Overview

overview

1

Static

static

1

Ransomware...ry.exe

windows7-x64

1

Ransomware...ry.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    210s
  • max time network
    213s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    03-02-2023 13:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Ransomware.wannacry.exe

  • Size

    3.6MB

  • MD5

    db349b97c37d22f5ea1d1841e3c89eb4

  • SHA1

    e889544aff85ffaf8b0d0da705105dee7c97fe26

  • SHA256

    24d004a104d4d54034dbcffc2a4b19a11f39008a575aa614ea04703480b1022c

  • SHA512

    d6c60b8f22f89cbd1262c0aa7ae240577a82002fb149e9127d4edf775a25abcda4e585b6113e79ab4a24bb65f4280532529c2f06f7ffe4d5db45c0caf74fea38

  • SSDEEP

    98304:wDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2g3R:wDqPe1Cxcxk3ZAEUadzR8yc4gB

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Ransomware.wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\Ransomware.wannacry.exe"
    1⤵
      PID:1684
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      1⤵
        PID:584
      • C:\Windows\system32\AUDIODG.EXE
        C:\Windows\system32\AUDIODG.EXE 0x54c
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1432
      • C:\Users\Admin\AppData\Local\Temp\Ransomware.wannacry.exe
        "C:\Users\Admin\AppData\Local\Temp\Ransomware.wannacry.exe"
        1⤵
          PID:912
        • C:\Users\Admin\AppData\Local\Temp\Ransomware.wannacry.exe
          "C:\Users\Admin\AppData\Local\Temp\Ransomware.wannacry.exe"
          1⤵
            PID:1580
          • C:\Users\Admin\AppData\Local\Temp\Ransomware.wannacry.exe
            "C:\Users\Admin\AppData\Local\Temp\Ransomware.wannacry.exe"
            1⤵
              PID:1696
            • C:\Users\Admin\AppData\Local\Temp\Ransomware.wannacry.exe
              "C:\Users\Admin\AppData\Local\Temp\Ransomware.wannacry.exe"
              1⤵
                PID:1596
              • C:\Users\Admin\AppData\Local\Temp\Ransomware.wannacry.exe
                "C:\Users\Admin\AppData\Local\Temp\Ransomware.wannacry.exe"
                1⤵
                  PID:1904
                • C:\Users\Admin\AppData\Local\Temp\Ransomware.wannacry.exe
                  "C:\Users\Admin\AppData\Local\Temp\Ransomware.wannacry.exe"
                  1⤵
                    PID:156

                  Network

                  MITRE ATT&CK Matrix

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • memory/584-55-0x000007FEFC341000-0x000007FEFC343000-memory.dmp

                    Filesize

                    8KB

                    Download

                  • memory/1684-54-0x0000000076401000-0x0000000076403000-memory.dmp

                    Filesize

                    8KB

                    Download