General
-
Target
Trading.docx
-
Size
203KB
-
Sample
240618-ppr6zaxfrj
-
MD5
0848cad87734eda3d07e5c1f4421df54
-
SHA1
a3b15ddaadabbd04fb5d8e45195371830bada2ed
-
SHA256
64b11a8ac6bde59c9d0446ef7133657080e0709ccafb2583764662150cec6b7e
-
SHA512
a2441f2636ad9f157a3f75ce79afd2f42382326d989524988b363292648d723e957cb0bafd025852f88fc2953239ea9be65ada723d178a20c406c21a807ffc61
-
SSDEEP
6144:0PnI1dobp1tYnkbeUmeMIHv/R7CKpybx/B0K0o94:0PI1dobp7IQeUXMwCKpybt0o+
Static task
static1
Behavioral task
behavioral1
Sample
Trading.docx
Resource
win11-20240508-en
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
wannacry
12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw
Targets
-
-
Target
Trading.docx
-
Size
203KB
-
MD5
0848cad87734eda3d07e5c1f4421df54
-
SHA1
a3b15ddaadabbd04fb5d8e45195371830bada2ed
-
SHA256
64b11a8ac6bde59c9d0446ef7133657080e0709ccafb2583764662150cec6b7e
-
SHA512
a2441f2636ad9f157a3f75ce79afd2f42382326d989524988b363292648d723e957cb0bafd025852f88fc2953239ea9be65ada723d178a20c406c21a807ffc61
-
SSDEEP
6144:0PnI1dobp1tYnkbeUmeMIHv/R7CKpybx/B0K0o94:0PI1dobp7IQeUXMwCKpybt0o+
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies file permissions
-
Adds Run key to start application
-
File and Directory Permissions Modification: Windows File and Directory Permissions Modification
-
Legitimate hosting services abused for malware hosting/C2
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1