General
-
Target
2023-04-14_c525eb716420dc915fe574b8a3973143_wannacry
-
Size
353KB
-
Sample
230415-ddsskscg75
-
MD5
c525eb716420dc915fe574b8a3973143
-
SHA1
b272f9a63aed4c5ab06e887d3ceb9854f52fa1d7
-
SHA256
083c5b43df8bee2a6235c3f5038cc9860b4a4bfd1675d367a67fcfff93ccfcfb
-
SHA512
24ba34d78e5c295c740e2ec9d0c27c90a25dcad5f330c72929c9e98a64f36f8ab6763c7f9929bc72a31d9b52d11ab17882a3841a75b77b904f4aeb90c768177d
-
SSDEEP
6144:G1/ZVevGFi0Xx6HQpNnCnoed+wBlO18eDKO3wexcXQVkcoHnqyk:WeUjNHCFkw3OCMpxcXiPoKN
Static task
static1
Behavioral task
behavioral1
Sample
2023-04-14_c525eb716420dc915fe574b8a3973143_wannacry.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
2023-04-14_c525eb716420dc915fe574b8a3973143_wannacry.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
C:\Users\Help_me_for_Decrypt.hta
http-equiv="x-ua-compatible"
Extracted
C:\Users\Admin\Music\How To Restore Your Files.txt
Extracted
C:\Users\Admin\AppData\Local\Temp\readme-warning.hta
https://tox.chat/
Extracted
C:\Users\Admin\Music\How To Restore Your Files.txt
Extracted
C:\Users\Admin\AppData\Local\Temp\dllhost.exe
email:>>[email protected]<;<
Targets
-
-
Target
2023-04-14_c525eb716420dc915fe574b8a3973143_wannacry
-
Size
353KB
-
MD5
c525eb716420dc915fe574b8a3973143
-
SHA1
b272f9a63aed4c5ab06e887d3ceb9854f52fa1d7
-
SHA256
083c5b43df8bee2a6235c3f5038cc9860b4a4bfd1675d367a67fcfff93ccfcfb
-
SHA512
24ba34d78e5c295c740e2ec9d0c27c90a25dcad5f330c72929c9e98a64f36f8ab6763c7f9929bc72a31d9b52d11ab17882a3841a75b77b904f4aeb90c768177d
-
SSDEEP
6144:G1/ZVevGFi0Xx6HQpNnCnoed+wBlO18eDKO3wexcXQVkcoHnqyk:WeUjNHCFkw3OCMpxcXiPoKN
Score10/10-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Stops running service(s)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-