General
-
Target
exploits
-
Size
24KB
-
Sample
240731-lg1xcsxdkq
-
MD5
ee502c9b199d0f6ba2e3646c992980ec
-
SHA1
8e144ae77cd7cfcf38c6f1816ba1d7b5941593ef
-
SHA256
dd4999b97ad8f28ff37f8a7be47b3da151cda1fd5f734e16b138c9d3bccf2e40
-
SHA512
d4afc198ac94803dcdf549344b94890c319aa5af790fe93a61befb714b70ac51892e5b23230aff03d1daae034f539cde9ca17a04567a97f6d9cbd1ddc211573c
-
SSDEEP
768:7rTilU9RC9fvOflS5/u01/8xWApJingqna03O7m7Y7dMdsx3wfc5BvSJKNjl1eqU:rilU9RC9fWflS5/u0/8xWAringqna03t
Static task
static1
Behavioral task
behavioral1
Sample
exploits.html
Resource
win11-20240730-en
Malware Config
Extracted
C:\Users\Admin\Downloads\@[email protected]
wannacry
12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw
Targets
-
-
Target
exploits
-
Size
24KB
-
MD5
ee502c9b199d0f6ba2e3646c992980ec
-
SHA1
8e144ae77cd7cfcf38c6f1816ba1d7b5941593ef
-
SHA256
dd4999b97ad8f28ff37f8a7be47b3da151cda1fd5f734e16b138c9d3bccf2e40
-
SHA512
d4afc198ac94803dcdf549344b94890c319aa5af790fe93a61befb714b70ac51892e5b23230aff03d1daae034f539cde9ca17a04567a97f6d9cbd1ddc211573c
-
SSDEEP
768:7rTilU9RC9fvOflS5/u01/8xWApJingqna03O7m7Y7dMdsx3wfc5BvSJKNjl1eqU:rilU9RC9fWflS5/u0/8xWAringqna03t
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Downloads MZ/PE file
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies file permissions
-
Adds Run key to start application
-
File and Directory Permissions Modification: Windows File and Directory Permissions Modification
-
Legitimate hosting services abused for malware hosting/C2
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Defense Evasion
File and Directory Permissions Modification
2Windows File and Directory Permissions Modification
1Hide Artifacts
1Hidden Files and Directories
1Indicator Removal
1File Deletion
1Modify Registry
3Subvert Trust Controls
1SIP and Trust Provider Hijacking
1