Overview

overview

9

Static

static

1

2023-04-10...ry.exe

windows7-x64

9

2023-04-10...ry.exe

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    2023-04-10_3b0822abd93a71c61a0ea9b32c5f2a82_wannacry

  • Size

    425KB

  • Sample

    230413-fk3bpshe26

  • MD5

    3b0822abd93a71c61a0ea9b32c5f2a82

  • SHA1

    96e8bd8f27674bfedd79bce5140bbdb8f54ca95c

  • SHA256

    592692ef9e15787367e2cdddf57c5e26e4faa44190be385e56bed1afada1c0cc

  • SHA512

    714f78ff210bc29c410f5d13064a77ed488a73b49b8a8d6df95bc8b955e82d692e6d75c154fde520b8c093c9a6fb84e87e1aecf6d9a6b289d3635242b8d23574

  • SSDEEP

    3072:3kxFxie+HQesvnHwMkrW9OTW+67TiziQ/iXjm4XzthkjXw:3ktpqQes/Hw9rW4q7Tiz8rRhk

Score
9/10
discoveryevasionransomware

Malware Config

Targets

    • Target

      2023-04-10_3b0822abd93a71c61a0ea9b32c5f2a82_wannacry

    • Size

      425KB

    • MD5

      3b0822abd93a71c61a0ea9b32c5f2a82

    • SHA1

      96e8bd8f27674bfedd79bce5140bbdb8f54ca95c

    • SHA256

      592692ef9e15787367e2cdddf57c5e26e4faa44190be385e56bed1afada1c0cc

    • SHA512

      714f78ff210bc29c410f5d13064a77ed488a73b49b8a8d6df95bc8b955e82d692e6d75c154fde520b8c093c9a6fb84e87e1aecf6d9a6b289d3635242b8d23574

    • SSDEEP

      3072:3kxFxie+HQesvnHwMkrW9OTW+67TiziQ/iXjm4XzthkjXw:3ktpqQes/Hw9rW4q7Tiz8rRhk

    Score
    9/10
    discoveryevasionransomware

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

      ransomware

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Modifies file permissions

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks