wannacry | fdf29c75af39e3765bfe36903f30f5789a4e4e89ae6eb1443f56a89d6dc1b651

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16-06-2024 18:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b497efdbfb51c7c4c695e0c15e745719_JaffaCakes118.exe
Size

240KB
MD5

b497efdbfb51c7c4c695e0c15e745719
SHA1

6aeb4ac212093211bf81294ebd4302c2127335ef
SHA256

fdf29c75af39e3765bfe36903f30f5789a4e4e89ae6eb1443f56a89d6dc1b651
SHA512

974b7b03d821f8afe10724f55ec1b7bb637805eed5b3a17b90ea80f9ec0ef204ef5169e661f53c83a509cc6438a87a50753bdd5dba7adc1a4c8eb2f37166a530
SSDEEP

3072:5mrhd5U1eigWcR+uiUg6p4FLlG4tlL8z+mmCoHFZ1oHEoad:5Ed5+IZiZhLlG4AimmC4

Score

10^/10

wannacry ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

b497efdbfb51c7c4c695e0c15e745719_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	b497efdbfb51c7c4c695e0c15e745719_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

b497efdbfb51c7c4c695e0c15e745719_JaffaCakes118.exe

pid process

4276 b497efdbfb51c7c4c695e0c15e745719_JaffaCakes118.exe
4276 b497efdbfb51c7c4c695e0c15e745719_JaffaCakes118.exe

pid	process
4276	b497efdbfb51c7c4c695e0c15e745719_JaffaCakes118.exe
4276	b497efdbfb51c7c4c695e0c15e745719_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\b497efdbfb51c7c4c695e0c15e745719_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b497efdbfb51c7c4c695e0c15e745719_JaffaCakes118.exe"
1⤵
- Sets desktop wallpaper using registry
- Suspicious use of SetWindowsHookEx
PID:4276

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4040,i,10373433614523925616,13586256558317053467,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:8
1⤵
PID:412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads