General
-
Target
ва.txt
-
Size
1KB
-
Sample
240421-sbaxbaeb6v
-
MD5
d7700a2064e24aa15ed6eff834a0b30f
-
SHA1
e0c32082c913a9505e9715c06ceef2d9c7661142
-
SHA256
7267a08112fb350eb8a635fa17ea86e1dbcf7d55d59709cca2417e2c247d9470
-
SHA512
5db898f12c7f9ab4886b036e8119472b240c95db9a27dfaf84957e07613a3fc91fa7ef1450669ca800af3c487f50c89dd17198ae620bbd9d0c635b0ce4de3cd3
Static task
static1
Behavioral task
behavioral1
Sample
ва.txt
Resource
win11-20240412-en
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@Please_Read_Me@.txt
wannacry
12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw
Targets
-
-
Target
ва.txt
-
Size
1KB
-
MD5
d7700a2064e24aa15ed6eff834a0b30f
-
SHA1
e0c32082c913a9505e9715c06ceef2d9c7661142
-
SHA256
7267a08112fb350eb8a635fa17ea86e1dbcf7d55d59709cca2417e2c247d9470
-
SHA512
5db898f12c7f9ab4886b036e8119472b240c95db9a27dfaf84957e07613a3fc91fa7ef1450669ca800af3c487f50c89dd17198ae620bbd9d0c635b0ce4de3cd3
-
Downloads MZ/PE file
-
Drops file in Drivers directory
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies file permissions
-
Modifies system executable filetype association
-
Registers COM server for autorun
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s)
-
Legitimate hosting services abused for malware hosting/C2
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Event Triggered Execution
1Change Default File Association
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Privilege Escalation
Event Triggered Execution
1Change Default File Association
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Defense Evasion
Indicator Removal
1File Deletion
1File and Directory Permissions Modification
1Modify Registry
5Hide Artifacts
1Hidden Files and Directories
1