Overview

overview

10

Static

static

@WanaDecryptor@.exe

windows7-x64

10

@WanaDecryptor@.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    90s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-01-2023 10:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    @WanaDecryptor@.exe

  • Size

    240KB

  • MD5

    7bf2b57f2a205768755c07f238fb32cc

  • SHA1

    45356a9dd616ed7161a3b9192e2f318d0ab5ad10

  • SHA256

    b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25

  • SHA512

    91a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9

  • SSDEEP

    3072:Rmrhd5U1eigWcR+uiUg6p4FLlG4tlL8z+mmCeHFZjoHEo3m:REd5+IZiZhLlG4AimmCo

Score
10/10
wannacryransomwareworm

Malware Config

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\@WanaDecryptor@.exe
    "C:\Users\Admin\AppData\Local\Temp\@WanaDecryptor@.exe"
    1⤵
    • Sets desktop wallpaper using registry
    • Suspicious use of SetWindowsHookEx
    PID:4864

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Defacement

1
T1491

Replay Monitor

Loading Replay Monitor...

Downloads