Resubmissions
26-02-2024 17:10
240226-vpvjzsbh8x 1026-02-2024 17:07
240226-vm4pwabh5v 1019-02-2024 16:49
240219-vbqnwage7y 10Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
19-02-2024 16:49
Static task
static1
Behavioral task
behavioral1
Sample
240219-tf7brafh73_pw_infected.zip
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral2
Sample
240219-tf7brafh73_pw_infected.zip
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Ransomware.WannaCry.zip
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral4
Sample
Ransomware.WannaCry.zip
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral6
Sample
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
General
-
Target
Ransomware.WannaCry.zip
-
Size
3.3MB
-
MD5
efe76bf09daba2c594d2bc173d9b5cf0
-
SHA1
ba5de52939cb809eae10fdbb7fac47095a9599a7
-
SHA256
707a9f323556179571bc832e34fa592066b1d5f2cac4a7426fe163597e3e618a
-
SHA512
4a1df71925cf2eb49c38f07c6a95bea17752b025f0114c6fd81bc0841c1d1f2965b5dda1469e454b9e8207c2e0dfd3df0959e57166620ccff86eeeb5cf855029
-
SSDEEP
98304:vhvb2BVmAw0p9jIVcEj5nnZNRyA30yBSRT:vhvq7Bu6EZnZN5EyBSN
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1700 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1700 taskmgr.exe -
Suspicious use of FindShellTrayWindow 43 IoCs
pid Process 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe -
Suspicious use of SendNotifyMessage 43 IoCs
pid Process 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Ransomware.WannaCry.zip1⤵PID:2184
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2336
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1700