wannacry | be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844

Resubmissions

09/10/2024, 12:00

241009-n6erjatfnk 10

09/10/2024, 06:17

241009-g127baxekr 10

Analysis

max time kernel
55s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 06:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WannaCry.exe
Size

224KB
MD5

5c7fb0927db37372da25f270708103a2
SHA1

120ed9279d85cbfa56e5b7779ffa7162074f7a29
SHA256

be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844
SHA512

a15f97fad744ccf5f620e5aabb81f48507327b898a9aa4287051464019e0f89224c484e9691812e166471af9beaddcfc3deb2ba878658761f4800663beef7206
SSDEEP

3072:Y059femWRwTs/dbelj0X8/j84pcRXPlU3Upt3or4H84lK8PtpLzLsR/EfcZ:+5RwTs/dSXj84mRXPemxdBlPvLzLeZ

Score

10^/10

wannacry defense_evasion discovery execution impact persistence ransomware spyware stealer worm

Malware Config

Extracted

Path

C:\Users\Admin\Documents\!Please Read Me!.txt

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �

Wallets

15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SDA8D5.tmp	WannaCry.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SDA8D9.tmp	WannaCry.exe

Executes dropped EXE 4 IoCs

pid	Process
2752	!WannaDecryptor!.exe
2220	!WannaDecryptor!.exe
1960	!WannaDecryptor!.exe
3020	!WannaDecryptor!.exe

Loads dropped DLL 9 IoCs

pid	Process
2184	cscript.exe
2700	WannaCry.exe
2700	WannaCry.exe
2700	WannaCry.exe
2700	WannaCry.exe
2540	cmd.exe
2540	cmd.exe
2700	WannaCry.exe
2700	WannaCry.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Update Task Scheduler = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WannaCry.exe\" /r"	WannaCry.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\!WannaCryptor!.bmp"	!WannaDecryptor!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Pictures\\My Wallpaper.jpg"	!WannaDecryptor!.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WannaCry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
3004	vssadmin.exe

Kills process with taskkill 4 IoCs

evasion

pid	Process
3008	taskkill.exe
3004	taskkill.exe
2840	taskkill.exe
1692	taskkill.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

description	pid	Process
Token: SeDebugPrivilege	1692	taskkill.exe
Token: SeDebugPrivilege	2840	taskkill.exe
Token: SeDebugPrivilege	3008	taskkill.exe
Token: SeDebugPrivilege	3004	taskkill.exe
Token: SeBackupPrivilege	2160	vssvc.exe
Token: SeRestorePrivilege	2160	vssvc.exe
Token: SeAuditPrivilege	2160	vssvc.exe
Token: SeIncreaseQuotaPrivilege	2896	WMIC.exe
Token: SeSecurityPrivilege	2896	WMIC.exe
Token: SeTakeOwnershipPrivilege	2896	WMIC.exe
Token: SeLoadDriverPrivilege	2896	WMIC.exe
Token: SeSystemProfilePrivilege	2896	WMIC.exe
Token: SeSystemtimePrivilege	2896	WMIC.exe
Token: SeProfSingleProcessPrivilege	2896	WMIC.exe
Token: SeIncBasePriorityPrivilege	2896	WMIC.exe
Token: SeCreatePagefilePrivilege	2896	WMIC.exe
Token: SeBackupPrivilege	2896	WMIC.exe
Token: SeRestorePrivilege	2896	WMIC.exe
Token: SeShutdownPrivilege	2896	WMIC.exe
Token: SeDebugPrivilege	2896	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2896	WMIC.exe
Token: SeRemoteShutdownPrivilege	2896	WMIC.exe
Token: SeUndockPrivilege	2896	WMIC.exe
Token: SeManageVolumePrivilege	2896	WMIC.exe
Token: 33	2896	WMIC.exe
Token: 34	2896	WMIC.exe
Token: 35	2896	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2896	WMIC.exe
Token: SeSecurityPrivilege	2896	WMIC.exe
Token: SeTakeOwnershipPrivilege	2896	WMIC.exe
Token: SeLoadDriverPrivilege	2896	WMIC.exe
Token: SeSystemProfilePrivilege	2896	WMIC.exe
Token: SeSystemtimePrivilege	2896	WMIC.exe
Token: SeProfSingleProcessPrivilege	2896	WMIC.exe
Token: SeIncBasePriorityPrivilege	2896	WMIC.exe
Token: SeCreatePagefilePrivilege	2896	WMIC.exe
Token: SeBackupPrivilege	2896	WMIC.exe
Token: SeRestorePrivilege	2896	WMIC.exe
Token: SeShutdownPrivilege	2896	WMIC.exe
Token: SeDebugPrivilege	2896	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2896	WMIC.exe
Token: SeRemoteShutdownPrivilege	2896	WMIC.exe
Token: SeUndockPrivilege	2896	WMIC.exe
Token: SeManageVolumePrivilege	2896	WMIC.exe
Token: 33	2896	WMIC.exe
Token: 34	2896	WMIC.exe
Token: 35	2896	WMIC.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3020	!WannaDecryptor!.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2752	!WannaDecryptor!.exe
2752	!WannaDecryptor!.exe
2220	!WannaDecryptor!.exe
2220	!WannaDecryptor!.exe
1960	!WannaDecryptor!.exe
1960	!WannaDecryptor!.exe
3020	!WannaDecryptor!.exe
3020	!WannaDecryptor!.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 2580	2700	WannaCry.exe	30
PID 2700 wrote to memory of 2580	2700	WannaCry.exe	30
PID 2700 wrote to memory of 2580	2700	WannaCry.exe	30
PID 2700 wrote to memory of 2580	2700	WannaCry.exe	30
PID 2580 wrote to memory of 2184	2580	cmd.exe	32
PID 2580 wrote to memory of 2184	2580	cmd.exe	32
PID 2580 wrote to memory of 2184	2580	cmd.exe	32
PID 2580 wrote to memory of 2184	2580	cmd.exe	32
PID 2700 wrote to memory of 2752	2700	WannaCry.exe	33
PID 2700 wrote to memory of 2752	2700	WannaCry.exe	33
PID 2700 wrote to memory of 2752	2700	WannaCry.exe	33
PID 2700 wrote to memory of 2752	2700	WannaCry.exe	33
PID 2700 wrote to memory of 2840	2700	WannaCry.exe	34
PID 2700 wrote to memory of 2840	2700	WannaCry.exe	34
PID 2700 wrote to memory of 2840	2700	WannaCry.exe	34
PID 2700 wrote to memory of 2840	2700	WannaCry.exe	34
PID 2700 wrote to memory of 1692	2700	WannaCry.exe	35
PID 2700 wrote to memory of 1692	2700	WannaCry.exe	35
PID 2700 wrote to memory of 1692	2700	WannaCry.exe	35
PID 2700 wrote to memory of 1692	2700	WannaCry.exe	35
PID 2700 wrote to memory of 3008	2700	WannaCry.exe	38
PID 2700 wrote to memory of 3008	2700	WannaCry.exe	38
PID 2700 wrote to memory of 3008	2700	WannaCry.exe	38
PID 2700 wrote to memory of 3008	2700	WannaCry.exe	38
PID 2700 wrote to memory of 3004	2700	WannaCry.exe	39
PID 2700 wrote to memory of 3004	2700	WannaCry.exe	39
PID 2700 wrote to memory of 3004	2700	WannaCry.exe	39
PID 2700 wrote to memory of 3004	2700	WannaCry.exe	39
PID 2700 wrote to memory of 2220	2700	WannaCry.exe	44
PID 2700 wrote to memory of 2220	2700	WannaCry.exe	44
PID 2700 wrote to memory of 2220	2700	WannaCry.exe	44
PID 2700 wrote to memory of 2220	2700	WannaCry.exe	44
PID 2700 wrote to memory of 2540	2700	WannaCry.exe	45
PID 2700 wrote to memory of 2540	2700	WannaCry.exe	45
PID 2700 wrote to memory of 2540	2700	WannaCry.exe	45
PID 2700 wrote to memory of 2540	2700	WannaCry.exe	45
PID 2540 wrote to memory of 1960	2540	cmd.exe	47
PID 2540 wrote to memory of 1960	2540	cmd.exe	47
PID 2540 wrote to memory of 1960	2540	cmd.exe	47
PID 2540 wrote to memory of 1960	2540	cmd.exe	47
PID 2700 wrote to memory of 3020	2700	WannaCry.exe	48
PID 2700 wrote to memory of 3020	2700	WannaCry.exe	48
PID 2700 wrote to memory of 3020	2700	WannaCry.exe	48
PID 2700 wrote to memory of 3020	2700	WannaCry.exe	48
PID 1960 wrote to memory of 1452	1960	!WannaDecryptor!.exe	50
PID 1960 wrote to memory of 1452	1960	!WannaDecryptor!.exe	50
PID 1960 wrote to memory of 1452	1960	!WannaDecryptor!.exe	50
PID 1960 wrote to memory of 1452	1960	!WannaDecryptor!.exe	50
PID 1452 wrote to memory of 3004	1452	cmd.exe	52
PID 1452 wrote to memory of 3004	1452	cmd.exe	52
PID 1452 wrote to memory of 3004	1452	cmd.exe	52
PID 1452 wrote to memory of 3004	1452	cmd.exe	52
PID 1452 wrote to memory of 2896	1452	cmd.exe	54
PID 1452 wrote to memory of 2896	1452	cmd.exe	54
PID 1452 wrote to memory of 2896	1452	cmd.exe	54
PID 1452 wrote to memory of 2896	1452	cmd.exe	54

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\WannaCry.exe
"C:\Users\Admin\AppData\Local\Temp\WannaCry.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Windows\SysWOW64\cmd.exe
  cmd /c 142141728454636.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2580
- - C:\Windows\SysWOW64\cscript.exe
    cscript //nologo c.vbs
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2184
- C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
  !WannaDecryptor!.exe f
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2752
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im MSExchange*
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2840
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im Microsoft.Exchange.*
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1692
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im sqlserver.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3008
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im sqlwriter.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3004
- C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
  !WannaDecryptor!.exe c
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2220
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c start /b !WannaDecryptor!.exe v
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2540
- - C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
    !WannaDecryptor!.exe v
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1960
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1452
    - - C:\Windows\SysWOW64\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        5⤵
        System Location Discovery: System Language Discovery
        Interacts with shadow copies
        
        PID:3004
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2896
- C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
  !WannaDecryptor!.exe
  2⤵
  - Executes dropped EXE
  - Sets desktop wallpaper using registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:3020

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\128.png.WCRY

Filesize
8KB

MD5
68c29b4466e652834a6cc18634e3b0c1

SHA1
0a1256e1d0b26e769b50dd55b62a253c7a67b592

SHA256
c28c5f5a4aefbbf874689fd691c2bd1cc73545567add02fb7bf0ec08764dad11

SHA512
d1516603700fa373674b149bcaa531a13c32311cc56d444e14700d15759ac724a812f595b0fde17c255a4f15262bf9893bc6cb23180eeb2a56734cc81c6b1c89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1024.db.WCRY

Filesize
312B

MD5
1a304732a8c34dad2bec6ab26831905b

SHA1
e6617e16975db323d334a88ad8fd75cc34ceea9a

SHA256
18dbc8b0db9034e86433f30920b1fe8798fd4d4b56d96081cec9ae15f4b28dbe

SHA512
bcd3ab0d17f98fd164ff63d9fd1b6165e045d5d9047febf16322612da524f0cedc2eec3fd5f61e91bd438ae81fa8f6a0013151d54fb762475b736384672819dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe

Filesize
236KB

MD5
cf1416074cd7791ab80a18f9e7e219d9

SHA1
276d2ec82c518d887a8a3608e51c56fa28716ded

SHA256
78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df

SHA512
0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe.lnk

Filesize
925B

MD5
ddb81d01af178b7fac1080d15577cfc9

SHA1
d8f9faa4235842c86dd12fe2406e38e415d69f7a

SHA256
d47b3785ec9e673348f1e82ad58dcd7a24002d59915ea68bfdb82abfc797d1fa

SHA512
f137dcf088e268c6491c91440b6e6e6822e04bf86c72ed551b00d1a76301b757474186576a0a7d73b97ea4edf6c2c67a9d55f5808b9e1a4dc97b1240af7fa040

Download Submit
C:\Users\Admin\AppData\Local\Temp\00000000.res

Filesize
136B

MD5
7ef545c755aeb71588a88e704415f4ae

SHA1
9d8eede5b49f7081d507436913f017321284fa98

SHA256
fe0f2650dc923a03870070964ea174941ee09b5d0f9211b0248f871de23e498d

SHA512
b9710ad713353c0b23ccfbacf63a47eeedc6ea1ec3460b53817f7541d0bfa9164a3c948cb6aae540da27bc20a10eac98e9e5a50e59853a3d5d0410bee9a3f277

Download Submit
C:\Users\Admin\AppData\Local\Temp\00000000.res

Filesize
136B

MD5
9bfcb8352943aa11d1787984e1b44041

SHA1
001f14320e0232592298d8d0ae71cd33a8270b24

SHA256
4e295ed125cdba3f31a72a58a59c976a0a58703a758024b4093c619eb28b9b28

SHA512
152598d00b3f361b3b379087e4677721502617154ebf5a1ddad875bd59e04905ac8fc14fd03bc9062b47a5b52e16b429fed5bb329c034838828600ddd030b951

Download Submit
C:\Users\Admin\AppData\Local\Temp\00000000.res

Filesize
136B

MD5
26026887d9874746e11c0da940149654

SHA1
65703733251d94e28bf691d9d9618d6c39514f21

SHA256
532ea6da11ef981f228e157d4f3d9ab07973ec1e0fd2f34d07197e954539f8c6

SHA512
c72c3bf031c82567e9895ea0223d899bb65055769042723f5379da496650f9aaf935541c502f942a04e71b9a647feb17cdd291c86b5b5b967ac9873041773344

Download Submit
C:\Users\Admin\AppData\Local\Temp\142141728454636.bat

Filesize
336B

MD5
3540e056349c6972905dc9706cd49418

SHA1
492c20442d34d45a6d6790c720349b11ec591cde

SHA256
73872a89440a2cba9d22bf4961c3d499ea2c72979c30c455f942374292fedadc

SHA512
c949d147100aef59e382c03abf7b162ae62a4d43456eebd730fbedcf5f95f5e1a24f6e349690d52d75331878a6ee8f6b88a7162ee9cf2a49e142196b12d0133c

Download Submit
C:\Users\Admin\AppData\Local\Temp\c.vbs

Filesize
219B

MD5
5f6d40ca3c34b470113ed04d06a88ff4

SHA1
50629e7211ae43e32060686d6be17ebd492fd7aa

SHA256
0fb5039a2fe7e90cdf3f22140d7f2103f94689b15609efe0edcc8430dd772fc1

SHA512
4d4aa1abd2c9183202fd3f0a65b37f07ee0166ba6561f094c13c8ea59752c7bdd960e37c49583746d4464bc3b1dc0b63a1fe36a37ce7e5709cd76ed433befe35

Download Submit
C:\Users\Admin\AppData\Local\Temp\c.wry

Filesize
628B

MD5
205ae8057a338e8d6498b3b2523c81ce

SHA1
3e6d03fc223d7c09a96829adcd3758d52b532d58

SHA256
597fe841949fa0a5395907216a59e2452f91bdd1c6ea17ff7b1bbb83bb3c105b

SHA512
bf57d718ce91b78bfd28180d2b934e88879d59f55d1f63b3740e7e2978c3df8f29903c709c28fc5fcb45934a8bd43ac32e0db2ab30c5fba6ea6a16e7c79df0d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\f.wry

Filesize
558B

MD5
3edf626e1749ec762c7132a4319435f5

SHA1
81ffb52a551fe5d01f260c7b2d112585af2e7459

SHA256
f28d3a8a5b7133231cb33e9faac9bbb679e0f0a71b13905fb42c7fe4dba07f87

SHA512
a2ec15213a6e27bcae37490bb86b6386ecddbf157ec01ef5c55374ea44fe64108746c82227f1fc1d6f5d0c40be9e444dcc776e32052013fc0d1e2212ea0f9bf7

Download Submit
C:\Users\Admin\AppData\Local\Temp\m.wry

Filesize
42KB

MD5
980b08bac152aff3f9b0136b616affa5

SHA1
2a9c9601ea038f790cc29379c79407356a3d25a3

SHA256
402046ada270528c9ac38bbfa0152836fe30fb8e12192354e53b8397421430d9

SHA512
100cda1f795781042b012498afd783fd6ff03b0068dbd07b2c2e163cd95e6c6e00755ce16b02b017693c9febc149ed02df9df9b607e2b9cca4b07e5bd420f496

Download Submit
C:\Users\Admin\AppData\Roaming\ExitSet.xltx.WCRY

Filesize
164KB

MD5
8f122a6460c43ce71c4770eaf2742241

SHA1
93ce16fbcaab5bd4450924a930d96b4e01df659b

SHA256
cfaef140786947a42f1ac4bc266f9f5d5b8cbff6fc5d6357d9159db79457182d

SHA512
d2961eb3f7fff24c87bc0e07fff77ed8acfb75126936812c894396a1bdd5c08402a7e8f2b1c5185f90a22f505ebf8591dbb3885868ca83fa2faf576ef1b6e878

Download Submit
C:\Users\Admin\Documents\!Please Read Me!.txt

Filesize
797B

MD5
afa18cf4aa2660392111763fb93a8c3d

SHA1
c219a3654a5f41ce535a09f2a188a464c3f5baf5

SHA256
227082c719fd4394c1f2311a0877d8a302c5b092bcc49f853a5cf3d2945f42b0

SHA512
4161f250d59b7d4d4a6c4f16639d66d21b2a9606de956d22ec00bedb006643fedbbb8e4cde9f6c0c977285918648314883ca91f3442d1125593bf2605f2d5c6b

Download Submit
C:\Users\Admin\Downloads\LockRegister.ppsx.WCRY

Filesize
1.1MB

MD5
683bad6c61a09f9df8e2de4b5b66e206

SHA1
1925611808358dd58a51ba2db53d6bd11fdd6d72

SHA256
476bcc9b78e3702213d5e1dc909a18088f2bc46d1b066437ada5cc6ac95d2e60

SHA512
4ce2cb85b7bab1cc684886ac454b29f2808700ead72cdf6d608c743de4d7df15f0f38277e9a9c939d7bccf5e6508b598b839be4d174759baba725b3086b2c054

Download Submit
C:\Users\Admin\Downloads\RemoveInstall.pptx.WCRY

Filesize
554KB

MD5
d332b3acd71fa335f9d04f24249fb9b8

SHA1
0d4c990b9b38b46f6b0c3fa28cd748a75b70eaaf

SHA256
18f877067b0642d8d0558e3fac95f4093073920290b2a60e70e81a5580e8c599

SHA512
612db192e7baaa504b20ba58ac0bceabe6f2228917174b467380d19cadfc9fae7d79a67757044bfbf608d1c96dcd7faa57612cce10a7bef7b269615c9d7ada3c

Download Submit
C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile25.bmp.WCRY

Filesize
48KB

MD5
c16bea82a371acf4fec3b08405047d1e

SHA1
cae897f98138f4edb911b317c42b475d5f2bc516

SHA256
6ba74116b5cabe84d617603a5eace9d09d14396866f474cf1adcdd8de61d3913

SHA512
20189deb65642157ee94409922e0bb95cad02f237742c777907fa587f0accab589d3b5fe552446ec2302a689705ff013dec2b0b08350a508cab5bf0a9ed750c5

Download Submit
C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile40.bmp.WCRY

Filesize
48KB

MD5
8da66afaad2346e2118811c5f8956b49

SHA1
a2f278168868f30608791545d4237d5e13785da3

SHA256
d5b16d4abee369eb2ae548dcfc18cc12ce02a1a52cdb9a97a6d8d31a8818e785

SHA512
7609a1e69110ff8c4be3025d7fdd397b16531614f44452cdf56a513302dff5ce48f45914c80c409af502f1f3b42d439dd3b64dfb6e5640b173ee2ae8430e8d53

Download Submit
memory/2700-6-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads