Resubmissions
16/03/2025, 11:14
250316-nb82wsspy4 316/03/2025, 10:39
250316-mp3xcssks8 1016/03/2025, 10:38
250316-mpmkdasks3 10Analysis
-
max time kernel
136s -
max time network
105s -
platform
windows10-ltsc_2021_x64 -
resource
win10ltsc2021-20250314-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system -
submitted
16/03/2025, 11:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
WannaCry2.0-main.zip
Resource
win10ltsc2021-20250314-en
windows10-ltsc_2021-x64
6 signatures
150 seconds
General
-
Target
WannaCry2.0-main.zip
-
Size
3.4MB
-
MD5
8df4da9f105c1efe0312277681ab7657
-
SHA1
2f59ed04ceaca4a13e84edd6d176b2a6e6d6b2ff
-
SHA256
a80032c76c5b96b652ad059098578b5afa4539c665650f2ae073b76657e889e0
-
SHA512
7c012c8b0e123a568631777bfc87cb2f92209d3aa221ed63ef7a07ae38a039f2d63f051190043d0acddd42b75ae2d718e81ea094253fdcf7d638bc52cf767c7d
-
SSDEEP
98304:Phvb2BVmAw0p9jIVcEj5nnZNRyA30yBSRTA:Phvq7Bu6EZnZN5EyBS6
Score
1/10
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2123103809-19148277-2527443841-1000_Classes\Local Settings explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeDebugPrivilege 2252 taskmgr.exe Token: SeSystemProfilePrivilege 2252 taskmgr.exe Token: SeCreateGlobalPrivilege 2252 taskmgr.exe Token: SeRestorePrivilege 5056 7zG.exe Token: 35 5056 7zG.exe Token: SeSecurityPrivilege 5056 7zG.exe Token: SeSecurityPrivilege 5056 7zG.exe Token: SeRestorePrivilege 3892 7zG.exe Token: 35 3892 7zG.exe Token: SeSecurityPrivilege 3892 7zG.exe Token: SeSecurityPrivilege 3892 7zG.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 5056 7zG.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe 2252 taskmgr.exe
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\WannaCry2.0-main.zip1⤵PID:1360
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2252
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" shell:::{52205fd8-5dfb-447d-801a-d0b52f2e83e1}1⤵PID:5192
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
PID:4624
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:936
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap24472:90:7zEvent91981⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5056
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\WannaCry2.0-main\" -an -ai#7zMap18073:130:7zEvent101691⤵
- Suspicious use of AdjustPrivilegeToken
PID:3892
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.3MB
MD5efe76bf09daba2c594d2bc173d9b5cf0
SHA1ba5de52939cb809eae10fdbb7fac47095a9599a7
SHA256707a9f323556179571bc832e34fa592066b1d5f2cac4a7426fe163597e3e618a
SHA5124a1df71925cf2eb49c38f07c6a95bea17752b025f0114c6fd81bc0841c1d1f2965b5dda1469e454b9e8207c2e0dfd3df0959e57166620ccff86eeeb5cf855029