Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
2024-05-09_f758060c8c066d38ff369b37dfe66cfd_wannacry
-
Size
3.4MB
-
Sample
240509-fmmzsseg82
-
MD5
f758060c8c066d38ff369b37dfe66cfd
-
SHA1
bf502d70259183f98c1ea2e1bccd8cfd26505252
-
SHA256
3777f15f4a05a75e14afc774ee7aefa3f4f8f001206297c498ecc4580c9a8fbe
-
SHA512
676afd32204db0d1d1556f53fb44a8ef873272334789fd6de98ad5ae08bcaba2478748b23efabe4c97dcfa77b6833d5f5d1efd7eb515298506640c3ab023116f
-
SSDEEP
98304:/qPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2g3x:/qPe1Cxcxk3ZAEUadzR8yc4gB
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-09_f758060c8c066d38ff369b37dfe66cfd_wannacry.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-09_f758060c8c066d38ff369b37dfe66cfd_wannacry.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
C:\Users\Admin\Documents\@[email protected]
wannacry
12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw
Extracted
C:\Users\Admin\AppData\Local\Temp\@[email protected]
wannacry
13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94
Targets
-
-
Target
2024-05-09_f758060c8c066d38ff369b37dfe66cfd_wannacry
-
Size
3.4MB
-
MD5
f758060c8c066d38ff369b37dfe66cfd
-
SHA1
bf502d70259183f98c1ea2e1bccd8cfd26505252
-
SHA256
3777f15f4a05a75e14afc774ee7aefa3f4f8f001206297c498ecc4580c9a8fbe
-
SHA512
676afd32204db0d1d1556f53fb44a8ef873272334789fd6de98ad5ae08bcaba2478748b23efabe4c97dcfa77b6833d5f5d1efd7eb515298506640c3ab023116f
-
SSDEEP
98304:/qPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2g3x:/qPe1Cxcxk3ZAEUadzR8yc4gB
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Detects command variations typically used by ransomware
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies file permissions
-
Adds Run key to start application
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1