General
-
Target
2024-06-30_535de5e322f73414ea048a3a607e438e_wannacry
-
Size
3.4MB
-
Sample
240630-nqwecazgmj
-
MD5
535de5e322f73414ea048a3a607e438e
-
SHA1
9681529766f246ef45cdb6e2657adce9bc9c6d53
-
SHA256
039c30882419d2268bbf84aa5d1a9db07aa8b5ef0969e0e103c0ea6dd2994d62
-
SHA512
f2c00bebc984c6db2f6b54eeb7c1178a3e3a3ab4f7f3415609aa6a39bf48a80ebe534db6f93a992ec148487a2428df8f66260c920990527a7a84afe8dd44bc54
-
SSDEEP
98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2g3F:QqPe1Cxcxk3ZAEUadzR8yc4gV
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-30_535de5e322f73414ea048a3a607e438e_wannacry.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
2024-06-30_535de5e322f73414ea048a3a607e438e_wannacry.exe
Resource
win10v2004-20240611-en
Malware Config
Extracted
C:\Users\Admin\Documents\@[email protected]
wannacry
12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw
Extracted
C:\Users\Admin\AppData\Local\Temp\@[email protected]
wannacry
13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94
Targets
-
-
Target
2024-06-30_535de5e322f73414ea048a3a607e438e_wannacry
-
Size
3.4MB
-
MD5
535de5e322f73414ea048a3a607e438e
-
SHA1
9681529766f246ef45cdb6e2657adce9bc9c6d53
-
SHA256
039c30882419d2268bbf84aa5d1a9db07aa8b5ef0969e0e103c0ea6dd2994d62
-
SHA512
f2c00bebc984c6db2f6b54eeb7c1178a3e3a3ab4f7f3415609aa6a39bf48a80ebe534db6f93a992ec148487a2428df8f66260c920990527a7a84afe8dd44bc54
-
SSDEEP
98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2g3F:QqPe1Cxcxk3ZAEUadzR8yc4gV
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Detects command variations typically used by ransomware
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies file permissions
-
Adds Run key to start application
-
File and Directory Permissions Modification: Windows File and Directory Permissions Modification
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1