General
-
Target
Byte Guard Free.exe
-
Size
2.4MB
-
Sample
240521-1gfnrabc5t
-
MD5
32eee970bec927fd068197918edac5a4
-
SHA1
8aa4820931aa228856f12fc516f886dab4d12e28
-
SHA256
53eeff9f4fa0473d90cf4abe978ff60d5898d2527924a593ef877303cab88a5b
-
SHA512
d47d2fbc9d4b9a47d0b5b1076aaa89b20ba72a9625e9fcfd57f000bc14abc11aff60123667bbb6998fa5bdff65b7207f410cc6008207fc2362db1d99c80afbe8
-
SSDEEP
49152:3Ls8e8SkGMITYbNbNWo4kSH3OqtwI2MrBm6w30IfRaRf:3PecGMIT4bNJFY3OqtxdmDDJef
Static task
static1
Behavioral task
behavioral1
Sample
Byte Guard Free.exe
Resource
win11-20240426-en
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
wannacry
13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94
Targets
-
-
Target
Byte Guard Free.exe
-
Size
2.4MB
-
MD5
32eee970bec927fd068197918edac5a4
-
SHA1
8aa4820931aa228856f12fc516f886dab4d12e28
-
SHA256
53eeff9f4fa0473d90cf4abe978ff60d5898d2527924a593ef877303cab88a5b
-
SHA512
d47d2fbc9d4b9a47d0b5b1076aaa89b20ba72a9625e9fcfd57f000bc14abc11aff60123667bbb6998fa5bdff65b7207f410cc6008207fc2362db1d99c80afbe8
-
SSDEEP
49152:3Ls8e8SkGMITYbNbNWo4kSH3OqtwI2MrBm6w30IfRaRf:3PecGMIT4bNJFY3OqtxdmDDJef
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies file permissions
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1