wannacry | 76fbe13d3f8930fbe883af17dd46eb301feb93c2aa522ec5f861c4e1822e20c3

Resubmissions

11-07-2023 21:30

230711-1cn5bsbh3x 10

10-07-2023 22:18

230710-179phseh3t 10

10-07-2023 18:24

230710-w2celscf72 10

Analysis

max time kernel
1610s
max time network
1614s
platform
windows7_x64
resource
win7-20230705-es
resource tags

arch:x64arch:x86image:win7-20230705-eslocale:es-esos:windows7-x64systemwindows
submitted
11-07-2023 21:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

da8847549d8b25exeexeexeex.exe
Size

244KB
MD5

da8847549d8b25dd77863a93c2d0705e
SHA1

d8ae71da2aa83a2eab0cc6461c973c0c37f65a03
SHA256

76fbe13d3f8930fbe883af17dd46eb301feb93c2aa522ec5f861c4e1822e20c3
SHA512

229a25e9fcf14dae0fb84d6d6ee7d7b3944c8de052588efb7cfdfd29ad22f895de0b0735cffdf2444b5badacd8cb046fe8b0691d0fe14bb40ed0552ead9ec24f
SSDEEP

3072:cmrhm1eigTcR+uiUg6p4FLlG4tlLGQ+mmCEHFZxoHEo3m:cEgNZiZhLlG4SvmmC4

Score

10^/10

wannacry ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	da8847549d8b25exeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Pictures\\My Wallpaper.jpg"	da8847549d8b25exeexeexeex.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2924	da8847549d8b25exeexeexeex.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2924	da8847549d8b25exeexeexeex.exe
2924	da8847549d8b25exeexeexeex.exe

C:\Users\Admin\AppData\Local\Temp\da8847549d8b25exeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\da8847549d8b25exeexeexeex.exe"
1⤵
- Sets desktop wallpaper using registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2924

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact