Overview

overview

10

Static

static

disney__va...os.txt

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    disney__valid_combos.txt

  • Size

    18KB

  • Sample

    220826-3qx1habbdk

  • MD5

    f52af7653650c4abb52b3a83eda168b0

  • SHA1

    ba3d5f7aef5a5e5aa456a994f3bfd8d5604a030e

  • SHA256

    65f8627ffed18384566a5489b726d8725a7279e4b62bc3ad15afc28455b3327e

  • SHA512

    d8f64d533fb2fc2ba4937d6db981c5adffd9ef13aee2241c1cdbfb2729c73ae9288c820cf5789c0c2fa57871b1369237a5bcb42f9bc36517ad227f8a7890c199

  • SSDEEP

    384:XAWO6NBYbG2jtjDC91SPDJLTAAc2BQanwtROezuqApI:wWOvbjqSL10p2Pw7OePApI

Score
10/10
wannacrydiscoveryevasionpersistenceransomwarespywarestealertrojanupxworm

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\@Please_Read_Me@.txt
Family

wannacry
Ransom Note Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �
Wallets

12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw

Targets

    • Target

      disney__valid_combos.txt

    • Size

      18KB

    • MD5

      f52af7653650c4abb52b3a83eda168b0

    • SHA1

      ba3d5f7aef5a5e5aa456a994f3bfd8d5604a030e

    • SHA256

      65f8627ffed18384566a5489b726d8725a7279e4b62bc3ad15afc28455b3327e

    • SHA512

      d8f64d533fb2fc2ba4937d6db981c5adffd9ef13aee2241c1cdbfb2729c73ae9288c820cf5789c0c2fa57871b1369237a5bcb42f9bc36517ad227f8a7890c199

    • SSDEEP

      384:XAWO6NBYbG2jtjDC91SPDJLTAAc2BQanwtROezuqApI:wWOvbjqSL10p2Pw7OePApI

    Score
    10/10
    wannacrydiscoveryevasionpersistenceransomwarespywarestealertrojanupxworm

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Wannacry

      WannaCry is a ransomware cryptoworm.

      ransomwarewormwannacry

    • Creates new service(s)

      persistence

    • Downloads MZ/PE file

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Registers COM server for autorun

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Uses Session Manager for persistence

      Creates Session Manager registry key to run executable early in system boot.

      persistence

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      evasiontrojan

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1

MITRE ATT&CK Matrix

Collection

Command and Control

    Credential Access

    Defense Evasion

    Discovery

    Execution

    Exfiltration

      Impact

      Initial Access

        Lateral Movement

          Persistence

          Privilege Escalation

            Tasks