Extracted

• • Target
    Dynamic Lighting BP/scripts/main.js
  • Size 7KB
  • SHA256 0b815be3d754b0f90b119e6afd7a523bbfa2ba3144378f0ea6ac465d3d6cfde7
  • MD5 a8d3cf2b2f23939d7c86b5accff8f61c
  • SHA1 6184d753048ac3f341f48e95298113f75074408a
  • SHA512 886a6da685dc56d294a38a24cbeaa4fcdc8b54c1a95b9c5697f5f7fc15f727ddefc8419cb75cd4ddcf78bae057814b2b1e4c9a3145b1300960e3ec0b2c7e9ffc
  • SSDEEP 96:NmXgECYbQ9uQzzj0Gc0h+covh+cHhYR7vxWoQ9A6bgNBv4oQj4oYNfDHOiPZYRMB:aN2jrc04cov4cH47F3Y89PZRTaC
  • TLSH
    T14FF1DD9D4CE2661C657EFBB676558400FB66C13B419049A5BBBC88727FB80F01053F9C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwaredefense_evasiondiscoveryexecutionwannacryimpactinstallerpersistenceprivilege_escalationransomwarespywarestealertrojanupxworm

  • Family: Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification

    defense_evasion

  • Installs/modifies Browser Helper Object

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Network Service Discovery

    Attempt to gather information on host's network.

    discovery

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Sets desktop wallpaper using registry

    ransomware

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1