wannacry | 0a5cf36c65067e613d41d4756246fae24897277e0d7e218b017715e3b6a3f59a

Reason

Machine shutdown

General

Target

7aebbcd75ea79673da63fee5f95805aa0ca8ef2ce8761faec09d1d0183a3adfc.exe
Size

244KB
MD5

4ae2a9a090d594271dc2b28b52fa41ad
SHA1

55c3f9bc95f7d8b2324fb7cf142f78a92c2b5cee
SHA256

7aebbcd75ea79673da63fee5f95805aa0ca8ef2ce8761faec09d1d0183a3adfc
SHA512

91f16406096d43a857ff4e61e0532dd16c723d65bd7437005eefaa2f4b677f808d480ccbeb2bb1266e41bac4373ff4d242153d8c6eb4926448ead2cfb36f571b
SSDEEP

3072:xmrhd5U1eigWcR+uiUg6p4FLlG4tlLpz+mmCkHFZjoHEo3y:xEd5+IZiZhLlG4NimmCe

Score

10^/10

wannacry ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

7aebbcd75ea79673da63fee5f95805aa0ca8ef2ce8761faec09d1d0183a3adfc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@WanaDecryptor@.bmp"	7aebbcd75ea79673da63fee5f95805aa0ca8ef2ce8761faec09d1d0183a3adfc.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies data under HKEY_USERS 15 IoCs

Processes:

LogonUI.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "169"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

260 WINWORD.EXE
260 WINWORD.EXE
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

7aebbcd75ea79673da63fee5f95805aa0ca8ef2ce8761faec09d1d0183a3adfc.exe

pid process

3068 7aebbcd75ea79673da63fee5f95805aa0ca8ef2ce8761faec09d1d0183a3adfc.exe

pid	process
260	WINWORD.EXE
260	WINWORD.EXE

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

7aebbcd75ea79673da63fee5f95805aa0ca8ef2ce8761faec09d1d0183a3adfc.exeWINWORD.EXELogonUI.exe

pid	process
3068	7aebbcd75ea79673da63fee5f95805aa0ca8ef2ce8761faec09d1d0183a3adfc.exe
3068	7aebbcd75ea79673da63fee5f95805aa0ca8ef2ce8761faec09d1d0183a3adfc.exe
260	WINWORD.EXE
260	WINWORD.EXE
260	WINWORD.EXE
260	WINWORD.EXE
260	WINWORD.EXE
260	WINWORD.EXE
260	WINWORD.EXE
4436	LogonUI.exe

C:\Users\Admin\AppData\Local\Temp\7aebbcd75ea79673da63fee5f95805aa0ca8ef2ce8761faec09d1d0183a3adfc.exe
"C:\Users\Admin\AppData\Local\Temp\7aebbcd75ea79673da63fee5f95805aa0ca8ef2ce8761faec09d1d0183a3adfc.exe"
1⤵
- Sets desktop wallpaper using registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3068

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\CloseEnable.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:260

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3990855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4436

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

memory/260-132-0x00007FFCE8AF0000-0x00007FFCE8B00000-memory.dmp

Filesize
64KB

Download
memory/260-133-0x00007FFCE8AF0000-0x00007FFCE8B00000-memory.dmp

Filesize
64KB

Download
memory/260-134-0x00007FFCE8AF0000-0x00007FFCE8B00000-memory.dmp

Filesize
64KB

Download
memory/260-135-0x00007FFCE8AF0000-0x00007FFCE8B00000-memory.dmp

Filesize
64KB

Download
memory/260-136-0x00007FFCE8AF0000-0x00007FFCE8B00000-memory.dmp

Filesize
64KB

Download
memory/260-137-0x00007FFCE6700000-0x00007FFCE6710000-memory.dmp

Filesize
64KB

Download
memory/260-138-0x00007FFCE6700000-0x00007FFCE6710000-memory.dmp

Filesize
64KB

Download
memory/260-140-0x00007FFCE8AF0000-0x00007FFCE8B00000-memory.dmp

Filesize
64KB

Download
memory/260-142-0x00007FFCE8AF0000-0x00007FFCE8B00000-memory.dmp

Filesize
64KB

Download
memory/260-141-0x00007FFCE8AF0000-0x00007FFCE8B00000-memory.dmp

Filesize
64KB

Download
memory/260-143-0x00007FFCE8AF0000-0x00007FFCE8B00000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads