General
- Target 2026-07-02_ccb56d2ca57a2cb81d5ccdef5fd82827_icedid_wannacry
- Size 11.2MB
- Sample260702-jalgzscs2k
- SHA256 0ef1f9143ea254e981db08cdc621e6fe8464cdae62e25c0033f6e539d8fecbe9
Malware Config
Targets
-
- Target 2026-07-02_ccb56d2ca57a2cb81d5ccdef5fd82827_icedid_wannacry
- Size 11.2MB
- SHA256 0ef1f9143ea254e981db08cdc621e6fe8464cdae62e25c0033f6e539d8fecbe9
Score10/10-
UAC bypass
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
-
Detects Windows executables referencing non-Windows User-Agents
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
-
Detects executables calling ClearMyTracksByProcess
-
Detects executables containing commands for clearing Windows Event Logs
-
Detects executables referencing many IR and analysis tools
-
Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
-
UPX dump on OEP (original entry point)
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Suspicious use of SetThreadContext
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Indicator Removal
1File Deletion
1Modify Registry
2