Overview

overview

10

Static

static

WinCrypto ...re.exe

windows7_x64

10

WinCrypto ...re.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    WinCrypto Ransomware.exe

  • Size

    4.4MB

  • Sample

    211213-mp6cgsddh6

  • MD5

    27786f44811d4832d01246e529b94320

  • SHA1

    b31bd516fe0ca01cd139739867ae2c60054dc328

  • SHA256

    5c396be42657aecabd75f8be6ac9b3af96fa1243a4a50214b3543617f39d6c5b

  • SHA512

    1904e09f2a963b725493bb11b9b18f43ffb9e132114bdcd3f05816ee80d50fcca181482bced3fafd739c425b09e6864bec93bbc4ea1365da7ffdb1dc81734dea

Score
10/10
persistenceransomware

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\README WINCRYPTO.txt

Ransom Note
WINCRYPTO RANSOMWARE YOUR DOCUMENTS, PHOTOS, DATABASES AND OTHER IMPORTANT FILES HAS BEEN ENCRYPTED! THE ONLY WAY TO DECRYPT YOUR FILES IS TO RECEIVE THE PRIVATE KEY AND DECRYPTION SOFTWARE. TO RECEIVE THE PRIVATE KEY AND DECRYPTION SOFTWARE GO TO ANY DECRYPTED FOLDER - INSIDE THERE IS THE SPECIAL FILE 'README WINCRYPTO.TXT' WITH COMPLETE INSTRUCTIONS HOW TO DECRYPT YOUR FILES. IF YOU CANNOT FIND ANY 'README WINCRYPTO.TXT' FILE AT YOUR PC. FOLLOW THE INSTRUCTIONS BELOW. 1. DOWNLOAD 'TOR BROWSER' FROM 'HTTPS://TORPROJECT.ORG' AND INSTALL IT. 2. IN THE 'TOR BROWSER' OPEN YOUR PERSONAL PAGE HERE. HTTPS://WINCRYPTO23XA93KU9234XN.ONION/7U2D-23MA-0M8C-M2AS NOTE! THIS PAGE IS AVAILABLE VIA 'TOR BROWSER' ONLY. FILE RECOVERY IS IMPOSSIBLE WHEN ANTI-VIRUS IS ACTIVATED AND THIS SOFTWARE IS TERMINATED!

Targets

    • Target

      WinCrypto Ransomware.exe

    • Size

      4.4MB

    • MD5

      27786f44811d4832d01246e529b94320

    • SHA1

      b31bd516fe0ca01cd139739867ae2c60054dc328

    • SHA256

      5c396be42657aecabd75f8be6ac9b3af96fa1243a4a50214b3543617f39d6c5b

    • SHA512

      1904e09f2a963b725493bb11b9b18f43ffb9e132114bdcd3f05816ee80d50fcca181482bced3fafd739c425b09e6864bec93bbc4ea1365da7ffdb1dc81734dea

    Score
    10/10
    persistenceransomware

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks