Analysis
-
max time kernel
142s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231025-en -
resource tags
arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system -
submitted
21-11-2023 01:49
Static task
static1
Behavioral task
behavioral1
Sample
368ecd6e169f383979f7b7861c5f0891b7030f8bac5b80e27c76da39deb83ac2.x.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
368ecd6e169f383979f7b7861c5f0891b7030f8bac5b80e27c76da39deb83ac2.x.exe
Resource
win10v2004-20231025-en
General
-
Target
368ecd6e169f383979f7b7861c5f0891b7030f8bac5b80e27c76da39deb83ac2.x.exe
-
Size
2.9MB
-
MD5
8fbfefe64f78e41f5619e9f07b34eb47
-
SHA1
c1c2af9247b833b3e871a4e9158b099a3948d64e
-
SHA256
368ecd6e169f383979f7b7861c5f0891b7030f8bac5b80e27c76da39deb83ac2
-
SHA512
42a7de0129d052b43e24971ee6267999d7f48e4f10fb2ec90d947f55f2eabf7e5bae1a9937de6f1e9245c8078b4e90cc470d22255b4fbc93f4e79aab2c113ee6
-
SSDEEP
6144:j/jhHGXR/BsheZM5wnH2m9pD6UgmryJOk55ndwz7AYjK8RTI5JN4jnpK:j/0XHsheSAH2GD3uOAwP5ZI5z4jpK
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
368ecd6e169f383979f7b7861c5f0891b7030f8bac5b80e27c76da39deb83ac2.x.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-177160434-2093019976-369403398-1000\Control Panel\Desktop\Wallpaper = ".\\wallpaper\\WanaDecryptor.bmp" 368ecd6e169f383979f7b7861c5f0891b7030f8bac5b80e27c76da39deb83ac2.x.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
368ecd6e169f383979f7b7861c5f0891b7030f8bac5b80e27c76da39deb83ac2.x.exedescription pid process Token: SeDebugPrivilege 2180 368ecd6e169f383979f7b7861c5f0891b7030f8bac5b80e27c76da39deb83ac2.x.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\368ecd6e169f383979f7b7861c5f0891b7030f8bac5b80e27c76da39deb83ac2.x.exe"C:\Users\Admin\AppData\Local\Temp\368ecd6e169f383979f7b7861c5f0891b7030f8bac5b80e27c76da39deb83ac2.x.exe"1⤵
- Sets desktop wallpaper using registry
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2180-0-0x000002171DB10000-0x000002171DE04000-memory.dmpFilesize
3.0MB
-
memory/2180-1-0x00007FFBFFD60000-0x00007FFC00821000-memory.dmpFilesize
10.8MB
-
memory/2180-2-0x0000021738410000-0x0000021738420000-memory.dmpFilesize
64KB
-
memory/2180-5-0x0000021738410000-0x0000021738420000-memory.dmpFilesize
64KB
-
memory/2180-6-0x00007FFBFFD60000-0x00007FFC00821000-memory.dmpFilesize
10.8MB
-
memory/2180-7-0x0000021738410000-0x0000021738420000-memory.dmpFilesize
64KB
-
memory/2180-8-0x0000021738410000-0x0000021738420000-memory.dmpFilesize
64KB
-
memory/2180-9-0x0000021738410000-0x0000021738420000-memory.dmpFilesize
64KB