Extracted

• • Target

    78999[1]

  • Size

    111KB

  • MD5

    00bb206e6e711332d71b1cb740ed77df

  • SHA1

    992bfb30bcf7870a9b20501f4cdc4721a82eb571

  • SHA256

    d12d332a503419991743de6755dde8d860a08ef248bd49b7e67da90273655bf4

  • SHA512

    1acd4e9d7fc7ddf42fc4b3fed7dace79b957bddb99730567def9e88443a6f6db126cc0af1d861a682117eb06ac93a28db6b564a6bd6193b419da517060e757dd

  • SSDEEP

    3072:XywYkVdhEdvYR4NjHQZxxxAMO4Gs4zREx0nZN6EzVtR:C+dhAHNPMO4Gs4zREx0PzN

  Score

  10^/10

  discoverywannacrydefense_evasionevasionexecutionimpactmacromacro_on_actionpersistenceprivilege_escalationransomwarespywarestealertrojanworm

  • Modifies WinLogon for persistence

    persistence

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • UAC bypass

    evasiontrojan

  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Disables RegEdit via registry modification

    evasion

  • Downloads MZ/PE file

  • Office macro that triggers on suspicious action

    Office document macro which triggers in special circumstances - often malicious.

    macromacro_on_action

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops desktop.ini file(s)

  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification

    defense_evasion

  • Legitimate hosting services abused for malware hosting/C2

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2