General
-
Target
Windows11InstallationAssistant.exe
-
Size
4.0MB
-
Sample
240419-j1w2eace55
-
MD5
9efe0c8b7f96c1a7d5bdd52bf07d009d
-
SHA1
dc6ff2f1c0af472cdc81b05f876c10420a6bbb78
-
SHA256
03a9b3163071ecb41e20b95eb664c3165b9fcaba89f5e5433484d65e8cfa0380
-
SHA512
b66772e1faeff8c607b6624106530945997fe2105569cbf92cf0eaa31f7bd02ed46b74bae6e9d79b6f51da76445564ed73fe9eb2a6507e3ce5d543781ba227fb
-
SSDEEP
98304:Fguv/rctyMh4cCE3p8fuCNCzLX/sA2uQqvAVGht5f/LyXtcH//9:SVtyMh9CVPUDk+4QjyXa
Static task
static1
Behavioral task
behavioral1
Sample
Windows11InstallationAssistant.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@Please_Read_Me@.txt
wannacry
115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn
Targets
-
-
Target
Windows11InstallationAssistant.exe
-
Size
4.0MB
-
MD5
9efe0c8b7f96c1a7d5bdd52bf07d009d
-
SHA1
dc6ff2f1c0af472cdc81b05f876c10420a6bbb78
-
SHA256
03a9b3163071ecb41e20b95eb664c3165b9fcaba89f5e5433484d65e8cfa0380
-
SHA512
b66772e1faeff8c607b6624106530945997fe2105569cbf92cf0eaa31f7bd02ed46b74bae6e9d79b6f51da76445564ed73fe9eb2a6507e3ce5d543781ba227fb
-
SSDEEP
98304:Fguv/rctyMh4cCE3p8fuCNCzLX/sA2uQqvAVGht5f/LyXtcH//9:SVtyMh9CVPUDk+4QjyXa
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies file permissions
-
Uses the VBS compiler for execution
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-
Sets desktop wallpaper using registry
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1