General
-
Target
hi nigga.png
-
Size
656KB
-
Sample
231201-wtw42seg2w
-
MD5
4992fd0cfa541f926d7a3d99f5a68841
-
SHA1
dec0b7273715cc6f3fd989f2ea93a1cdce1cc754
-
SHA256
fd179a4f2a3175198307a6696fe1d2ad1a3d6be7cac9600f03a5433a37105e2d
-
SHA512
4c4cb27289df6f99554fdf4f5d7d3a2842ba74414a459b339effc423ecd718c19f45e05f64e2fe97556ab29bdc433dd4345c8fce177cc9dc1d22884e10d9aa05
-
SSDEEP
12288:Lfz4nJ+Ua0oSE9nl3RMpz3sTaB/vr117uJDUJFmktl:jcJ+Ua0ovRcpATQL1FuSFmkD
Static task
static1
Behavioral task
behavioral1
Sample
hi nigga.png
Resource
win10v2004-20231127-en
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
wannacry
13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94
Targets
-
-
Target
hi nigga.png
-
Size
656KB
-
MD5
4992fd0cfa541f926d7a3d99f5a68841
-
SHA1
dec0b7273715cc6f3fd989f2ea93a1cdce1cc754
-
SHA256
fd179a4f2a3175198307a6696fe1d2ad1a3d6be7cac9600f03a5433a37105e2d
-
SHA512
4c4cb27289df6f99554fdf4f5d7d3a2842ba74414a459b339effc423ecd718c19f45e05f64e2fe97556ab29bdc433dd4345c8fce177cc9dc1d22884e10d9aa05
-
SSDEEP
12288:Lfz4nJ+Ua0oSE9nl3RMpz3sTaB/vr117uJDUJFmktl:jcJ+Ua0ovRcpATQL1FuSFmkD
-
Disables Task Manager via registry modification
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies file permissions
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
File and Directory Permissions Modification
1Hide Artifacts
1Hidden Files and Directories
1Indicator Removal
1File Deletion
1Modify Registry
3