wannacry | 76fbe13d3f8930fbe883af17dd46eb301feb93c2aa522ec5f861c4e1822e20c3

Resubmissions

11/07/2023, 21:30

230711-1cn5bsbh3x10

10/07/2023, 22:18

230710-179phseh3t10

10/07/2023, 18:24

230710-w2celscf7210

Analysis

max time kernel
97s
max time network
106s
platform
windows10-1703_x64
resource
win10-20230703-en
resource tags

arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
submitted
10/07/2023, 22:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
da8847549d8b25exeexeexeex.exe
Size 244KB
Sample230710-179phseh3t
SHA256 76fbe13d3f8930fbe883af17dd46eb301feb93c2aa522ec5f861c4e1822e20c3
MD5 da8847549d8b25dd77863a93c2d0705e
SHA1 d8ae71da2aa83a2eab0cc6461c973c0c37f65a03
SHA512 229a25e9fcf14dae0fb84d6d6ee7d7b3944c8de052588efb7cfdfd29ad22f895de0b0735cffdf2444b5badacd8cb046fe8b0691d0fe14bb40ed0552ead9ec24f
SSDEEP 3072:cmrhm1eigTcR+uiUg6p4FLlG4tlLGQ+mmCEHFZxoHEo3m:cEgNZiZhLlG4SvmmC4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

wannacry ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4175128012-676912335-1083716439-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	da8847549d8b25exeexeexeex.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4768	da8847549d8b25exeexeexeex.exe
4768	da8847549d8b25exeexeexeex.exe

C:\Users\Admin\AppData\Local\Temp\da8847549d8b25exeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\da8847549d8b25exeexeexeex.exe"
1⤵
- Sets desktop wallpaper using registry
- Suspicious use of SetWindowsHookEx
PID:4768

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact