General
-
Target
file
-
Size
312KB
-
Sample
240605-116z2sad9w
-
MD5
450e0aab9f62393eadf03dd1a626c7b4
-
SHA1
5ce12787cbc8e90f2e86596c9edfcd9373ed969b
-
SHA256
832f578406b2c2f5bceae2863a5b9c9177fda71c9c579abe4cbec8522c3381a6
-
SHA512
064e61082e1039f8af2354fa023f42b5437f1c19b8a4bebd01eb30808bd41d81317a6862166d0149e7b2a9adbffd1bc729ab2d994af63a4c916107590c5ea249
-
SSDEEP
3072:RiEgAkHnjPIQ6KSEX/YHZPaW+LN7DxRLlzglKZVnU4:5gAkHnjPIQBSEA5PCN7jBZVnU4
Static task
static1
Behavioral task
behavioral1
Sample
file.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
file.html
Resource
win10v2004-20240426-en
Malware Config
Extracted
C:\Users\Admin\Downloads\@[email protected]
wannacry
13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94
Targets
-
-
Target
file
-
Size
312KB
-
MD5
450e0aab9f62393eadf03dd1a626c7b4
-
SHA1
5ce12787cbc8e90f2e86596c9edfcd9373ed969b
-
SHA256
832f578406b2c2f5bceae2863a5b9c9177fda71c9c579abe4cbec8522c3381a6
-
SHA512
064e61082e1039f8af2354fa023f42b5437f1c19b8a4bebd01eb30808bd41d81317a6862166d0149e7b2a9adbffd1bc729ab2d994af63a4c916107590c5ea249
-
SSDEEP
3072:RiEgAkHnjPIQ6KSEX/YHZPaW+LN7DxRLlzglKZVnU4:5gAkHnjPIQBSEA5PCN7jBZVnU4
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Downloads MZ/PE file
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies file permissions
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Legitimate hosting services abused for malware hosting/C2
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1