Extracted

• • Target

    yfga_game.exe

  • Size

    10.9MB

  • MD5

    f24b9a4537d2cf5cd04db5ef80453dd8

  • SHA1

    69b201dd4b919afbb4bbe3a19e3e80097e2813bc

  • SHA256

    f31ffc12e2212bd27a5e636aa3667451fe1772bea79cf411eea54b84ac31f107

  • SHA512

    84936e358accff1767411b019639741ed051e7102a2ebde8bc6e74f87adc3e3f36495538ff53edd181eb9e48256a373f0e06da65ce0824680ff631fe09db90f1

  • SSDEEP

    196608:Zw81jWusNrPGC0ePjqHbUjHicQskqPe1Cxcxk3ZAEUadzR8yc4ghrl:O8tWhTr0eqgDiDjqG1Fxk3mEUadzRURH

  Score

  10^/10

  wannacryaspackv2defense_evasiondiscoveryevasionexecutionexploitimpactpersistenceransomwarespywarestealerupxworm

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Blocklisted process makes network request

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Disables Task Manager via registry modification

    evasion

  • Drops file in Drivers directory

  • Manipulates Digital Signatures

    Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

  • Possible privilege escalation attempt

    exploit

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops desktop.ini file(s)

  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification

    defense_evasion

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2