Extracted

• • Target

    MedalSetup.MzAzNDk1ODA1LDEsbm9yZWY=.exe

  • Size

    146.1MB

  • MD5

    c987cbef9f06beb7fd0889b593209aa4

  • SHA1

    bcfb919be91a3fb2374bb07ff5661fe11792edbf

  • SHA256

    1d620c8b5e06dcef6423f6f3d1601539b2461ff9ababdf440c5fd23db2110be9

  • SHA512

    136528652d92d56c66e5a9c2d6cc3a0646e3a3c09c68e831338d8aa9490b73cd46d2947e7c7763ce9ab9b342285a5d0cfc7c2a62cde835b6845390caf8a2280d

  • SSDEEP

    3145728:0K7Rq3JCtTOWfVRrlnSXbZHae+jgvS3YgJRAAlrpc:5qyBfVRZwN6e+U6vRAy

  Score

  10^/10

  wannacryadwaredefense_evasiondiscoveryevasionexecutionimpactmotwpersistencephishingprivilege_escalationransomwarespywarestealertrojanworm

  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry

  • Wannacry family

    wannacry

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to get system information.

    execution

  • A potential corporate email address has been identified in the URL: [email protected]

    phishing

  • Drops startup file

  • Modifies file permissions

    discovery

  • Adds Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification

    defense_evasion

  • Installs/modifies Browser Helper Object

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware

  • Legitimate hosting services abused for malware hosting/C2

  • Mark of the Web detected: This indicates that the page was originally saved or cloned.

    phishingmotw

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory

  • Enumerates processes with tasklist

    discovery

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1