General
-
Target
Lol.exe
-
Size
707KB
-
Sample
240605-j8a4xaaf61
-
MD5
dbd981f4901d297f4a7bf0134a09349c
-
SHA1
ce188646d85daeb2ade3320d477e91c7419e1166
-
SHA256
6bbe96ab56f23f208768ba47f6400f53aaa0f3704249d29812b286d5841469af
-
SHA512
ea498ac3c23de53f5031fdfee6a55d8d1c8cc9fb5d9dfacb61fc77fd7214988516450090ad79fe23d29183fd352e632727aaedbe819119f3ef4b38f6d6de1d87
-
SSDEEP
12288:YV7eOAfPMVeOAf7WnKaULUyKP6NGP3hFnQW:YV7eOBVeOcvGzj
Static task
static1
Behavioral task
behavioral1
Sample
Lol.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Lol.exe
Resource
win10v2004-20240426-en
Malware Config
Extracted
C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
wannacry
115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn
Targets
-
-
Target
Lol.exe
-
Size
707KB
-
MD5
dbd981f4901d297f4a7bf0134a09349c
-
SHA1
ce188646d85daeb2ade3320d477e91c7419e1166
-
SHA256
6bbe96ab56f23f208768ba47f6400f53aaa0f3704249d29812b286d5841469af
-
SHA512
ea498ac3c23de53f5031fdfee6a55d8d1c8cc9fb5d9dfacb61fc77fd7214988516450090ad79fe23d29183fd352e632727aaedbe819119f3ef4b38f6d6de1d87
-
SSDEEP
12288:YV7eOAfPMVeOAf7WnKaULUyKP6NGP3hFnQW:YV7eOBVeOcvGzj
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies file permissions
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1