General
-
Target
5393ae32ac0338e591278eeb2cfd05a8140e4d98f8654a6da51646c12acbf3c3.zip
-
Size
3.3MB
-
Sample
250604-prrm8axwgv
-
MD5
18a719130ddc5cf064012edc77d67641
-
SHA1
e7da4aba6a2e45a193c1b0155b2f8558b5bb3c9b
-
SHA256
a4d49a2f67f418612956194bd95cc2a71837d8ee2bba3f528d0c90da5733af47
-
SHA512
3d6e551bf6bc12e98f17ead7fa1837c7a8d4136044586ce0299b278de382002848a1f34837c3966506a4860b27c8938be47d814bcf63c653d54692c1fa6650ed
-
SSDEEP
49152:ef8BytloxqR5mIVK7texeONM/zyLBIwPqlixFVSTAttooaazwp5pv2Bkv2XEYj:yecLV8t+ZM/mPLvSs/najbmfD
Static task
static1
Behavioral task
behavioral1
Sample
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
Resource
win10v2004-20250502-es
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\@[email protected]
wannacry
115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn
Targets
-
-
Target
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
-
Size
3.4MB
-
MD5
84c82835a5d21bbcf75a61706d8ab549
-
SHA1
5ff465afaabcbf0150d1a3ab2c2e74f3a4426467
-
SHA256
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
-
SHA512
90723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244
-
SSDEEP
98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2g3x:QqPe1Cxcxk3ZAEUadzR8yc4gB
-
Wannacry family
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies file permissions
-
Adds Run key to start application
-
File and Directory Permissions Modification: Windows File and Directory Permissions Modification
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
File and Directory Permissions Modification
2Windows File and Directory Permissions Modification
1Hide Artifacts
1Hidden Files and Directories
1Indicator Removal
1File Deletion
1Modify Registry
3Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1