wannacry | 368ecd6e169f383979f7b7861c5f0891b7030f8bac5b80e27c76da39deb83ac2

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
21-11-2023 01:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

368ecd6e169f383979f7b7861c5f0891b7030f8bac5b80e27c76da39deb83ac2.x.exe
Size

2.9MB
MD5

8fbfefe64f78e41f5619e9f07b34eb47
SHA1

c1c2af9247b833b3e871a4e9158b099a3948d64e
SHA256

368ecd6e169f383979f7b7861c5f0891b7030f8bac5b80e27c76da39deb83ac2
SHA512

42a7de0129d052b43e24971ee6267999d7f48e4f10fb2ec90d947f55f2eabf7e5bae1a9937de6f1e9245c8078b4e90cc470d22255b4fbc93f4e79aab2c113ee6
SSDEEP

6144:j/jhHGXR/BsheZM5wnH2m9pD6UgmryJOk55ndwz7AYjK8RTI5JN4jnpK:j/0XHsheSAH2GD3uOAwP5ZI5z4jpK

Score

10^/10

wannacry ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Control Panel\Desktop\Wallpaper = ".\\wallpaper\\WanaDecryptor.bmp"	368ecd6e169f383979f7b7861c5f0891b7030f8bac5b80e27c76da39deb83ac2.x.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2876	2204	368ecd6e169f383979f7b7861c5f0891b7030f8bac5b80e27c76da39deb83ac2.x.exe	28
PID 2204 wrote to memory of 2876	2204	368ecd6e169f383979f7b7861c5f0891b7030f8bac5b80e27c76da39deb83ac2.x.exe	28
PID 2204 wrote to memory of 2876	2204	368ecd6e169f383979f7b7861c5f0891b7030f8bac5b80e27c76da39deb83ac2.x.exe	28

C:\Users\Admin\AppData\Local\Temp\368ecd6e169f383979f7b7861c5f0891b7030f8bac5b80e27c76da39deb83ac2.x.exe
"C:\Users\Admin\AppData\Local\Temp\368ecd6e169f383979f7b7861c5f0891b7030f8bac5b80e27c76da39deb83ac2.x.exe"
1⤵
- Sets desktop wallpaper using registry
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2204 -s 580
  2⤵
  PID:2876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact