761faec09d1d0183a3adfc.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
7aebbcd75ea79673da63fee5f95805aa0ca8ef2ce8761faec09d1d0183a3adfc.exepid process 1884 7aebbcd75ea79673da63fee5f95805aa0ca8ef2ce8761faec09d1d0183a3adfc.exe 1884 7aebbcd75ea79673da63fee5f95805aa0ca8ef2ce8761faec09d1d0183a3adfc.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1884-54-0x0000000075571000-0x0000000075573000-memory.dmpFilesize
8KB