General
-
Target
Skärmbild 2024-01-01 214243.png
-
Size
325KB
-
Sample
250518-wkcztawm18
-
MD5
06c944901cf04ab82354e6605c5ea928
-
SHA1
053a6f7c743ae5080facca7c9bbc66fa6a06e5ce
-
SHA256
14bf5b30bb1c7a7c1b9456b3c5b0a1c45ea43f89eed0c9f74b5155abf28a3689
-
SHA512
78559130484341bf9eef2ec2a393ae8d3e8ba943718e73aba465571a5f7d92d326f97100965e882d7a99ffbc78a85fb1ed884657faf6b87259213ad53f635e23
-
SSDEEP
6144:73vArMcSXzbpHCD0OE9hHAPDLaoqucA/eLx0NrvxO99DtsFMFCYnhG:7Y4c4zbpiAOErgrLaoB/mx0NrvxOnpeB
Static task
static1
Behavioral task
behavioral1
Sample
Skärmbild 2024-01-01 214243.png
Resource
win10v2004-20250502-en
Behavioral task
behavioral2
Sample
Skärmbild 2024-01-01 214243.png
Resource
win11-20250502-en
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
wannacry
12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw
Targets
-
-
Target
Skärmbild 2024-01-01 214243.png
-
Size
325KB
-
MD5
06c944901cf04ab82354e6605c5ea928
-
SHA1
053a6f7c743ae5080facca7c9bbc66fa6a06e5ce
-
SHA256
14bf5b30bb1c7a7c1b9456b3c5b0a1c45ea43f89eed0c9f74b5155abf28a3689
-
SHA512
78559130484341bf9eef2ec2a393ae8d3e8ba943718e73aba465571a5f7d92d326f97100965e882d7a99ffbc78a85fb1ed884657faf6b87259213ad53f635e23
-
SSDEEP
6144:73vArMcSXzbpHCD0OE9hHAPDLaoqucA/eLx0NrvxO99DtsFMFCYnhG:7Y4c4zbpiAOErgrLaoB/mx0NrvxOnpeB
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Wannacry family
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (105) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Downloads MZ/PE file
-
Drops file in Drivers directory
-
Modifies RDP port number used by Windows
-
Patched UPX-packed file
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
-
Sets service image path in registry
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
Impair Defenses: Safe Mode Boot
-
Loads dropped DLL
-
Modifies file permissions
-
Adds Run key to start application
-
Blocklisted process makes network request
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
File and Directory Permissions Modification: Windows File and Directory Permissions Modification
-
Legitimate hosting services abused for malware hosting/C2
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
File and Directory Permissions Modification
2Windows File and Directory Permissions Modification
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
1Safe Mode Boot
1Indicator Removal
1File Deletion
1Modify Registry
6Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1