wannacry | 0a5cf36c65067e613d41d4756246fae24897277e0d7e218b017715e3b6a3f59a

Analysis

max time kernel
65s
max time network
69s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
05/10/2022, 19:01

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

7aebbcd75ea79673da63fee5f95805aa0ca8ef2ce8761faec09d1d0183a3adfc.exe
Size

244KB
MD5

4ae2a9a090d594271dc2b28b52fa41ad
SHA1

55c3f9bc95f7d8b2324fb7cf142f78a92c2b5cee
SHA256

7aebbcd75ea79673da63fee5f95805aa0ca8ef2ce8761faec09d1d0183a3adfc
SHA512

91f16406096d43a857ff4e61e0532dd16c723d65bd7437005eefaa2f4b677f808d480ccbeb2bb1266e41bac4373ff4d242153d8c6eb4926448ead2cfb36f571b
SSDEEP

3072:xmrhd5U1eigWcR+uiUg6p4FLlG4tlLpz+mmCkHFZjoHEo3y:xEd5+IZiZhLlG4NimmCe

Score

10^/10

wannacry ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	7aebbcd75ea79673da63fee5f95805aa0ca8ef2ce8761faec09d1d0183a3adfc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Pictures\\My Wallpaper.jpg"	7aebbcd75ea79673da63fee5f95805aa0ca8ef2ce8761faec09d1d0183a3adfc.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1316	NOTEPAD.EXE

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1104	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1104	AUDIODG.EXE
Token: 33	1104	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1104	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1348	7aebbcd75ea79673da63fee5f95805aa0ca8ef2ce8761faec09d1d0183a3adfc.exe
1348	7aebbcd75ea79673da63fee5f95805aa0ca8ef2ce8761faec09d1d0183a3adfc.exe

C:\Users\Admin\AppData\Local\Temp\7aebbcd75ea79673da63fee5f95805aa0ca8ef2ce8761faec09d1d0183a3adfc.exe
"C:\Users\Admin\AppData\Local\Temp\7aebbcd75ea79673da63fee5f95805aa0ca8ef2ce8761faec09d1d0183a3adfc.exe"
1⤵
- Sets desktop wallpaper using registry
- Suspicious use of SetWindowsHookEx
PID:1348

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\CompareResume.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:1316

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:1808

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x54c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1104

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:1816

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact