Overview

overview

10

Static

static

4186675cb6...82.exe

windows7_x64

10

4186675cb6...82.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4186675cb6706f9d51167fb0f14cd3f8fcfb0065093f62b10a15f7d9a6c8d982

  • Size

    3.6MB

  • Sample

    220708-f54ehabcdl

  • MD5

    5bef35496fcbdbe841c82f4d1ab8b7c2

  • SHA1

    50049556b3406e07347411767d6d01a704b6fee6

  • SHA256

    4186675cb6706f9d51167fb0f14cd3f8fcfb0065093f62b10a15f7d9a6c8d982

  • SHA512

    874424429d6aaac293717ad6d5deadb4227cc5e3c6376bdd362b2f1bee3d28a819c5e9aae991179c6702a0c4fbb7ec5c4a64297b8e9587c3b6cbae0bd0d98225

Score
10/10
wannacrydiscoveryransomwaresuricataworm

Malware Config

Extracted

Path

C:\ProgramData\dlkzpibqectdraf799\@Please_Read_Me@.txt

Family

wannacry

Ransom Note
Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �
Wallets

115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn

Targets

    • Target

      4186675cb6706f9d51167fb0f14cd3f8fcfb0065093f62b10a15f7d9a6c8d982

    • Size

      3.6MB

    • MD5

      5bef35496fcbdbe841c82f4d1ab8b7c2

    • SHA1

      50049556b3406e07347411767d6d01a704b6fee6

    • SHA256

      4186675cb6706f9d51167fb0f14cd3f8fcfb0065093f62b10a15f7d9a6c8d982

    • SHA512

      874424429d6aaac293717ad6d5deadb4227cc5e3c6376bdd362b2f1bee3d28a819c5e9aae991179c6702a0c4fbb7ec5c4a64297b8e9587c3b6cbae0bd0d98225

    Score
    10/10
    suricatawannacrydiscoveryransomwareworm

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • suricata: ET MALWARE Known Sinkhole Response Kryptos Logic

      suricata: ET MALWARE Known Sinkhole Response Kryptos Logic

      suricata

    • suricata: ET MALWARE W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1

      suricata: ET MALWARE W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1

      suricata

    • Executes dropped EXE

    • Modifies file permissions

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1
T1158

Privilege Escalation

Defense Evasion

File Permissions Modification

1
T1222

Hidden Files and Directories

1
T1158

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks