Overview

overview

4

Static

static

3

WannaCry.exe

macos-10.15-amd64

4

Resubmissions

28-07-2024 07:07

240728-hxpmgsthmr 10

27-07-2024 18:52

240727-xh78lswhmg 10

29-05-2024 01:42

240529-b4pshaeb68 10

28-05-2024 03:12

240528-dqg7lsdg65 10

28-05-2024 03:08

240528-dnct4sdf86 10

28-05-2024 00:39

240528-az15ashb56 10

26-05-2024 05:03

240526-fp6vpagf79 3

26-05-2024 04:32

240526-e585bafg76 10

26-05-2024 04:29

240526-e4bgnaeh91 10

26-05-2024 04:26

240526-e2y5yaff38 4

Analysis

  • max time kernel
    96s
  • max time network
    99s
  • platform
    macos-10.15_amd64
  • resource
    macos-20240410-en
  • resource tags

    arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    26-05-2024 04:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    WannaCry.exe

  • Size

    3.4MB

  • MD5

    84c82835a5d21bbcf75a61706d8ab549

  • SHA1

    5ff465afaabcbf0150d1a3ab2c2e74f3a4426467

  • SHA256

    ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa

  • SHA512

    90723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244

  • SSDEEP

    98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2g3x:QqPe1Cxcxk3ZAEUadzR8yc4gB

Score
4/10
evasionexecution

Malware Config

Signatures

  • JavaScript 1 TTPs 1 IoCs

    Adversaries may abuse various implementations of JavaScript for execution.

    execution
  • Resource Forking 1 TTPs 1 IoCs

    Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

    evasion

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"/Users/run/WannaCry.exe\""
    1⤵
      PID:485
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"/Users/run/WannaCry.exe\""
      1⤵
        PID:485
      • /usr/bin/sudo
        sudo /bin/zsh -c /Users/run/WannaCry.exe
        1⤵
          PID:485
          • /bin/zsh
            /bin/zsh -c /Users/run/WannaCry.exe
            2⤵
              PID:486
            • /Users/run/WannaCry.exe
              /Users/run/WannaCry.exe
              2⤵
                PID:486
            • /usr/bin/pluginkit
              /usr/bin/pluginkit -e ignore -i com.microsoft.OneDrive.FinderSync
              1⤵
                PID:489
              • /usr/sbin/spctl
                /usr/sbin/spctl --assess --type execute /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/OneDriveUpdater0BF23177/OneDrive.app
                1⤵
                  PID:490
                • /usr/libexec/xpcproxy
                  xpcproxy com.apple.quicklook.ui.helper
                  1⤵
                    PID:530
                  • /System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
                    /System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
                    1⤵
                      PID:530
                    • /usr/libexec/xpcproxy
                      xpcproxy com.apple.JarLauncher.2128
                      1⤵
                        PID:531
                      • /System/Library/CoreServices/Jar Launcher.app/Contents/MacOS/Jar Launcher
                        "/System/Library/CoreServices/Jar Launcher.app/Contents/MacOS/Jar Launcher"
                        1⤵
                          PID:531
                          • /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/java
                            "/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/java" -jar /Users/run/tmp/hello.jar
                            2⤵
                              PID:533
                          • /usr/libexec/xpcproxy
                            xpcproxy com.apple.metadata.mdwrite
                            1⤵
                              PID:532
                            • /usr/libexec/xpcproxy
                              xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
                              1⤵
                                PID:537
                              • /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
                                /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
                                1⤵
                                  PID:537

                                Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads