Extracted

• • Target

    wildfire-test-pe-file.exe

  • Size

    54KB

  • MD5

    a01913203fc4c42d7e05bc8135ddcc24

  • SHA1

    f6a792542cbe386d559700d452f7aea9617325c8

  • SHA256

    9646a1e1b53f02e6b7d559ea0128e7c3f9c76378e02e3e8734064a9df7675cc8

  • SHA512

    50ff3c475cc7b120d0dc2761a2aae118d4d33efc0185001f3ecc2d3508778eef4d0bd2a9a057593bc5f6ba29462c219204b7be2a426f6944e3e394bae93c7635

  • SSDEEP

    768:9/EAAqxG0QqLccK+xL7scaOZ/IcGs8WbwnWh+6AXT2qEDnXbiPGEDUXnpT0rJmnU:CAc0QqgHW7/ZwcF8c6jELX+PupTNj

  Score

  10^/10

  cryptolockerwannacrydefense_evasiondiscoveryevasionexecutionimpactpersistencephishingprivilege_escalationransomwarespywarestealertrojanworm

  • CryptoLocker

    Ransomware family with multiple variants.

    ransomwarecryptolocker

  • Cryptolocker family

    cryptolocker

  • Modifies WinLogon for persistence

    persistence

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • UAC bypass

    evasiontrojan

  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry

  • Wannacry family

    wannacry

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (107) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Disables use of System Restore points

    evasion

  • Downloads MZ/PE file

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • A potential corporate email address has been identified in the URL: [email protected]

    phishing

  • Drops startup file

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Impair Defenses: Safe Mode Boot

    defense_evasion

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1