Resubmissions
13-08-2024 15:37
240813-s2ggsawgmn 613-08-2024 14:19
240813-rmt9naybjf 1028-07-2024 21:45
240728-1l2f1swfkq 1028-07-2024 21:44
240728-1lrlta1and 628-07-2024 07:40
240728-jhm1sawakm 728-07-2024 07:19
240728-h5hh5svcpk 727-07-2024 21:18
240727-z5qyyssgjh 626-07-2024 20:28
240726-y9a8mawcqf 626-07-2024 20:28
240726-y84tjssgnj 6General
-
Target
https://discord.com/channels/@me
-
Sample
240728-1l2f1swfkq
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://discord.com/channels/@me
Resource
win11-20240709-en
Malware Config
Extracted
C:\Users\Admin\Downloads\@[email protected]
wannacry
13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94
Extracted
C:\Users\Admin\Downloads\msg\m_english.wnry
http://schemas.microsoft.com/office/word/2003/wordml}}\paperw12240\paperh15840\margl1501\margr1502\margt1701\margb1440\gutter0\ltrsect
Extracted
C:\Users\Admin\Downloads\r.wnry
wannacry
Targets
-
-
Target
https://discord.com/channels/@me
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Downloads MZ/PE file
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies file permissions
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
File and Directory Permissions Modification: Windows File and Directory Permissions Modification
-
Legitimate hosting services abused for malware hosting/C2
-
Checks system information in the registry
System information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
File and Directory Permissions Modification
2Windows File and Directory Permissions Modification
1Hide Artifacts
1Hidden Files and Directories
1Indicator Removal
1File Deletion
1Modify Registry
3Subvert Trust Controls
1SIP and Trust Provider Hijacking
1