General
-
Target
2024-06-30_2e176a8daceac208b023af90fe821b9f_wannacry
-
Size
3.4MB
-
Sample
240630-nybd5szhmq
-
MD5
2e176a8daceac208b023af90fe821b9f
-
SHA1
ea7567140605b39fc3c740f9f780816bf1511b05
-
SHA256
6a10041e438fec4e55fefa6452ccc09aa887e1da819ab97abcb36021d1d213f7
-
SHA512
bfd879e1781c86e3e73de0206f9ff153dd708c5c1414217a6699480c7a942756a8ed6a1ed65887c9418537fab5ae7f6273fa4596ba0e740f77eada9ea9386ef7
-
SSDEEP
98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2g3k:QqPe1Cxcxk3ZAEUadzR8yc4gU
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-30_2e176a8daceac208b023af90fe821b9f_wannacry.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
2024-06-30_2e176a8daceac208b023af90fe821b9f_wannacry.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
C:\Users\Admin\Documents\@[email protected]
wannacry
12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw
Extracted
C:\Users\Admin\AppData\Local\Temp\@[email protected]
wannacry
13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94
Targets
-
-
Target
2024-06-30_2e176a8daceac208b023af90fe821b9f_wannacry
-
Size
3.4MB
-
MD5
2e176a8daceac208b023af90fe821b9f
-
SHA1
ea7567140605b39fc3c740f9f780816bf1511b05
-
SHA256
6a10041e438fec4e55fefa6452ccc09aa887e1da819ab97abcb36021d1d213f7
-
SHA512
bfd879e1781c86e3e73de0206f9ff153dd708c5c1414217a6699480c7a942756a8ed6a1ed65887c9418537fab5ae7f6273fa4596ba0e740f77eada9ea9386ef7
-
SSDEEP
98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2g3k:QqPe1Cxcxk3ZAEUadzR8yc4gU
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Detects command variations typically used by ransomware
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies file permissions
-
Adds Run key to start application
-
File and Directory Permissions Modification: Windows File and Directory Permissions Modification
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1